diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
deleted file mode 100644
index b920e1793..000000000
--- a/.github/FUNDING.yml
+++ /dev/null
@@ -1,3 +0,0 @@
-# These are supported funding model platforms
-
-github: traefik
diff --git a/.github/ISSUE_TEMPLATE.md b/.github/ISSUE_TEMPLATE.md
deleted file mode 100644
index 8d124b341..000000000
--- a/.github/ISSUE_TEMPLATE.md
+++ /dev/null
@@ -1,77 +0,0 @@
-
-
-### Do you want to request a *feature* or report a *bug*?
-
-
-
-Bug
-
-
-
-### What did you do?
-
-
-
-### What did you expect to see?
-
-
-
-### What did you see instead?
-
-
-
-### Output of `traefik version`: (_What version of Traefik are you using?_)
-
-
-
-```
-(paste your output here)
-```
-
-### What is your environment & configuration (arguments, toml, provider, platform, ...)?
-
-```toml
-# (paste your configuration here)
-```
-
-
-
-
-### If applicable, please paste the log output in DEBUG level (`--log.level=DEBUG` switch)
-
-```
-(paste your output here)
-```
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
deleted file mode 100644
index ce21d35ee..000000000
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ /dev/null
@@ -1,82 +0,0 @@
-name: Bug Report (Traefik)
-description: Create a report to help us improve.
-body:
- - type: checkboxes
- id: terms
- attributes:
- label: Welcome!
- description: |
- The issue tracker is for reporting bugs and feature requests only.
- For end-user related support questions, please use the [Traefik community forum](https://community.traefik.io/).
-
- All new/updated issues are triaged regularly by the maintainers.
- All issues closed by a bot are subsequently double-checked by the maintainers.
-
- DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
-
- options:
- - label: Yes, I've searched similar issues on [GitHub](https://github.com/traefik/traefik/issues) and didn't find any.
- required: true
- - label: Yes, I've searched similar issues on the [Traefik community forum](https://community.traefik.io) and didn't find any.
- required: true
-
- - type: textarea
- attributes:
- label: What did you do?
- description: |
- How to write a good bug report?
-
- - Respect the issue template as much as possible.
- - The title should be short and descriptive.
- - Explain the conditions which led you to report this issue: the context.
- - The context should lead to something, an idea or a problem that you’re facing.
- - Remain clear and concise.
- - Format your messages to help the reader focus on what matters and understand the structure of your message, use [Markdown syntax](https://help.github.com/articles/github-flavored-markdown)
- placeholder: What did you do?
- validations:
- required: true
-
- - type: textarea
- attributes:
- label: What did you see instead?
- placeholder: What did you see instead?
- validations:
- required: true
-
- - type: textarea
- attributes:
- label: What version of Traefik are you using?
- description: |
- `latest` is not considered as a valid version.
-
- Output of `traefik version`.
-
- For the Traefik Docker image (`docker run [IMAGE] version`), example:
- ```console
- $ docker run traefik version
- ```
- placeholder: Paste your output here.
- validations:
- required: true
-
- - type: textarea
- attributes:
- label: What is your environment & configuration?
- description: arguments, toml, provider, platform, ...
- placeholder: Add information here.
- value: |
- ```yaml
- # (paste your configuration here)
- ```
-
- Add more configuration information here.
- validations:
- required: true
-
- - type: textarea
- attributes:
- label: If applicable, please paste the log output in DEBUG level
- description: "`--log.level=DEBUG` switch."
- placeholder: Paste your output here.
- validations:
- required: false
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
deleted file mode 100644
index 80c8c86b5..000000000
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-blank_issues_enabled: false
-contact_links:
- - name: Traefik Community Support
- url: https://community.traefik.io/
- about: If you have a question, or are looking for advice, please post on our Discuss forum! The community loves to chime in to help. Happy Coding!
- - name: Traefik Helm Chart Issues
- url: https://github.com/traefik/traefik-helm-chart
- about: Are you submitting an issue or feature enhancement for the Traefik helm chart? Please post in the traefik-helm-chart GitHub Issues.
diff --git a/.github/ISSUE_TEMPLATE/feature-request.yml b/.github/ISSUE_TEMPLATE/feature-request.yml
deleted file mode 100644
index 5a092594d..000000000
--- a/.github/ISSUE_TEMPLATE/feature-request.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-name: Feature Request (Traefik)
-description: Suggest an idea for this project.
-body:
- - type: checkboxes
- id: terms
- attributes:
- label: Welcome!
- description: |
- The issue tracker is for reporting bugs and feature requests only. For end-user related support questions, please refer to one of the following:
- - the Traefik community forum: https://community.traefik.io/
-
- DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
- options:
- - label: Yes, I've searched similar issues on [GitHub](https://github.com/traefik/traefik/issues) and didn't find any.
- required: true
- - label: Yes, I've searched similar issues on the [Traefik community forum](https://community.traefik.io) and didn't find any.
- required: true
-
- - type: textarea
- attributes:
- label: What did you expect to see?
- description: |
- How to write a good issue?
-
- - Respect the issue template as much as possible.
- - The title should be short and descriptive.
- - Explain the conditions which led you to report this issue: the context.
- - The context should lead to something, an idea or a problem that you’re facing.
- - Remain clear and concise.
- - Format your messages to help the reader focus on what matters and understand the structure of your message, use [Markdown syntax](https://help.github.com/articles/github-flavored-markdown)
- placeholder: What did you expect to see?
- validations:
- required: true
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 2594684f6..b4717dc18 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,17 +1,16 @@
-| `traefik/http/middlewares/Middleware01/addPrefix/prefix` | `foobar` |
-| `traefik/http/middlewares/Middleware02/basicAuth/headerField` | `foobar` |
-| `traefik/http/middlewares/Middleware02/basicAuth/realm` | `foobar` |
-| `traefik/http/middlewares/Middleware02/basicAuth/removeHeader` | `true` |
-| `traefik/http/middlewares/Middleware02/basicAuth/users/0` | `foobar` |
-| `traefik/http/middlewares/Middleware02/basicAuth/users/1` | `foobar` |
-| `traefik/http/middlewares/Middleware02/basicAuth/usersFile` | `foobar` |
-| `traefik/http/middlewares/Middleware03/buffering/maxRequestBodyBytes` | `42` |
-| `traefik/http/middlewares/Middleware03/buffering/maxResponseBodyBytes` | `42` |
-| `traefik/http/middlewares/Middleware03/buffering/memRequestBodyBytes` | `42` |
-| `traefik/http/middlewares/Middleware03/buffering/memResponseBodyBytes` | `42` |
-| `traefik/http/middlewares/Middleware03/buffering/retryExpression` | `foobar` |
-| `traefik/http/middlewares/Middleware04/chain/middlewares/0` | `foobar` |
-| `traefik/http/middlewares/Middleware04/chain/middlewares/1` | `foobar` |
-| `traefik/http/middlewares/Middleware05/circuitBreaker/checkPeriod` | `42s` |
-| `traefik/http/middlewares/Middleware05/circuitBreaker/expression` | `foobar` |
-| `traefik/http/middlewares/Middleware05/circuitBreaker/fallbackDuration` | `42s` |
-| `traefik/http/middlewares/Middleware05/circuitBreaker/recoveryDuration` | `42s` |
-| `traefik/http/middlewares/Middleware05/circuitBreaker/responseCode` | `42` |
-| `traefik/http/middlewares/Middleware06/compress/defaultEncoding` | `foobar` |
-| `traefik/http/middlewares/Middleware06/compress/encodings/0` | `foobar` |
-| `traefik/http/middlewares/Middleware06/compress/encodings/1` | `foobar` |
-| `traefik/http/middlewares/Middleware06/compress/excludedContentTypes/0` | `foobar` |
-| `traefik/http/middlewares/Middleware06/compress/excludedContentTypes/1` | `foobar` |
-| `traefik/http/middlewares/Middleware06/compress/includedContentTypes/0` | `foobar` |
-| `traefik/http/middlewares/Middleware06/compress/includedContentTypes/1` | `foobar` |
-| `traefik/http/middlewares/Middleware06/compress/minResponseBodyBytes` | `42` |
-| `traefik/http/middlewares/Middleware07/contentType/autoDetect` | `true` |
-| `traefik/http/middlewares/Middleware08/digestAuth/headerField` | `foobar` |
-| `traefik/http/middlewares/Middleware08/digestAuth/realm` | `foobar` |
-| `traefik/http/middlewares/Middleware08/digestAuth/removeHeader` | `true` |
-| `traefik/http/middlewares/Middleware08/digestAuth/users/0` | `foobar` |
-| `traefik/http/middlewares/Middleware08/digestAuth/users/1` | `foobar` |
-| `traefik/http/middlewares/Middleware08/digestAuth/usersFile` | `foobar` |
-| `traefik/http/middlewares/Middleware09/errors/query` | `foobar` |
-| `traefik/http/middlewares/Middleware09/errors/service` | `foobar` |
-| `traefik/http/middlewares/Middleware09/errors/status/0` | `foobar` |
-| `traefik/http/middlewares/Middleware09/errors/status/1` | `foobar` |
-| `traefik/http/middlewares/Middleware09/errors/statusRewrites/name0` | `42` |
-| `traefik/http/middlewares/Middleware09/errors/statusRewrites/name1` | `42` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/addAuthCookiesToResponse/0` | `foobar` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/addAuthCookiesToResponse/1` | `foobar` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/address` | `foobar` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/authRequestHeaders/0` | `foobar` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/authRequestHeaders/1` | `foobar` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/authResponseHeaders/0` | `foobar` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/authResponseHeaders/1` | `foobar` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/authResponseHeadersRegex` | `foobar` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/forwardBody` | `true` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/headerField` | `foobar` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/maxBodySize` | `42` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/preserveLocationHeader` | `true` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/preserveRequestMethod` | `true` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/tls/ca` | `foobar` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/tls/caOptional` | `true` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/tls/cert` | `foobar` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/tls/insecureSkipVerify` | `true` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/tls/key` | `foobar` |
-| `traefik/http/middlewares/Middleware10/forwardAuth/trustForwardHeader` | `true` |
-| `traefik/http/middlewares/Middleware11/grpcWeb/allowOrigins/0` | `foobar` |
-| `traefik/http/middlewares/Middleware11/grpcWeb/allowOrigins/1` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/accessControlAllowCredentials` | `true` |
-| `traefik/http/middlewares/Middleware12/headers/accessControlAllowHeaders/0` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/accessControlAllowHeaders/1` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/accessControlAllowMethods/0` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/accessControlAllowMethods/1` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/accessControlAllowOriginList/0` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/accessControlAllowOriginList/1` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/accessControlAllowOriginListRegex/0` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/accessControlAllowOriginListRegex/1` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/accessControlExposeHeaders/0` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/accessControlExposeHeaders/1` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/accessControlMaxAge` | `42` |
-| `traefik/http/middlewares/Middleware12/headers/addVaryHeader` | `true` |
-| `traefik/http/middlewares/Middleware12/headers/allowedHosts/0` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/allowedHosts/1` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/browserXssFilter` | `true` |
-| `traefik/http/middlewares/Middleware12/headers/contentSecurityPolicy` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/contentSecurityPolicyReportOnly` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/contentTypeNosniff` | `true` |
-| `traefik/http/middlewares/Middleware12/headers/customBrowserXSSValue` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/customFrameOptionsValue` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/customRequestHeaders/name0` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/customRequestHeaders/name1` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/customResponseHeaders/name0` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/customResponseHeaders/name1` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/featurePolicy` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/forceSTSHeader` | `true` |
-| `traefik/http/middlewares/Middleware12/headers/frameDeny` | `true` |
-| `traefik/http/middlewares/Middleware12/headers/hostsProxyHeaders/0` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/hostsProxyHeaders/1` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/isDevelopment` | `true` |
-| `traefik/http/middlewares/Middleware12/headers/permissionsPolicy` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/publicKey` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/referrerPolicy` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/sslForceHost` | `true` |
-| `traefik/http/middlewares/Middleware12/headers/sslHost` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/sslProxyHeaders/name0` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/sslProxyHeaders/name1` | `foobar` |
-| `traefik/http/middlewares/Middleware12/headers/sslRedirect` | `true` |
-| `traefik/http/middlewares/Middleware12/headers/sslTemporaryRedirect` | `true` |
-| `traefik/http/middlewares/Middleware12/headers/stsIncludeSubdomains` | `true` |
-| `traefik/http/middlewares/Middleware12/headers/stsPreload` | `true` |
-| `traefik/http/middlewares/Middleware12/headers/stsSeconds` | `42` |
-| `traefik/http/middlewares/Middleware13/ipAllowList/ipStrategy/depth` | `42` |
-| `traefik/http/middlewares/Middleware13/ipAllowList/ipStrategy/excludedIPs/0` | `foobar` |
-| `traefik/http/middlewares/Middleware13/ipAllowList/ipStrategy/excludedIPs/1` | `foobar` |
-| `traefik/http/middlewares/Middleware13/ipAllowList/ipStrategy/ipv6Subnet` | `42` |
-| `traefik/http/middlewares/Middleware13/ipAllowList/rejectStatusCode` | `42` |
-| `traefik/http/middlewares/Middleware13/ipAllowList/sourceRange/0` | `foobar` |
-| `traefik/http/middlewares/Middleware13/ipAllowList/sourceRange/1` | `foobar` |
-| `traefik/http/middlewares/Middleware14/ipWhiteList/ipStrategy/depth` | `42` |
-| `traefik/http/middlewares/Middleware14/ipWhiteList/ipStrategy/excludedIPs/0` | `foobar` |
-| `traefik/http/middlewares/Middleware14/ipWhiteList/ipStrategy/excludedIPs/1` | `foobar` |
-| `traefik/http/middlewares/Middleware14/ipWhiteList/ipStrategy/ipv6Subnet` | `42` |
-| `traefik/http/middlewares/Middleware14/ipWhiteList/sourceRange/0` | `foobar` |
-| `traefik/http/middlewares/Middleware14/ipWhiteList/sourceRange/1` | `foobar` |
-| `traefik/http/middlewares/Middleware15/inFlightReq/amount` | `42` |
-| `traefik/http/middlewares/Middleware15/inFlightReq/sourceCriterion/ipStrategy/depth` | `42` |
-| `traefik/http/middlewares/Middleware15/inFlightReq/sourceCriterion/ipStrategy/excludedIPs/0` | `foobar` |
-| `traefik/http/middlewares/Middleware15/inFlightReq/sourceCriterion/ipStrategy/excludedIPs/1` | `foobar` |
-| `traefik/http/middlewares/Middleware15/inFlightReq/sourceCriterion/ipStrategy/ipv6Subnet` | `42` |
-| `traefik/http/middlewares/Middleware15/inFlightReq/sourceCriterion/requestHeaderName` | `foobar` |
-| `traefik/http/middlewares/Middleware15/inFlightReq/sourceCriterion/requestHost` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/issuer/commonName` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/issuer/country` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/issuer/domainComponent` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/issuer/locality` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/issuer/organization` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/issuer/province` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/issuer/serialNumber` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/notAfter` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/notBefore` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/sans` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/serialNumber` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/commonName` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/country` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/domainComponent` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/locality` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/organization` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/organizationalUnit` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/province` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/serialNumber` | `true` |
-| `traefik/http/middlewares/Middleware16/passTLSClientCert/pem` | `true` |
-| `traefik/http/middlewares/Middleware17/plugin/PluginConf0/name0` | `foobar` |
-| `traefik/http/middlewares/Middleware17/plugin/PluginConf0/name1` | `foobar` |
-| `traefik/http/middlewares/Middleware17/plugin/PluginConf1/name0` | `foobar` |
-| `traefik/http/middlewares/Middleware17/plugin/PluginConf1/name1` | `foobar` |
-| `traefik/http/middlewares/Middleware18/rateLimit/average` | `42` |
-| `traefik/http/middlewares/Middleware18/rateLimit/burst` | `42` |
-| `traefik/http/middlewares/Middleware18/rateLimit/period` | `42s` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/db` | `42` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/dialTimeout` | `42s` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/endpoints/0` | `foobar` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/endpoints/1` | `foobar` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/maxActiveConns` | `42` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/minIdleConns` | `42` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/password` | `foobar` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/poolSize` | `42` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/readTimeout` | `42s` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/tls/ca` | `foobar` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/tls/cert` | `foobar` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/tls/insecureSkipVerify` | `true` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/tls/key` | `foobar` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/username` | `foobar` |
-| `traefik/http/middlewares/Middleware18/rateLimit/redis/writeTimeout` | `42s` |
-| `traefik/http/middlewares/Middleware18/rateLimit/sourceCriterion/ipStrategy/depth` | `42` |
-| `traefik/http/middlewares/Middleware18/rateLimit/sourceCriterion/ipStrategy/excludedIPs/0` | `foobar` |
-| `traefik/http/middlewares/Middleware18/rateLimit/sourceCriterion/ipStrategy/excludedIPs/1` | `foobar` |
-| `traefik/http/middlewares/Middleware18/rateLimit/sourceCriterion/ipStrategy/ipv6Subnet` | `42` |
-| `traefik/http/middlewares/Middleware18/rateLimit/sourceCriterion/requestHeaderName` | `foobar` |
-| `traefik/http/middlewares/Middleware18/rateLimit/sourceCriterion/requestHost` | `true` |
-| `traefik/http/middlewares/Middleware19/redirectRegex/permanent` | `true` |
-| `traefik/http/middlewares/Middleware19/redirectRegex/regex` | `foobar` |
-| `traefik/http/middlewares/Middleware19/redirectRegex/replacement` | `foobar` |
-| `traefik/http/middlewares/Middleware20/redirectScheme/permanent` | `true` |
-| `traefik/http/middlewares/Middleware20/redirectScheme/port` | `foobar` |
-| `traefik/http/middlewares/Middleware20/redirectScheme/scheme` | `foobar` |
-| `traefik/http/middlewares/Middleware21/replacePath/path` | `foobar` |
-| `traefik/http/middlewares/Middleware22/replacePathRegex/regex` | `foobar` |
-| `traefik/http/middlewares/Middleware22/replacePathRegex/replacement` | `foobar` |
-| `traefik/http/middlewares/Middleware23/retry/attempts` | `42` |
-| `traefik/http/middlewares/Middleware23/retry/initialInterval` | `42s` |
-| `traefik/http/middlewares/Middleware24/stripPrefix/forceSlash` | `true` |
-| `traefik/http/middlewares/Middleware24/stripPrefix/prefixes/0` | `foobar` |
-| `traefik/http/middlewares/Middleware24/stripPrefix/prefixes/1` | `foobar` |
-| `traefik/http/middlewares/Middleware25/stripPrefixRegex/regex/0` | `foobar` |
-| `traefik/http/middlewares/Middleware25/stripPrefixRegex/regex/1` | `foobar` |
-| `traefik/http/routers/Router0/entryPoints/0` | `foobar` |
-| `traefik/http/routers/Router0/entryPoints/1` | `foobar` |
-| `traefik/http/routers/Router0/middlewares/0` | `foobar` |
-| `traefik/http/routers/Router0/middlewares/1` | `foobar` |
-| `traefik/http/routers/Router0/observability/accessLogs` | `true` |
-| `traefik/http/routers/Router0/observability/metrics` | `true` |
-| `traefik/http/routers/Router0/observability/tracing` | `true` |
-| `traefik/http/routers/Router0/priority` | `42` |
-| `traefik/http/routers/Router0/rule` | `foobar` |
-| `traefik/http/routers/Router0/ruleSyntax` | `foobar` |
-| `traefik/http/routers/Router0/service` | `foobar` |
-| `traefik/http/routers/Router0/tls/certResolver` | `foobar` |
-| `traefik/http/routers/Router0/tls/domains/0/main` | `foobar` |
-| `traefik/http/routers/Router0/tls/domains/0/sans/0` | `foobar` |
-| `traefik/http/routers/Router0/tls/domains/0/sans/1` | `foobar` |
-| `traefik/http/routers/Router0/tls/domains/1/main` | `foobar` |
-| `traefik/http/routers/Router0/tls/domains/1/sans/0` | `foobar` |
-| `traefik/http/routers/Router0/tls/domains/1/sans/1` | `foobar` |
-| `traefik/http/routers/Router0/tls/options` | `foobar` |
-| `traefik/http/routers/Router1/entryPoints/0` | `foobar` |
-| `traefik/http/routers/Router1/entryPoints/1` | `foobar` |
-| `traefik/http/routers/Router1/middlewares/0` | `foobar` |
-| `traefik/http/routers/Router1/middlewares/1` | `foobar` |
-| `traefik/http/routers/Router1/observability/accessLogs` | `true` |
-| `traefik/http/routers/Router1/observability/metrics` | `true` |
-| `traefik/http/routers/Router1/observability/tracing` | `true` |
-| `traefik/http/routers/Router1/priority` | `42` |
-| `traefik/http/routers/Router1/rule` | `foobar` |
-| `traefik/http/routers/Router1/ruleSyntax` | `foobar` |
-| `traefik/http/routers/Router1/service` | `foobar` |
-| `traefik/http/routers/Router1/tls/certResolver` | `foobar` |
-| `traefik/http/routers/Router1/tls/domains/0/main` | `foobar` |
-| `traefik/http/routers/Router1/tls/domains/0/sans/0` | `foobar` |
-| `traefik/http/routers/Router1/tls/domains/0/sans/1` | `foobar` |
-| `traefik/http/routers/Router1/tls/domains/1/main` | `foobar` |
-| `traefik/http/routers/Router1/tls/domains/1/sans/0` | `foobar` |
-| `traefik/http/routers/Router1/tls/domains/1/sans/1` | `foobar` |
-| `traefik/http/routers/Router1/tls/options` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport0/certificates/0/certFile` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport0/certificates/0/keyFile` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport0/certificates/1/certFile` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport0/certificates/1/keyFile` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport0/disableHTTP2` | `true` |
-| `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/dialTimeout` | `42s` |
-| `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/idleConnTimeout` | `42s` |
-| `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/pingTimeout` | `42s` |
-| `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/readIdleTimeout` | `42s` |
-| `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/responseHeaderTimeout` | `42s` |
-| `traefik/http/serversTransports/ServersTransport0/insecureSkipVerify` | `true` |
-| `traefik/http/serversTransports/ServersTransport0/maxIdleConnsPerHost` | `42` |
-| `traefik/http/serversTransports/ServersTransport0/peerCertURI` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport0/rootCAs/0` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport0/rootCAs/1` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport0/serverName` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport0/spiffe/ids/0` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport0/spiffe/ids/1` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport0/spiffe/trustDomain` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport1/certificates/0/certFile` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport1/certificates/0/keyFile` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport1/certificates/1/certFile` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport1/certificates/1/keyFile` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport1/disableHTTP2` | `true` |
-| `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/dialTimeout` | `42s` |
-| `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/idleConnTimeout` | `42s` |
-| `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/pingTimeout` | `42s` |
-| `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/readIdleTimeout` | `42s` |
-| `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/responseHeaderTimeout` | `42s` |
-| `traefik/http/serversTransports/ServersTransport1/insecureSkipVerify` | `true` |
-| `traefik/http/serversTransports/ServersTransport1/maxIdleConnsPerHost` | `42` |
-| `traefik/http/serversTransports/ServersTransport1/peerCertURI` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport1/rootCAs/0` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport1/rootCAs/1` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport1/serverName` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport1/spiffe/ids/0` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport1/spiffe/ids/1` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport1/spiffe/trustDomain` | `foobar` |
-| `traefik/http/services/Service01/failover/fallback` | `foobar` |
-| `traefik/http/services/Service01/failover/healthCheck` | `` |
-| `traefik/http/services/Service01/failover/service` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/healthCheck/followRedirects` | `true` |
-| `traefik/http/services/Service02/loadBalancer/healthCheck/headers/name0` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/healthCheck/headers/name1` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/healthCheck/hostname` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/healthCheck/interval` | `42s` |
-| `traefik/http/services/Service02/loadBalancer/healthCheck/method` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/healthCheck/mode` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/healthCheck/path` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/healthCheck/port` | `42` |
-| `traefik/http/services/Service02/loadBalancer/healthCheck/scheme` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/healthCheck/status` | `42` |
-| `traefik/http/services/Service02/loadBalancer/healthCheck/timeout` | `42s` |
-| `traefik/http/services/Service02/loadBalancer/passHostHeader` | `true` |
-| `traefik/http/services/Service02/loadBalancer/responseForwarding/flushInterval` | `42s` |
-| `traefik/http/services/Service02/loadBalancer/servers/0/preservePath` | `true` |
-| `traefik/http/services/Service02/loadBalancer/servers/0/url` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/servers/0/weight` | `42` |
-| `traefik/http/services/Service02/loadBalancer/servers/1/preservePath` | `true` |
-| `traefik/http/services/Service02/loadBalancer/servers/1/url` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/servers/1/weight` | `42` |
-| `traefik/http/services/Service02/loadBalancer/serversTransport` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/sticky/cookie/domain` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/sticky/cookie/httpOnly` | `true` |
-| `traefik/http/services/Service02/loadBalancer/sticky/cookie/maxAge` | `42` |
-| `traefik/http/services/Service02/loadBalancer/sticky/cookie/name` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/sticky/cookie/path` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/sticky/cookie/sameSite` | `foobar` |
-| `traefik/http/services/Service02/loadBalancer/sticky/cookie/secure` | `true` |
-| `traefik/http/services/Service02/loadBalancer/strategy` | `foobar` |
-| `traefik/http/services/Service03/mirroring/healthCheck` | `` |
-| `traefik/http/services/Service03/mirroring/maxBodySize` | `42` |
-| `traefik/http/services/Service03/mirroring/mirrorBody` | `true` |
-| `traefik/http/services/Service03/mirroring/mirrors/0/name` | `foobar` |
-| `traefik/http/services/Service03/mirroring/mirrors/0/percent` | `42` |
-| `traefik/http/services/Service03/mirroring/mirrors/1/name` | `foobar` |
-| `traefik/http/services/Service03/mirroring/mirrors/1/percent` | `42` |
-| `traefik/http/services/Service03/mirroring/service` | `foobar` |
-| `traefik/http/services/Service04/weighted/healthCheck` | `` |
-| `traefik/http/services/Service04/weighted/services/0/name` | `foobar` |
-| `traefik/http/services/Service04/weighted/services/0/weight` | `42` |
-| `traefik/http/services/Service04/weighted/services/1/name` | `foobar` |
-| `traefik/http/services/Service04/weighted/services/1/weight` | `42` |
-| `traefik/http/services/Service04/weighted/sticky/cookie/domain` | `foobar` |
-| `traefik/http/services/Service04/weighted/sticky/cookie/httpOnly` | `true` |
-| `traefik/http/services/Service04/weighted/sticky/cookie/maxAge` | `42` |
-| `traefik/http/services/Service04/weighted/sticky/cookie/name` | `foobar` |
-| `traefik/http/services/Service04/weighted/sticky/cookie/path` | `foobar` |
-| `traefik/http/services/Service04/weighted/sticky/cookie/sameSite` | `foobar` |
-| `traefik/http/services/Service04/weighted/sticky/cookie/secure` | `true` |
-| `traefik/tcp/middlewares/TCPMiddleware01/ipAllowList/sourceRange/0` | `foobar` |
-| `traefik/tcp/middlewares/TCPMiddleware01/ipAllowList/sourceRange/1` | `foobar` |
-| `traefik/tcp/middlewares/TCPMiddleware02/ipWhiteList/sourceRange/0` | `foobar` |
-| `traefik/tcp/middlewares/TCPMiddleware02/ipWhiteList/sourceRange/1` | `foobar` |
-| `traefik/tcp/middlewares/TCPMiddleware03/inFlightConn/amount` | `42` |
-| `traefik/tcp/routers/TCPRouter0/entryPoints/0` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/entryPoints/1` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/middlewares/0` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/middlewares/1` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/priority` | `42` |
-| `traefik/tcp/routers/TCPRouter0/rule` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/ruleSyntax` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/service` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/tls/certResolver` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/tls/domains/0/main` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/tls/domains/0/sans/0` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/tls/domains/0/sans/1` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/tls/domains/1/main` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/tls/domains/1/sans/0` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/tls/domains/1/sans/1` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/tls/options` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/tls/passthrough` | `true` |
-| `traefik/tcp/routers/TCPRouter1/entryPoints/0` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/entryPoints/1` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/middlewares/0` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/middlewares/1` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/priority` | `42` |
-| `traefik/tcp/routers/TCPRouter1/rule` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/ruleSyntax` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/service` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/tls/certResolver` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/tls/domains/0/main` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/tls/domains/0/sans/0` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/tls/domains/0/sans/1` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/tls/domains/1/main` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/tls/domains/1/sans/0` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/tls/domains/1/sans/1` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/tls/options` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/tls/passthrough` | `true` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/dialKeepAlive` | `42s` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/dialTimeout` | `42s` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/terminationDelay` | `42s` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/tls/certificates/0/certFile` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/tls/certificates/0/keyFile` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/tls/certificates/1/certFile` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/tls/certificates/1/keyFile` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/tls/insecureSkipVerify` | `true` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/tls/peerCertURI` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/tls/rootCAs/0` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/tls/rootCAs/1` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/tls/serverName` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/tls/spiffe/ids/0` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/tls/spiffe/ids/1` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport0/tls/spiffe/trustDomain` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/dialKeepAlive` | `42s` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/dialTimeout` | `42s` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/terminationDelay` | `42s` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/tls/certificates/0/certFile` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/tls/certificates/0/keyFile` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/tls/certificates/1/certFile` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/tls/certificates/1/keyFile` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/tls/insecureSkipVerify` | `true` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/tls/peerCertURI` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/tls/rootCAs/0` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/tls/rootCAs/1` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/tls/serverName` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/tls/spiffe/ids/0` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/tls/spiffe/ids/1` | `foobar` |
-| `traefik/tcp/serversTransports/TCPServersTransport1/tls/spiffe/trustDomain` | `foobar` |
-| `traefik/tcp/services/TCPService01/loadBalancer/proxyProtocol/version` | `42` |
-| `traefik/tcp/services/TCPService01/loadBalancer/servers/0/address` | `foobar` |
-| `traefik/tcp/services/TCPService01/loadBalancer/servers/0/tls` | `true` |
-| `traefik/tcp/services/TCPService01/loadBalancer/servers/1/address` | `foobar` |
-| `traefik/tcp/services/TCPService01/loadBalancer/servers/1/tls` | `true` |
-| `traefik/tcp/services/TCPService01/loadBalancer/serversTransport` | `foobar` |
-| `traefik/tcp/services/TCPService01/loadBalancer/terminationDelay` | `42` |
-| `traefik/tcp/services/TCPService02/weighted/services/0/name` | `foobar` |
-| `traefik/tcp/services/TCPService02/weighted/services/0/weight` | `42` |
-| `traefik/tcp/services/TCPService02/weighted/services/1/name` | `foobar` |
-| `traefik/tcp/services/TCPService02/weighted/services/1/weight` | `42` |
-| `traefik/tls/certificates/0/certFile` | `foobar` |
-| `traefik/tls/certificates/0/keyFile` | `foobar` |
-| `traefik/tls/certificates/0/stores/0` | `foobar` |
-| `traefik/tls/certificates/0/stores/1` | `foobar` |
-| `traefik/tls/certificates/1/certFile` | `foobar` |
-| `traefik/tls/certificates/1/keyFile` | `foobar` |
-| `traefik/tls/certificates/1/stores/0` | `foobar` |
-| `traefik/tls/certificates/1/stores/1` | `foobar` |
-| `traefik/tls/options/Options0/alpnProtocols/0` | `foobar` |
-| `traefik/tls/options/Options0/alpnProtocols/1` | `foobar` |
-| `traefik/tls/options/Options0/cipherSuites/0` | `foobar` |
-| `traefik/tls/options/Options0/cipherSuites/1` | `foobar` |
-| `traefik/tls/options/Options0/clientAuth/caFiles/0` | `foobar` |
-| `traefik/tls/options/Options0/clientAuth/caFiles/1` | `foobar` |
-| `traefik/tls/options/Options0/clientAuth/clientAuthType` | `foobar` |
-| `traefik/tls/options/Options0/curvePreferences/0` | `foobar` |
-| `traefik/tls/options/Options0/curvePreferences/1` | `foobar` |
-| `traefik/tls/options/Options0/disableSessionTickets` | `true` |
-| `traefik/tls/options/Options0/maxVersion` | `foobar` |
-| `traefik/tls/options/Options0/minVersion` | `foobar` |
-| `traefik/tls/options/Options0/preferServerCipherSuites` | `true` |
-| `traefik/tls/options/Options0/sniStrict` | `true` |
-| `traefik/tls/options/Options1/alpnProtocols/0` | `foobar` |
-| `traefik/tls/options/Options1/alpnProtocols/1` | `foobar` |
-| `traefik/tls/options/Options1/cipherSuites/0` | `foobar` |
-| `traefik/tls/options/Options1/cipherSuites/1` | `foobar` |
-| `traefik/tls/options/Options1/clientAuth/caFiles/0` | `foobar` |
-| `traefik/tls/options/Options1/clientAuth/caFiles/1` | `foobar` |
-| `traefik/tls/options/Options1/clientAuth/clientAuthType` | `foobar` |
-| `traefik/tls/options/Options1/curvePreferences/0` | `foobar` |
-| `traefik/tls/options/Options1/curvePreferences/1` | `foobar` |
-| `traefik/tls/options/Options1/disableSessionTickets` | `true` |
-| `traefik/tls/options/Options1/maxVersion` | `foobar` |
-| `traefik/tls/options/Options1/minVersion` | `foobar` |
-| `traefik/tls/options/Options1/preferServerCipherSuites` | `true` |
-| `traefik/tls/options/Options1/sniStrict` | `true` |
-| `traefik/tls/stores/Store0/defaultCertificate/certFile` | `foobar` |
-| `traefik/tls/stores/Store0/defaultCertificate/keyFile` | `foobar` |
-| `traefik/tls/stores/Store0/defaultGeneratedCert/domain/main` | `foobar` |
-| `traefik/tls/stores/Store0/defaultGeneratedCert/domain/sans/0` | `foobar` |
-| `traefik/tls/stores/Store0/defaultGeneratedCert/domain/sans/1` | `foobar` |
-| `traefik/tls/stores/Store0/defaultGeneratedCert/resolver` | `foobar` |
-| `traefik/tls/stores/Store1/defaultCertificate/certFile` | `foobar` |
-| `traefik/tls/stores/Store1/defaultCertificate/keyFile` | `foobar` |
-| `traefik/tls/stores/Store1/defaultGeneratedCert/domain/main` | `foobar` |
-| `traefik/tls/stores/Store1/defaultGeneratedCert/domain/sans/0` | `foobar` |
-| `traefik/tls/stores/Store1/defaultGeneratedCert/domain/sans/1` | `foobar` |
-| `traefik/tls/stores/Store1/defaultGeneratedCert/resolver` | `foobar` |
-| `traefik/udp/routers/UDPRouter0/entryPoints/0` | `foobar` |
-| `traefik/udp/routers/UDPRouter0/entryPoints/1` | `foobar` |
-| `traefik/udp/routers/UDPRouter0/service` | `foobar` |
-| `traefik/udp/routers/UDPRouter1/entryPoints/0` | `foobar` |
-| `traefik/udp/routers/UDPRouter1/entryPoints/1` | `foobar` |
-| `traefik/udp/routers/UDPRouter1/service` | `foobar` |
-| `traefik/udp/services/UDPService01/loadBalancer/servers/0/address` | `foobar` |
-| `traefik/udp/services/UDPService01/loadBalancer/servers/1/address` | `foobar` |
-| `traefik/udp/services/UDPService02/weighted/services/0/name` | `foobar` |
-| `traefik/udp/services/UDPService02/weighted/services/0/weight` | `42` |
-| `traefik/udp/services/UDPService02/weighted/services/1/name` | `foobar` |
-| `traefik/udp/services/UDPService02/weighted/services/1/weight` | `42` |
+
+| Key (Path) | Value |
+|------------|-------|
+| `traefik/http/middlewares/Middleware01/addPrefix/prefix` | `foobar` |
+| | `foobar` |
+| `traefik/http/middlewares/Middleware02/basicAuth/realm` | `foobar` |
+| | `true` |
+| `traefik/http/middlewares/Middleware02/basicAuth/users/0` | `foobar` |
+| `traefik/http/middlewares/Middleware02/basicAuth/users/1` | `foobar` |
+| `traefik/http/middlewares/Middleware02/basicAuth/usersFile` | `foobar` |
+| `traefik/http/middlewares/Middleware03/buffering/maxRequestBodyBytes` | `42` |
+| `traefik/http/middlewares/Middleware03/buffering/maxResponseBodyBytes` | `42` |
+| `traefik/http/middlewares/Middleware03/buffering/memRequestBodyBytes` | `42` |
+| `traefik/http/middlewares/Middleware03/buffering/memResponseBodyBytes` | `42` |
+| `traefik/http/middlewares/Middleware03/buffering/retryExpression` | `foobar` |
+| `traefik/http/middlewares/Middleware04/chain/middlewares/0` | `foobar` |
+| `traefik/http/middlewares/Middleware04/chain/middlewares/1` | `foobar` |
+| `traefik/http/middlewares/Middleware05/circuitBreaker/checkPeriod` | `42s` |
+| `traefik/http/middlewares/Middleware05/circuitBreaker/expression` | `foobar` |
+| `traefik/http/middlewares/Middleware05/circuitBreaker/fallbackDuration` | `42s` |
+| `traefik/http/middlewares/Middleware05/circuitBreaker/recoveryDuration` | `42s` |
+| `traefik/http/middlewares/Middleware05/circuitBreaker/responseCode` | `42` |
+| `traefik/http/middlewares/Middleware06/compress/defaultEncoding` | `foobar` |
+| `traefik/http/middlewares/Middleware06/compress/encodings/0` | `foobar` |
+| `traefik/http/middlewares/Middleware06/compress/encodings/1` | `foobar` |
+| `traefik/http/middlewares/Middleware06/compress/excludedContentTypes/0` | `foobar` |
+| `traefik/http/middlewares/Middleware06/compress/excludedContentTypes/1` | `foobar` |
+| `traefik/http/middlewares/Middleware06/compress/includedContentTypes/0` | `foobar` |
+| `traefik/http/middlewares/Middleware06/compress/includedContentTypes/1` | `foobar` |
+| `traefik/http/middlewares/Middleware06/compress/minResponseBodyBytes` | `42` |
+| `traefik/http/middlewares/Middleware07/contentType/autoDetect` | `true` |
+| | `foobar` |
+| `traefik/http/middlewares/Middleware08/digestAuth/realm` | `foobar` |
+| | `true` |
+| `traefik/http/middlewares/Middleware08/digestAuth/users/0` | `foobar` |
+| `traefik/http/middlewares/Middleware08/digestAuth/users/1` | `foobar` |
+| `traefik/http/middlewares/Middleware08/digestAuth/usersFile` | `foobar` |
+| `traefik/http/middlewares/Middleware09/errors/query` | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `42` |
+| | `42` |
+| `traefik/http/middlewares/Middleware10/forwardAuth/addAuthCookiesToResponse/0` | `foobar` |
+| `traefik/http/middlewares/Middleware10/forwardAuth/addAuthCookiesToResponse/1` | `foobar` |
+| `traefik/http/middlewares/Middleware10/forwardAuth/address` | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| `traefik/http/middlewares/Middleware10/forwardAuth/forwardBody` | `true` |
+| | `foobar` |
+| `traefik/http/middlewares/Middleware10/forwardAuth/maxBodySize` | `42` |
+| | `true` |
+| `traefik/http/middlewares/Middleware10/forwardAuth/preserveRequestMethod` | `true` |
+| `traefik/http/middlewares/Middleware10/forwardAuth/tls/ca` | `foobar` |
+| `traefik/http/middlewares/Middleware10/forwardAuth/tls/caOptional` | `true` |
+| `traefik/http/middlewares/Middleware10/forwardAuth/tls/cert` | `foobar` |
+| `traefik/http/middlewares/Middleware10/forwardAuth/tls/insecureSkipVerify` | `true` |
+| `traefik/http/middlewares/Middleware10/forwardAuth/tls/key` | `foobar` |
+| | `true` |
+| `traefik/http/middlewares/Middleware11/grpcWeb/allowOrigins/0` | `foobar` |
+| `traefik/http/middlewares/Middleware11/grpcWeb/allowOrigins/1` | `foobar` |
+| | `true` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `42` |
+| | `true` |
+| | `foobar` |
+| | `foobar` |
+| | `true` |
+| | `foobar` |
+| | `foobar` |
+| | `true` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `true` |
+| | `true` |
+| | `foobar` |
+| | `foobar` |
+| | `true` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `true` |
+| | `foobar` |
+| | `foobar` |
+| | `foobar` |
+| | `true` |
+| | `true` |
+| `traefik/http/middlewares/Middleware12/headers/stsIncludeSubdomains` | `true` |
+| | `true` |
+| | `42` |
+| `traefik/http/middlewares/Middleware13/ipAllowList/ipStrategy/depth` | `42` |
+| `traefik/http/middlewares/Middleware13/ipAllowList/ipStrategy/excludedIPs/0` | `foobar` |
+| `traefik/http/middlewares/Middleware13/ipAllowList/ipStrategy/excludedIPs/1` | `foobar` |
+| `traefik/http/middlewares/Middleware13/ipAllowList/ipStrategy/ipv6Subnet` | `42` |
+| `traefik/http/middlewares/Middleware13/ipAllowList/rejectStatusCode` | `42` |
+| `traefik/http/middlewares/Middleware13/ipAllowList/sourceRange/0` | `foobar` |
+| `traefik/http/middlewares/Middleware13/ipAllowList/sourceRange/1` | `foobar` |
+| `traefik/http/middlewares/Middleware14/ipWhiteList/ipStrategy/depth` | `42` |
+| `traefik/http/middlewares/Middleware14/ipWhiteList/ipStrategy/excludedIPs/0` | `foobar` |
+| `traefik/http/middlewares/Middleware14/ipWhiteList/ipStrategy/excludedIPs/1` | `foobar` |
+| `traefik/http/middlewares/Middleware14/ipWhiteList/ipStrategy/ipv6Subnet` | `42` |
+| `traefik/http/middlewares/Middleware14/ipWhiteList/sourceRange/0` | `foobar` |
+| `traefik/http/middlewares/Middleware14/ipWhiteList/sourceRange/1` | `foobar` |
+| `traefik/http/middlewares/Middleware15/inFlightReq/amount` | `42` |
+| `traefik/http/middlewares/Middleware15/inFlightReq/sourceCriterion/ipStrategy/depth` | `42` |
+| `traefik/http/middlewares/Middleware15/inFlightReq/sourceCriterion/ipStrategy/excludedIPs/0` | `foobar` |
+| `traefik/http/middlewares/Middleware15/inFlightReq/sourceCriterion/ipStrategy/excludedIPs/1` | `foobar` |
+| `traefik/http/middlewares/Middleware15/inFlightReq/sourceCriterion/ipStrategy/ipv6Subnet` | `42` |
+| | `foobar` |
+| `traefik/http/middlewares/Middleware15/inFlightReq/sourceCriterion/requestHost` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/issuer/commonName` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/issuer/country` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/issuer/domainComponent` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/issuer/locality` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/issuer/organization` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/issuer/province` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/issuer/serialNumber` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/notAfter` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/notBefore` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/sans` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/serialNumber` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/commonName` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/country` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/domainComponent` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/locality` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/organization` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/organizationalUnit` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/province` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/info/subject/serialNumber` | `true` |
+| `traefik/http/middlewares/Middleware16/passTLSClientCert/pem` | `true` |
+| `traefik/http/middlewares/Middleware17/plugin/PluginConf0/name0` | `foobar` |
+| `traefik/http/middlewares/Middleware17/plugin/PluginConf0/name1` | `foobar` |
+| `traefik/http/middlewares/Middleware17/plugin/PluginConf1/name0` | `foobar` |
+| `traefik/http/middlewares/Middleware17/plugin/PluginConf1/name1` | `foobar` |
+| `traefik/http/middlewares/Middleware18/rateLimit/average` | `42` |
+| `traefik/http/middlewares/Middleware18/rateLimit/burst` | `42` |
+| `traefik/http/middlewares/Middleware18/rateLimit/period` | `42s` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/db` | `42` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/dialTimeout` | `42s` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/endpoints/0` | `foobar` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/endpoints/1` | `foobar` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/maxActiveConns` | `42` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/minIdleConns` | `42` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/password` | `foobar` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/poolSize` | `42` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/readTimeout` | `42s` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/tls/ca` | `foobar` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/tls/cert` | `foobar` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/tls/insecureSkipVerify` | `true` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/tls/key` | `foobar` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/username` | `foobar` |
+| `traefik/http/middlewares/Middleware18/rateLimit/redis/writeTimeout` | `42s` |
+| `traefik/http/middlewares/Middleware18/rateLimit/sourceCriterion/ipStrategy/depth` | `42` |
+| `traefik/http/middlewares/Middleware18/rateLimit/sourceCriterion/ipStrategy/excludedIPs/0` | `foobar` |
+| `traefik/http/middlewares/Middleware18/rateLimit/sourceCriterion/ipStrategy/excludedIPs/1` | `foobar` |
+| `traefik/http/middlewares/Middleware18/rateLimit/sourceCriterion/ipStrategy/ipv6Subnet` | `42` |
+| | `foobar` |
+| `traefik/http/middlewares/Middleware18/rateLimit/sourceCriterion/requestHost` | `true` |
+| `traefik/http/middlewares/Middleware19/redirectRegex/permanent` | `true` |
+| `traefik/http/middlewares/Middleware19/redirectRegex/regex` | `foobar` |
+| `traefik/http/middlewares/Middleware19/redirectRegex/replacement` | `foobar` |
+| `traefik/http/middlewares/Middleware20/redirectScheme/permanent` | `true` |
+| `traefik/http/middlewares/Middleware20/redirectScheme/port` | `foobar` |
+| `traefik/http/middlewares/Middleware20/redirectScheme/scheme` | `foobar` |
+| `traefik/http/middlewares/Middleware21/replacePath/path` | `foobar` |
+| `traefik/http/middlewares/Middleware22/replacePathRegex/regex` | `foobar` |
+| `traefik/http/middlewares/Middleware22/replacePathRegex/replacement` | `foobar` |
+| `traefik/http/middlewares/Middleware23/retry/attempts` | `42` |
+| `traefik/http/middlewares/Middleware23/retry/initialInterval` | `42s` |
+| `traefik/http/middlewares/Middleware24/stripPrefix/forceSlash` | `true` |
+| `traefik/http/middlewares/Middleware24/stripPrefix/prefixes/0` | `foobar` |
+| `traefik/http/middlewares/Middleware24/stripPrefix/prefixes/1` | `foobar` |
+| `traefik/http/middlewares/Middleware25/stripPrefixRegex/regex/0` | `foobar` |
+| `traefik/http/middlewares/Middleware25/stripPrefixRegex/regex/1` | `foobar` |
+| `traefik/http/routers/Router0/entryPoints/0` | `foobar` |
+| `traefik/http/routers/Router0/entryPoints/1` | `foobar` |
+| `traefik/http/routers/Router0/middlewares/0` | `foobar` |
+| `traefik/http/routers/Router0/middlewares/1` | `foobar` |
+| `traefik/http/routers/Router0/observability/accessLogs` | `true` |
+| `traefik/http/routers/Router0/observability/metrics` | `true` |
+| `traefik/http/routers/Router0/observability/traceVerbosity` | `foobar` |
+| `traefik/http/routers/Router0/observability/tracing` | `true` |
+| `traefik/http/routers/Router0/priority` | `42` |
+| `traefik/http/routers/Router0/rule` | `foobar` |
+| `traefik/http/routers/Router0/ruleSyntax` | `foobar` |
+| `traefik/http/routers/Router0/service` | `foobar` |
+| `traefik/http/routers/Router0/tls/certResolver` | `foobar` |
+| `traefik/http/routers/Router0/tls/domains/0/main` | `foobar` |
+| `traefik/http/routers/Router0/tls/domains/0/sans/0` | `foobar` |
+| `traefik/http/routers/Router0/tls/domains/0/sans/1` | `foobar` |
+| `traefik/http/routers/Router0/tls/domains/1/main` | `foobar` |
+| `traefik/http/routers/Router0/tls/domains/1/sans/0` | `foobar` |
+| `traefik/http/routers/Router0/tls/domains/1/sans/1` | `foobar` |
+| `traefik/http/routers/Router0/tls/options` | `foobar` |
+| `traefik/http/routers/Router1/entryPoints/0` | `foobar` |
+| `traefik/http/routers/Router1/entryPoints/1` | `foobar` |
+| `traefik/http/routers/Router1/middlewares/0` | `foobar` |
+| `traefik/http/routers/Router1/middlewares/1` | `foobar` |
+| `traefik/http/routers/Router1/observability/accessLogs` | `true` |
+| `traefik/http/routers/Router1/observability/metrics` | `true` |
+| `traefik/http/routers/Router1/observability/traceVerbosity` | `foobar` |
+| `traefik/http/routers/Router1/observability/tracing` | `true` |
+| `traefik/http/routers/Router1/priority` | `42` |
+| `traefik/http/routers/Router1/rule` | `foobar` |
+| `traefik/http/routers/Router1/ruleSyntax` | `foobar` |
+| `traefik/http/routers/Router1/service` | `foobar` |
+| `traefik/http/routers/Router1/tls/certResolver` | `foobar` |
+| `traefik/http/routers/Router1/tls/domains/0/main` | `foobar` |
+| `traefik/http/routers/Router1/tls/domains/0/sans/0` | `foobar` |
+| `traefik/http/routers/Router1/tls/domains/0/sans/1` | `foobar` |
+| `traefik/http/routers/Router1/tls/domains/1/main` | `foobar` |
+| `traefik/http/routers/Router1/tls/domains/1/sans/0` | `foobar` |
+| `traefik/http/routers/Router1/tls/domains/1/sans/1` | `foobar` |
+| `traefik/http/routers/Router1/tls/options` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/certificates/0/certFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/certificates/0/keyFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/certificates/1/certFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/certificates/1/keyFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/disableHTTP2` | `true` |
+| `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/dialTimeout` | `42s` |
+| `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/idleConnTimeout` | `42s` |
+| `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/pingTimeout` | `42s` |
+| `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/readIdleTimeout` | `42s` |
+| | `42s` |
+| `traefik/http/serversTransports/ServersTransport0/insecureSkipVerify` | `true` |
+| `traefik/http/serversTransports/ServersTransport0/maxIdleConnsPerHost` | `42` |
+| `traefik/http/serversTransports/ServersTransport0/peerCertURI` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/rootCAs/0` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/rootCAs/1` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/serverName` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/spiffe/ids/0` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/spiffe/ids/1` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/spiffe/trustDomain` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/certificates/0/certFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/certificates/0/keyFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/certificates/1/certFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/certificates/1/keyFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/disableHTTP2` | `true` |
+| `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/dialTimeout` | `42s` |
+| `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/idleConnTimeout` | `42s` |
+| `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/pingTimeout` | `42s` |
+| `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/readIdleTimeout` | `42s` |
+| | `42s` |
+| `traefik/http/serversTransports/ServersTransport1/insecureSkipVerify` | `true` |
+| `traefik/http/serversTransports/ServersTransport1/maxIdleConnsPerHost` | `42` |
+| `traefik/http/serversTransports/ServersTransport1/peerCertURI` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/rootCAs/0` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/rootCAs/1` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/serverName` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/spiffe/ids/0` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/spiffe/ids/1` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/spiffe/trustDomain` | `foobar` |
+| `traefik/http/services/Service01/failover/fallback` | `foobar` |
+| `traefik/http/services/Service01/failover/healthCheck` | `` |
+| `traefik/http/services/Service01/failover/service` | `foobar` |
+| `traefik/http/services/Service02/loadBalancer/healthCheck/followRedirects` | `true` |
+| | `foobar` |
+| | `foobar` |
+| `traefik/http/services/Service02/loadBalancer/healthCheck/hostname` | `foobar` |
+| `traefik/http/services/Service02/loadBalancer/healthCheck/interval` | `42s` |
+| `traefik/http/services/Service02/loadBalancer/healthCheck/method` | `foobar` |
+| `traefik/http/services/Service02/loadBalancer/healthCheck/mode` | `foobar` |
+| `traefik/http/services/Service02/loadBalancer/healthCheck/path` | `foobar` |
+| `traefik/http/services/Service02/loadBalancer/healthCheck/port` | `42` |
+| `traefik/http/services/Service02/loadBalancer/healthCheck/scheme` | `foobar` |
+| `traefik/http/services/Service02/loadBalancer/healthCheck/status` | `42` |
+| `traefik/http/services/Service02/loadBalancer/healthCheck/timeout` | `42s` |
+| `traefik/http/services/Service02/loadBalancer/healthCheck/unhealthyInterval` | `42s` |
+| | `true` |
+| `traefik/http/services/Service02/loadBalancer/responseForwarding/flushInterval` | `42s` |
+| `traefik/http/services/Service02/loadBalancer/servers/0/preservePath` | `true` |
+| `traefik/http/services/Service02/loadBalancer/servers/0/url` | `foobar` |
+| `traefik/http/services/Service02/loadBalancer/servers/0/weight` | `42` |
+| `traefik/http/services/Service02/loadBalancer/servers/1/preservePath` | `true` |
+| `traefik/http/services/Service02/loadBalancer/servers/1/url` | `foobar` |
+| `traefik/http/services/Service02/loadBalancer/servers/1/weight` | `42` |
+| `traefik/http/services/Service02/loadBalancer/serversTransport` | `foobar` |
+| `traefik/http/services/Service02/loadBalancer/sticky/cookie/domain` | `foobar` |
+| `traefik/http/services/Service02/loadBalancer/sticky/cookie/httpOnly` | `true` |
+| `traefik/http/services/Service02/loadBalancer/sticky/cookie/maxAge` | `42` |
+| `traefik/http/services/Service02/loadBalancer/sticky/cookie/name` | `foobar` |
+| `traefik/http/services/Service02/loadBalancer/sticky/cookie/path` | `foobar` |
+| `traefik/http/services/Service02/loadBalancer/sticky/cookie/sameSite` | `foobar` |
+| `traefik/http/services/Service02/loadBalancer/sticky/cookie/secure` | `true` |
+| `traefik/http/services/Service02/loadBalancer/strategy` | `foobar` |
+| `traefik/http/services/Service03/mirroring/healthCheck` | `` |
+| `traefik/http/services/Service03/mirroring/maxBodySize` | `42` |
+| `traefik/http/services/Service03/mirroring/mirrorBody` | `true` |
+| `traefik/http/services/Service03/mirroring/mirrors/0/name` | `foobar` |
+| `traefik/http/services/Service03/mirroring/mirrors/0/percent` | `42` |
+| `traefik/http/services/Service03/mirroring/mirrors/1/name` | `foobar` |
+| `traefik/http/services/Service03/mirroring/mirrors/1/percent` | `42` |
+| `traefik/http/services/Service03/mirroring/service` | `foobar` |
+| `traefik/http/services/Service04/weighted/healthCheck` | `` |
+| `traefik/http/services/Service04/weighted/services/0/name` | `foobar` |
+| `traefik/http/services/Service04/weighted/services/0/weight` | `42` |
+| `traefik/http/services/Service04/weighted/services/1/name` | `foobar` |
+| `traefik/http/services/Service04/weighted/services/1/weight` | `42` |
+| `traefik/http/services/Service04/weighted/sticky/cookie/domain` | `foobar` |
+| `traefik/http/services/Service04/weighted/sticky/cookie/httpOnly` | `true` |
+| `traefik/http/services/Service04/weighted/sticky/cookie/maxAge` | `42` |
+| `traefik/http/services/Service04/weighted/sticky/cookie/name` | `foobar` |
+| `traefik/http/services/Service04/weighted/sticky/cookie/path` | `foobar` |
+| `traefik/http/services/Service04/weighted/sticky/cookie/sameSite` | `foobar` |
+| `traefik/http/services/Service04/weighted/sticky/cookie/secure` | `true` |
+| `traefik/tcp/middlewares/TCPMiddleware01/ipAllowList/sourceRange/0` | `foobar` |
+| `traefik/tcp/middlewares/TCPMiddleware01/ipAllowList/sourceRange/1` | `foobar` |
+| `traefik/tcp/middlewares/TCPMiddleware02/ipWhiteList/sourceRange/0` | `foobar` |
+| `traefik/tcp/middlewares/TCPMiddleware02/ipWhiteList/sourceRange/1` | `foobar` |
+| `traefik/tcp/middlewares/TCPMiddleware03/inFlightConn/amount` | `42` |
+| `traefik/tcp/routers/TCPRouter0/entryPoints/0` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/entryPoints/1` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/middlewares/0` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/middlewares/1` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/priority` | `42` |
+| `traefik/tcp/routers/TCPRouter0/rule` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/ruleSyntax` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/service` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/tls/certResolver` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/tls/domains/0/main` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/tls/domains/0/sans/0` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/tls/domains/0/sans/1` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/tls/domains/1/main` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/tls/domains/1/sans/0` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/tls/domains/1/sans/1` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/tls/options` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/tls/passthrough` | `true` |
+| `traefik/tcp/routers/TCPRouter1/entryPoints/0` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/entryPoints/1` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/middlewares/0` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/middlewares/1` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/priority` | `42` |
+| `traefik/tcp/routers/TCPRouter1/rule` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/ruleSyntax` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/service` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/tls/certResolver` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/tls/domains/0/main` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/tls/domains/0/sans/0` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/tls/domains/0/sans/1` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/tls/domains/1/main` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/tls/domains/1/sans/0` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/tls/domains/1/sans/1` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/tls/options` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/tls/passthrough` | `true` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/dialKeepAlive` | `42s` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/dialTimeout` | `42s` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/proxyProtocol/version` | `42` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/terminationDelay` | `42s` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/tls/certificates/0/certFile` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/tls/certificates/0/keyFile` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/tls/certificates/1/certFile` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/tls/certificates/1/keyFile` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/tls/insecureSkipVerify` | `true` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/tls/peerCertURI` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/tls/rootCAs/0` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/tls/rootCAs/1` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/tls/serverName` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/tls/spiffe/ids/0` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/tls/spiffe/ids/1` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport0/tls/spiffe/trustDomain` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/dialKeepAlive` | `42s` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/dialTimeout` | `42s` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/proxyProtocol/version` | `42` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/terminationDelay` | `42s` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/tls/certificates/0/certFile` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/tls/certificates/0/keyFile` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/tls/certificates/1/certFile` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/tls/certificates/1/keyFile` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/tls/insecureSkipVerify` | `true` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/tls/peerCertURI` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/tls/rootCAs/0` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/tls/rootCAs/1` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/tls/serverName` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/tls/spiffe/ids/0` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/tls/spiffe/ids/1` | `foobar` |
+| `traefik/tcp/serversTransports/TCPServersTransport1/tls/spiffe/trustDomain` | `foobar` |
+| `traefik/tcp/services/TCPService01/loadBalancer/proxyProtocol/version` | `42` |
+| `traefik/tcp/services/TCPService01/loadBalancer/servers/0/address` | `foobar` |
+| `traefik/tcp/services/TCPService01/loadBalancer/servers/0/tls` | `true` |
+| `traefik/tcp/services/TCPService01/loadBalancer/servers/1/address` | `foobar` |
+| `traefik/tcp/services/TCPService01/loadBalancer/servers/1/tls` | `true` |
+| `traefik/tcp/services/TCPService01/loadBalancer/serversTransport` | `foobar` |
+| `traefik/tcp/services/TCPService01/loadBalancer/terminationDelay` | `42` |
+| `traefik/tcp/services/TCPService02/weighted/services/0/name` | `foobar` |
+| `traefik/tcp/services/TCPService02/weighted/services/0/weight` | `42` |
+| `traefik/tcp/services/TCPService02/weighted/services/1/name` | `foobar` |
+| `traefik/tcp/services/TCPService02/weighted/services/1/weight` | `42` |
+| `traefik/tls/certificates/0/certFile` | `foobar` |
+| `traefik/tls/certificates/0/keyFile` | `foobar` |
+| `traefik/tls/certificates/0/stores/0` | `foobar` |
+| `traefik/tls/certificates/0/stores/1` | `foobar` |
+| `traefik/tls/certificates/1/certFile` | `foobar` |
+| `traefik/tls/certificates/1/keyFile` | `foobar` |
+| `traefik/tls/certificates/1/stores/0` | `foobar` |
+| `traefik/tls/certificates/1/stores/1` | `foobar` |
+| `traefik/tls/options/Options0/alpnProtocols/0` | `foobar` |
+| `traefik/tls/options/Options0/alpnProtocols/1` | `foobar` |
+| `traefik/tls/options/Options0/cipherSuites/0` | `foobar` |
+| `traefik/tls/options/Options0/cipherSuites/1` | `foobar` |
+| `traefik/tls/options/Options0/clientAuth/caFiles/0` | `foobar` |
+| `traefik/tls/options/Options0/clientAuth/caFiles/1` | `foobar` |
+| `traefik/tls/options/Options0/clientAuth/clientAuthType` | `foobar` |
+| `traefik/tls/options/Options0/curvePreferences/0` | `foobar` |
+| `traefik/tls/options/Options0/curvePreferences/1` | `foobar` |
+| `traefik/tls/options/Options0/disableSessionTickets` | `true` |
+| `traefik/tls/options/Options0/maxVersion` | `foobar` |
+| `traefik/tls/options/Options0/minVersion` | `foobar` |
+| `traefik/tls/options/Options0/preferServerCipherSuites` | `true` |
+| `traefik/tls/options/Options0/sniStrict` | `true` |
+| `traefik/tls/options/Options1/alpnProtocols/0` | `foobar` |
+| `traefik/tls/options/Options1/alpnProtocols/1` | `foobar` |
+| `traefik/tls/options/Options1/cipherSuites/0` | `foobar` |
+| `traefik/tls/options/Options1/cipherSuites/1` | `foobar` |
+| `traefik/tls/options/Options1/clientAuth/caFiles/0` | `foobar` |
+| `traefik/tls/options/Options1/clientAuth/caFiles/1` | `foobar` |
+| `traefik/tls/options/Options1/clientAuth/clientAuthType` | `foobar` |
+| `traefik/tls/options/Options1/curvePreferences/0` | `foobar` |
+| `traefik/tls/options/Options1/curvePreferences/1` | `foobar` |
+| `traefik/tls/options/Options1/disableSessionTickets` | `true` |
+| `traefik/tls/options/Options1/maxVersion` | `foobar` |
+| `traefik/tls/options/Options1/minVersion` | `foobar` |
+| `traefik/tls/options/Options1/preferServerCipherSuites` | `true` |
+| `traefik/tls/options/Options1/sniStrict` | `true` |
+| `traefik/tls/stores/Store0/defaultCertificate/certFile` | `foobar` |
+| `traefik/tls/stores/Store0/defaultCertificate/keyFile` | `foobar` |
+| `traefik/tls/stores/Store0/defaultGeneratedCert/domain/main` | `foobar` |
+| `traefik/tls/stores/Store0/defaultGeneratedCert/domain/sans/0` | `foobar` |
+| `traefik/tls/stores/Store0/defaultGeneratedCert/domain/sans/1` | `foobar` |
+| `traefik/tls/stores/Store0/defaultGeneratedCert/resolver` | `foobar` |
+| `traefik/tls/stores/Store1/defaultCertificate/certFile` | `foobar` |
+| `traefik/tls/stores/Store1/defaultCertificate/keyFile` | `foobar` |
+| `traefik/tls/stores/Store1/defaultGeneratedCert/domain/main` | `foobar` |
+| `traefik/tls/stores/Store1/defaultGeneratedCert/domain/sans/0` | `foobar` |
+| `traefik/tls/stores/Store1/defaultGeneratedCert/domain/sans/1` | `foobar` |
+| `traefik/tls/stores/Store1/defaultGeneratedCert/resolver` | `foobar` |
+| `traefik/udp/routers/UDPRouter0/entryPoints/0` | `foobar` |
+| `traefik/udp/routers/UDPRouter0/entryPoints/1` | `foobar` |
+| `traefik/udp/routers/UDPRouter0/service` | `foobar` |
+| `traefik/udp/routers/UDPRouter1/entryPoints/0` | `foobar` |
+| `traefik/udp/routers/UDPRouter1/entryPoints/1` | `foobar` |
+| `traefik/udp/routers/UDPRouter1/service` | `foobar` |
+| `traefik/udp/services/UDPService01/loadBalancer/servers/0/address` | `foobar` |
+| `traefik/udp/services/UDPService01/loadBalancer/servers/1/address` | `foobar` |
+| `traefik/udp/services/UDPService02/weighted/services/0/name` | `foobar` |
+| `traefik/udp/services/UDPService02/weighted/services/0/weight` | `42` |
+| `traefik/udp/services/UDPService02/weighted/services/1/name` | `foobar` |
+| `traefik/udp/services/UDPService02/weighted/services/1/weight` | `42` |
diff --git a/docs/content/reference/dynamic-configuration/kv.md b/docs/content/reference/dynamic-configuration/kv.md
deleted file mode 100644
index 8db8415e5..000000000
--- a/docs/content/reference/dynamic-configuration/kv.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-title: "Traefik Dynamic Configuration with KV stores"
-description: "Read the technical documentation to learn the Traefik Dynamic Configuration with KV stores."
----
-
-# KV Configuration Reference
-
-Dynamic configuration with KV stores.
-{: .subtitle }
-
-| Key (Path) | Value |
-|----------------------------------------------------------------------------------------------|-------------|
---8<-- "content/reference/dynamic-configuration/kv-ref.md"
diff --git a/docs/content/reference/dynamic-configuration/nomad.md b/docs/content/reference/dynamic-configuration/nomad.md
deleted file mode 100644
index 680e621b4..000000000
--- a/docs/content/reference/dynamic-configuration/nomad.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-title: "Traefik Nomad Service Discovery Configuration Documentation"
-description: "View the reference for performing dynamic configurations with Traefik Proxy and Nomad Service Discovery. Read the technical documentation."
----
-
-# Nomad Service Discovery Configuration Reference
-
-Dynamic configuration with Nomad Service Discovery
-{: .subtitle }
-
-The labels are case-insensitive.
-
-```yaml
---8<-- "content/reference/dynamic-configuration/nomad.yml"
---8<-- "content/reference/dynamic-configuration/docker-labels.yml"
-```
diff --git a/docs/content/reference/dynamic-configuration/nomad.yml b/docs/content/reference/dynamic-configuration/nomad.yml
deleted file mode 100644
index 23efc00c6..000000000
--- a/docs/content/reference/dynamic-configuration/nomad.yml
+++ /dev/null
@@ -1 +0,0 @@
-- "traefik.enable=true"
diff --git a/docs/content/reference/dynamic-configuration/rancher.md b/docs/content/reference/dynamic-configuration/rancher.md
deleted file mode 100644
index e69de29bb..000000000
diff --git a/docs/content/reference/dynamic-configuration/swarm.md b/docs/content/reference/dynamic-configuration/swarm.md
deleted file mode 100644
index 67fec341c..000000000
--- a/docs/content/reference/dynamic-configuration/swarm.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-title: "Traefik Docker Swarm Configuration Documentation"
-description: "Reference dynamic configuration with Docker Swarm labels in Traefik Proxy. Read the technical documentation."
----
-
-# Docker Swarm Configuration Reference
-
-Dynamic configuration with Docker Labels
-{: .subtitle }
-
-The labels are case-insensitive.
-
-```yaml
-labels:
- --8<-- "content/reference/dynamic-configuration/swarm.yml"
- --8<-- "content/reference/dynamic-configuration/docker-labels.yml"
-```
diff --git a/docs/content/reference/dynamic-configuration/swarm.yml b/docs/content/reference/dynamic-configuration/swarm.yml
deleted file mode 100644
index 1b40b4483..000000000
--- a/docs/content/reference/dynamic-configuration/swarm.yml
+++ /dev/null
@@ -1,3 +0,0 @@
-- "traefik.enable=true"
-- "traefik.swarm.network=foobar"
-- "traefik.swarm.lbswarm=true"
diff --git a/docs/content/reference/dynamic-configuration/traefik.containo.us_tlsoptions.yaml b/docs/content/reference/dynamic-configuration/traefik.containo.us_tlsoptions.yaml
new file mode 100644
index 000000000..6c7fdc914
--- /dev/null
+++ b/docs/content/reference/dynamic-configuration/traefik.containo.us_tlsoptions.yaml
@@ -0,0 +1,114 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ controller-gen.kubebuilder.io/version: v0.16.1
+ name: tlsoptions.traefik.containo.us
+spec:
+ group: traefik.containo.us
+ names:
+ kind: TLSOption
+ listKind: TLSOptionList
+ plural: tlsoptions
+ singular: tlsoption
+ scope: Namespaced
+ versions:
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.
+ More info: https://doc.traefik.io/traefik/v2.11/https/tls/#tls-options
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: TLSOptionSpec defines the desired state of a TLSOption.
+ properties:
+ alpnProtocols:
+ description: |-
+ ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.
+ More info: https://doc.traefik.io/traefik/v2.11/https/tls/#alpn-protocols
+ items:
+ type: string
+ type: array
+ cipherSuites:
+ description: |-
+ CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.
+ More info: https://doc.traefik.io/traefik/v2.11/https/tls/#cipher-suites
+ items:
+ type: string
+ type: array
+ clientAuth:
+ description: ClientAuth defines the server's policy for TLS Client
+ Authentication.
+ properties:
+ clientAuthType:
+ description: ClientAuthType defines the client authentication
+ type to apply.
+ enum:
+ - NoClientCert
+ - RequestClientCert
+ - RequireAnyClientCert
+ - VerifyClientCertIfGiven
+ - RequireAndVerifyClientCert
+ type: string
+ secretNames:
+ description: SecretNames defines the names of the referenced Kubernetes
+ Secret storing certificate details.
+ items:
+ type: string
+ type: array
+ type: object
+ curvePreferences:
+ description: |-
+ CurvePreferences defines the preferred elliptic curves.
+ More info: https://doc.traefik.io/traefik/v2.11/https/tls/#curve-preferences
+ items:
+ type: string
+ type: array
+ maxVersion:
+ description: |-
+ MaxVersion defines the maximum TLS version that Traefik will accept.
+ Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
+ Default: None.
+ type: string
+ minVersion:
+ description: |-
+ MinVersion defines the minimum TLS version that Traefik will accept.
+ Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
+ Default: VersionTLS10.
+ type: string
+ preferServerCipherSuites:
+ description: |-
+ PreferServerCipherSuites defines whether the server chooses a cipher suite among his own instead of among the client's.
+ It is enabled automatically when minVersion or maxVersion is set.
+ Deprecated: https://github.com/golang/go/issues/45430
+ type: boolean
+ sniStrict:
+ description: SniStrict defines whether Traefik allows connections
+ from clients connections that do not specify a server_name extension.
+ type: boolean
+ type: object
+ required:
+ - metadata
+ - spec
+ type: object
+ served: true
+ storage: true
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_ingressroutes.yaml b/docs/content/reference/dynamic-configuration/traefik.io_ingressroutes.yaml
index 160703eb8..7c40866ea 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_ingressroutes.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_ingressroutes.yaml
@@ -43,7 +43,7 @@ spec:
description: |-
EntryPoints defines the list of entry point names to bind to.
Entry points have to be configured in the static configuration.
- More info: https://doc.traefik.io/traefik/v3.4/routing/entrypoints/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
Default: all.
items:
type: string
@@ -64,12 +64,12 @@ spec:
match:
description: |-
Match defines the router's rule.
- More info: https://doc.traefik.io/traefik/v3.4/routing/routers/#rule
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/
type: string
middlewares:
description: |-
Middlewares defines the list of references to Middleware resources.
- More info: https://doc.traefik.io/traefik/v3.4/routing/providers/kubernetes-crd/#kind-middleware
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/middleware/
items:
description: MiddlewareRef is a reference to a Middleware
resource.
@@ -89,19 +89,30 @@ spec:
observability:
description: |-
Observability defines the observability configuration for a router.
- More info: https://doc.traefik.io/traefik/v3.4/routing/routers/#observability
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/observability/
properties:
accessLogs:
+ description: AccessLogs enables access logs for this router.
type: boolean
metrics:
+ description: Metrics enables metrics for this router.
type: boolean
+ traceVerbosity:
+ default: minimal
+ description: TraceVerbosity defines the verbosity level
+ of the tracing for this router.
+ enum:
+ - minimal
+ - detailed
+ type: string
tracing:
+ description: Tracing enables tracing for this router.
type: boolean
type: object
priority:
description: |-
Priority defines the router's priority.
- More info: https://doc.traefik.io/traefik/v3.4/routing/routers/#priority
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/#priority
maximum: 9223372036854775000
type: integer
services:
@@ -136,7 +147,7 @@ spec:
- type: integer
- type: string
description: |-
- Interval defines the frequency of the health check calls.
+ Interval defines the frequency of the health check calls for healthy targets.
Default: 30s
x-kubernetes-int-or-string: true
method:
@@ -172,6 +183,15 @@ spec:
Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
Default: 5s
x-kubernetes-int-or-string: true
+ unhealthyInterval:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.
+ When UnhealthyInterval is not defined, it defaults to the Interval value.
+ Default: 30s
+ x-kubernetes-int-or-string: true
type: object
kind:
description: Kind defines the kind of the Service.
@@ -243,7 +263,7 @@ spec:
sticky:
description: |-
Sticky defines the sticky sessions configuration.
- More info: https://doc.traefik.io/traefik/v3.4/routing/services/#sticky-sessions
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
properties:
cookie:
description: Cookie defines the sticky cookie configuration.
@@ -312,7 +332,7 @@ spec:
syntax:
description: |-
Syntax defines the router's rule syntax.
- More info: https://doc.traefik.io/traefik/v3.4/routing/routers/#rulesyntax
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/rules-and-priority/#rulesyntax
Deprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.
type: string
required:
@@ -322,18 +342,18 @@ spec:
tls:
description: |-
TLS defines the TLS configuration.
- More info: https://doc.traefik.io/traefik/v3.4/routing/routers/#tls
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/routing/router/#tls
properties:
certResolver:
description: |-
CertResolver defines the name of the certificate resolver to use.
Cert resolvers have to be configured in the static configuration.
- More info: https://doc.traefik.io/traefik/v3.4/https/acme/#certificate-resolvers
+ More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/tls/certificate-resolvers/acme/
type: string
domains:
description: |-
Domains defines the list of domains that will be used to issue certificates.
- More info: https://doc.traefik.io/traefik/v3.4/routing/routers/#domains
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#domains
items:
description: Domain holds a domain name with SANs.
properties:
@@ -352,17 +372,17 @@ spec:
description: |-
Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
If not defined, the `default` TLSOption is used.
- More info: https://doc.traefik.io/traefik/v3.4/https/tls/#tls-options
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-options/
properties:
name:
description: |-
Name defines the name of the referenced TLSOption.
- More info: https://doc.traefik.io/traefik/v3.4/routing/providers/kubernetes-crd/#kind-tlsoption
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsoption/
type: string
namespace:
description: |-
Namespace defines the namespace of the referenced TLSOption.
- More info: https://doc.traefik.io/traefik/v3.4/routing/providers/kubernetes-crd/#kind-tlsoption
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsoption/
type: string
required:
- name
@@ -379,12 +399,12 @@ spec:
name:
description: |-
Name defines the name of the referenced TLSStore.
- More info: https://doc.traefik.io/traefik/v3.4/routing/providers/kubernetes-crd/#kind-tlsstore
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsstore/
type: string
namespace:
description: |-
Namespace defines the namespace of the referenced TLSStore.
- More info: https://doc.traefik.io/traefik/v3.4/routing/providers/kubernetes-crd/#kind-tlsstore
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/tlsstore/
type: string
required:
- name
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_ingressroutetcps.yaml b/docs/content/reference/dynamic-configuration/traefik.io_ingressroutetcps.yaml
index a42968a0c..37a02f2fb 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_ingressroutetcps.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_ingressroutetcps.yaml
@@ -43,7 +43,7 @@ spec:
description: |-
EntryPoints defines the list of entry point names to bind to.
Entry points have to be configured in the static configuration.
- More info: https://doc.traefik.io/traefik/v3.4/routing/entrypoints/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
Default: all.
items:
type: string
@@ -56,7 +56,7 @@ spec:
match:
description: |-
Match defines the router's rule.
- More info: https://doc.traefik.io/traefik/v3.4/routing/routers/#rule_1
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/
type: string
middlewares:
description: Middlewares defines the list of references to MiddlewareTCP
@@ -80,7 +80,7 @@ spec:
priority:
description: |-
Priority defines the router's priority.
- More info: https://doc.traefik.io/traefik/v3.4/routing/routers/#priority_1
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/#priority
maximum: 9223372036854775000
type: integer
services:
@@ -122,7 +122,8 @@ spec:
proxyProtocol:
description: |-
ProxyProtocol defines the PROXY protocol configuration.
- More info: https://doc.traefik.io/traefik/v3.4/routing/services/#proxy-protocol
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/service/#proxy-protocol
+ Deprecated: ProxyProtocol will not be supported in future APIVersions, please use ServersTransport to configure ProxyProtocol instead.
properties:
version:
description: Version defines the PROXY Protocol version
@@ -163,7 +164,7 @@ spec:
syntax:
description: |-
Syntax defines the router's rule syntax.
- More info: https://doc.traefik.io/traefik/v3.4/routing/routers/#rulesyntax_1
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/rules-and-priority/#rulesyntax
Deprecated: Please do not use this field and rewrite the router rules to use the v3 syntax.
enum:
- v3
@@ -176,18 +177,18 @@ spec:
tls:
description: |-
TLS defines the TLS configuration on a layer 4 / TCP Route.
- More info: https://doc.traefik.io/traefik/v3.4/routing/routers/#tls_1
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/routing/router/#tls
properties:
certResolver:
description: |-
CertResolver defines the name of the certificate resolver to use.
Cert resolvers have to be configured in the static configuration.
- More info: https://doc.traefik.io/traefik/v3.4/https/acme/#certificate-resolvers
+ More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/tls/certificate-resolvers/acme/
type: string
domains:
description: |-
Domains defines the list of domains that will be used to issue certificates.
- More info: https://doc.traefik.io/traefik/v3.4/routing/routers/#domains
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/tls/#domains
items:
description: Domain holds a domain name with SANs.
properties:
@@ -206,7 +207,7 @@ spec:
description: |-
Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.
If not defined, the `default` TLSOption is used.
- More info: https://doc.traefik.io/traefik/v3.4/https/tls/#tls-options
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/tls/#tls-options
properties:
name:
description: Name defines the name of the referenced Traefik
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_ingressrouteudps.yaml b/docs/content/reference/dynamic-configuration/traefik.io_ingressrouteudps.yaml
index d23d7e851..dc08ce018 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_ingressrouteudps.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_ingressrouteudps.yaml
@@ -43,7 +43,7 @@ spec:
description: |-
EntryPoints defines the list of entry point names to bind to.
Entry points have to be configured in the static configuration.
- More info: https://doc.traefik.io/traefik/v3.4/routing/entrypoints/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/install-configuration/entrypoints/
Default: all.
items:
type: string
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_middlewares.yaml b/docs/content/reference/dynamic-configuration/traefik.io_middlewares.yaml
index f45b0b68f..5321da0b0 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_middlewares.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_middlewares.yaml
@@ -19,7 +19,7 @@ spec:
openAPIV3Schema:
description: |-
Middleware is the CRD implementation of a Traefik Middleware.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/overview/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/overview/
properties:
apiVersion:
description: |-
@@ -45,7 +45,7 @@ spec:
description: |-
AddPrefix holds the add prefix middleware configuration.
This middleware updates the path of a request before forwarding it.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/addprefix/
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/addprefix/
properties:
prefix:
description: |-
@@ -60,12 +60,12 @@ spec:
description: |-
BasicAuth holds the basic auth middleware configuration.
This middleware restricts access to your services to known users.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/basicauth/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/basicauth/
properties:
headerField:
description: |-
HeaderField defines a header field to store the authenticated user.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/basicauth/#headerfield
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/basicauth/#headerfield
type: string
realm:
description: |-
@@ -86,7 +86,7 @@ spec:
description: |-
Buffering holds the buffering middleware configuration.
This middleware retries or limits the size of requests that can be forwarded to backends.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/buffering/#maxrequestbodybytes
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/buffering/#maxrequestbodybytes
properties:
maxRequestBodyBytes:
description: |-
@@ -118,14 +118,14 @@ spec:
description: |-
RetryExpression defines the retry conditions.
It is a logical combination of functions with operators AND (&&) and OR (||).
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/buffering/#retryexpression
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/buffering/#retryexpression
type: string
type: object
chain:
description: |-
Chain holds the configuration of the chain middleware.
This middleware enables to define reusable combinations of other pieces of middleware.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/chain/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/chain/
properties:
middlewares:
description: Middlewares is the list of MiddlewareRef which composes
@@ -188,7 +188,7 @@ spec:
description: |-
Compress holds the compress middleware configuration.
This middleware compresses responses before sending them to the client, using gzip, brotli, or zstd compression.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/compress/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/compress/
properties:
defaultEncoding:
description: DefaultEncoding specifies the default encoding if
@@ -238,12 +238,12 @@ spec:
description: |-
DigestAuth holds the digest auth middleware configuration.
This middleware restricts access to your services to known users.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/digestauth/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/digestauth/
properties:
headerField:
description: |-
HeaderField defines a header field to store the authenticated user.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/basicauth/#headerfield
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/digestauth/#headerfield
type: string
realm:
description: |-
@@ -263,7 +263,7 @@ spec:
description: |-
ErrorPage holds the custom error middleware configuration.
This middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/errorpages/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/errorpages/
properties:
query:
description: |-
@@ -275,7 +275,7 @@ spec:
service:
description: |-
Service defines the reference to a Kubernetes Service that will serve the error page.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/errorpages/#service
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/errorpages/#service
properties:
healthCheck:
description: Healthcheck defines health checks for ExternalName
@@ -301,7 +301,7 @@ spec:
- type: integer
- type: string
description: |-
- Interval defines the frequency of the health check calls.
+ Interval defines the frequency of the health check calls for healthy targets.
Default: 30s
x-kubernetes-int-or-string: true
method:
@@ -337,6 +337,15 @@ spec:
Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
Default: 5s
x-kubernetes-int-or-string: true
+ unhealthyInterval:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.
+ When UnhealthyInterval is not defined, it defaults to the Interval value.
+ Default: 30s
+ x-kubernetes-int-or-string: true
type: object
kind:
description: Kind defines the kind of the Service.
@@ -408,7 +417,7 @@ spec:
sticky:
description: |-
Sticky defines the sticky sessions configuration.
- More info: https://doc.traefik.io/traefik/v3.4/routing/services/#sticky-sessions
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
properties:
cookie:
description: Cookie defines the sticky cookie configuration.
@@ -495,7 +504,7 @@ spec:
description: |-
ForwardAuth holds the forward auth middleware configuration.
This middleware delegates the request authentication to a Service.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/forwardauth/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/
properties:
addAuthCookiesToResponse:
description: AddAuthCookiesToResponse defines the list of cookies
@@ -523,7 +532,7 @@ spec:
authResponseHeadersRegex:
description: |-
AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/forwardauth/#authresponseheadersregex
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/#authresponseheadersregex
type: string
forwardBody:
description: ForwardBody defines whether to send the request body
@@ -532,7 +541,7 @@ spec:
headerField:
description: |-
HeaderField defines a header field to store the authenticated user.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/forwardauth/#headerfield
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/forwardauth/#headerfield
type: string
maxBodySize:
description: MaxBodySize defines the maximum body size in bytes
@@ -594,7 +603,7 @@ spec:
description: |-
Headers holds the headers middleware configuration.
This middleware manages the requests and responses headers.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/headers/#customrequestheaders
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/headers/#customrequestheaders
properties:
accessControlAllowCredentials:
description: AccessControlAllowCredentials defines whether the
@@ -766,7 +775,7 @@ spec:
description: |-
InFlightReq holds the in-flight request middleware configuration.
This middleware limits the number of requests being processed and served concurrently.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/inflightreq/
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/inflightreq/
properties:
amount:
description: |-
@@ -780,12 +789,12 @@ spec:
SourceCriterion defines what criterion is used to group requests as originating from a common source.
If several strategies are defined at the same time, an error will be raised.
If none are set, the default is to use the requestHost.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/inflightreq/#sourcecriterion
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/inflightreq/#sourcecriterion
properties:
ipStrategy:
description: |-
IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/ipallowlist/#ipstrategy
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
properties:
depth:
description: Depth tells Traefik to use the X-Forwarded-For
@@ -821,12 +830,12 @@ spec:
description: |-
IPAllowList holds the IP allowlist middleware configuration.
This middleware limits allowed requests based on the client IP.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/ipallowlist/
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/
properties:
ipStrategy:
description: |-
IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/ipallowlist/#ipstrategy
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
properties:
depth:
description: Depth tells Traefik to use the X-Forwarded-For
@@ -864,7 +873,7 @@ spec:
ipStrategy:
description: |-
IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/ipallowlist/#ipstrategy
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
properties:
depth:
description: Depth tells Traefik to use the X-Forwarded-For
@@ -895,7 +904,7 @@ spec:
description: |-
PassTLSClientCert holds the pass TLS client cert middleware configuration.
This middleware adds the selected data from the passed client TLS certificate to a header.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/passtlsclientcert/
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/passtlsclientcert/
properties:
info:
description: Info selects the specific client certificate details
@@ -998,13 +1007,13 @@ spec:
x-kubernetes-preserve-unknown-fields: true
description: |-
Plugin defines the middleware plugin configuration.
- More info: https://doc.traefik.io/traefik/plugins/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/overview/#community-middlewares
type: object
rateLimit:
description: |-
RateLimit holds the rate limit configuration.
This middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/ratelimit/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/ratelimit/
properties:
average:
description: |-
@@ -1123,7 +1132,7 @@ spec:
ipStrategy:
description: |-
IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/ipallowlist/#ipstrategy
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/ipallowlist/#ipstrategy
properties:
depth:
description: Depth tells Traefik to use the X-Forwarded-For
@@ -1159,11 +1168,11 @@ spec:
description: |-
RedirectRegex holds the redirect regex middleware configuration.
This middleware redirects a request using regex matching and replacement.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/redirectregex/#regex
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/redirectregex/#regex
properties:
permanent:
description: Permanent defines whether the redirection is permanent
- (301).
+ (308).
type: boolean
regex:
description: Regex defines the regex used to match and capture
@@ -1178,11 +1187,11 @@ spec:
description: |-
RedirectScheme holds the redirect scheme middleware configuration.
This middleware redirects requests from a scheme/port to another.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/redirectscheme/
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/redirectscheme/
properties:
permanent:
description: Permanent defines whether the redirection is permanent
- (301).
+ (308).
type: boolean
port:
description: Port defines the port of the new URL.
@@ -1195,7 +1204,7 @@ spec:
description: |-
ReplacePath holds the replace path middleware configuration.
This middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/replacepath/
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/replacepath/
properties:
path:
description: Path defines the path to use as replacement in the
@@ -1206,7 +1215,7 @@ spec:
description: |-
ReplacePathRegex holds the replace path regex middleware configuration.
This middleware replaces the path of a URL using regex matching and replacement.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/replacepathregex/
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/replacepathregex/
properties:
regex:
description: Regex defines the regular expression used to match
@@ -1222,7 +1231,7 @@ spec:
Retry holds the retry middleware configuration.
This middleware reissues requests a given number of times to a backend server if that server does not reply.
As soon as the server answers, the middleware stops retrying, regardless of the response status.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/retry/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/middlewares/retry/
properties:
attempts:
description: Attempts defines how many times the request should
@@ -1246,7 +1255,7 @@ spec:
description: |-
StripPrefix holds the strip prefix middleware configuration.
This middleware removes the specified prefixes from the URL path.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/stripprefix/
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/stripprefix/
properties:
forceSlash:
description: |-
@@ -1265,7 +1274,7 @@ spec:
description: |-
StripPrefixRegex holds the strip prefix regex middleware configuration.
This middleware removes the matching prefixes from the URL path.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/http/stripprefixregex/
+ More info: https://doc.traefik.io/traefik/v3.5/middlewares/http/stripprefixregex/
properties:
regex:
description: Regex defines the regular expression to match the
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_middlewaretcps.yaml b/docs/content/reference/dynamic-configuration/traefik.io_middlewaretcps.yaml
index 26d9ba184..5f7604923 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_middlewaretcps.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_middlewaretcps.yaml
@@ -19,7 +19,7 @@ spec:
openAPIV3Schema:
description: |-
MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/overview/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/overview/
properties:
apiVersion:
description: |-
@@ -56,7 +56,7 @@ spec:
description: |-
IPAllowList defines the IPAllowList middleware configuration.
This middleware accepts/refuses connections based on the client IP.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/tcp/ipallowlist/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/ipallowlist/
properties:
sourceRange:
description: SourceRange defines the allowed IPs (or ranges of
@@ -70,7 +70,7 @@ spec:
IPWhiteList defines the IPWhiteList middleware configuration.
This middleware accepts/refuses connections based on the client IP.
Deprecated: please use IPAllowList instead.
- More info: https://doc.traefik.io/traefik/v3.4/middlewares/tcp/ipwhitelist/
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/middlewares/ipwhitelist/
properties:
sourceRange:
description: SourceRange defines the allowed IPs (or ranges of
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_serverstransports.yaml b/docs/content/reference/dynamic-configuration/traefik.io_serverstransports.yaml
index 99d820da2..0828291ee 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_serverstransports.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_serverstransports.yaml
@@ -21,7 +21,7 @@ spec:
ServersTransport is the CRD implementation of a ServersTransport.
If no serversTransport is specified, the default@internal will be used.
The default@internal serversTransport is created from the static configuration.
- More info: https://doc.traefik.io/traefik/v3.4/routing/services/#serverstransport_1
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/serverstransport/
properties:
apiVersion:
description: |-
@@ -107,7 +107,7 @@ spec:
maxIdleConnsPerHost:
description: MaxIdleConnsPerHost controls the maximum idle (keep-alive)
to keep per-host.
- minimum: 0
+ minimum: -1
type: integer
peerCertURI:
description: PeerCertURI defines the peer cert URI used to match against
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_serverstransporttcps.yaml b/docs/content/reference/dynamic-configuration/traefik.io_serverstransporttcps.yaml
index 35f5dab93..f8be2b1d9 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_serverstransporttcps.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_serverstransporttcps.yaml
@@ -21,7 +21,7 @@ spec:
ServersTransportTCP is the CRD implementation of a TCPServersTransport.
If no tcpServersTransport is specified, a default one named default@internal will be used.
The default@internal tcpServersTransport can be configured in the static configuration.
- More info: https://doc.traefik.io/traefik/v3.4/routing/services/#serverstransport_3
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/tcp/serverstransport/
properties:
apiVersion:
description: |-
@@ -63,6 +63,15 @@ spec:
to a backend server can be established.
pattern: ^([0-9]+(ns|us|µs|ms|s|m|h)?)+$
x-kubernetes-int-or-string: true
+ proxyProtocol:
+ description: ProxyProtocol holds the PROXY Protocol configuration.
+ properties:
+ version:
+ description: Version defines the PROXY Protocol version to use.
+ maximum: 2
+ minimum: 1
+ type: integer
+ type: object
terminationDelay:
anyOf:
- type: integer
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_tlsoptions.yaml b/docs/content/reference/dynamic-configuration/traefik.io_tlsoptions.yaml
index 758a0ab96..c32974fae 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_tlsoptions.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_tlsoptions.yaml
@@ -19,7 +19,7 @@ spec:
openAPIV3Schema:
description: |-
TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.
- More info: https://doc.traefik.io/traefik/v3.4/https/tls/#tls-options
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#tls-options
properties:
apiVersion:
description: |-
@@ -44,14 +44,14 @@ spec:
alpnProtocols:
description: |-
ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.
- More info: https://doc.traefik.io/traefik/v3.4/https/tls/#alpn-protocols
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#alpn-protocols
items:
type: string
type: array
cipherSuites:
description: |-
CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.
- More info: https://doc.traefik.io/traefik/v3.4/https/tls/#cipher-suites
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#cipher-suites
items:
type: string
type: array
@@ -78,8 +78,8 @@ spec:
type: object
curvePreferences:
description: |-
- CurvePreferences defines the preferred elliptic curves in a specific order.
- More info: https://doc.traefik.io/traefik/v3.4/https/tls/#curve-preferences
+ CurvePreferences defines the preferred elliptic curves.
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#curve-preferences
items:
type: string
type: array
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_tlsstores.yaml b/docs/content/reference/dynamic-configuration/traefik.io_tlsstores.yaml
index bdf4a93d6..779c93908 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_tlsstores.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_tlsstores.yaml
@@ -21,7 +21,7 @@ spec:
TLSStore is the CRD implementation of a Traefik TLS Store.
For the time being, only the TLSStore named default is supported.
This means that you cannot have two stores that are named default in different Kubernetes namespaces.
- More info: https://doc.traefik.io/traefik/v3.4/https/tls/#certificates-stores
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/tls/tls-certificates/#certificates-stores#certificates-stores
properties:
apiVersion:
description: |-
diff --git a/docs/content/reference/dynamic-configuration/traefik.io_traefikservices.yaml b/docs/content/reference/dynamic-configuration/traefik.io_traefikservices.yaml
index 6715233b3..77e97156b 100644
--- a/docs/content/reference/dynamic-configuration/traefik.io_traefikservices.yaml
+++ b/docs/content/reference/dynamic-configuration/traefik.io_traefikservices.yaml
@@ -22,7 +22,7 @@ spec:
TraefikService object allows to:
- Apply weight to Services on load-balancing
- Mirror traffic on services
- More info: https://doc.traefik.io/traefik/v3.4/routing/providers/kubernetes-crd/#kind-traefikservice
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/traefikservice/
properties:
apiVersion:
description: |-
@@ -71,7 +71,7 @@ spec:
- type: integer
- type: string
description: |-
- Interval defines the frequency of the health check calls.
+ Interval defines the frequency of the health check calls for healthy targets.
Default: 30s
x-kubernetes-int-or-string: true
method:
@@ -107,6 +107,15 @@ spec:
Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
Default: 5s
x-kubernetes-int-or-string: true
+ unhealthyInterval:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.
+ When UnhealthyInterval is not defined, it defaults to the Interval value.
+ Default: 30s
+ x-kubernetes-int-or-string: true
type: object
kind:
description: Kind defines the kind of the Service.
@@ -156,7 +165,7 @@ spec:
- type: integer
- type: string
description: |-
- Interval defines the frequency of the health check calls.
+ Interval defines the frequency of the health check calls for healthy targets.
Default: 30s
x-kubernetes-int-or-string: true
method:
@@ -192,6 +201,15 @@ spec:
Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
Default: 5s
x-kubernetes-int-or-string: true
+ unhealthyInterval:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.
+ When UnhealthyInterval is not defined, it defaults to the Interval value.
+ Default: 30s
+ x-kubernetes-int-or-string: true
type: object
kind:
description: Kind defines the kind of the Service.
@@ -268,7 +286,7 @@ spec:
sticky:
description: |-
Sticky defines the sticky sessions configuration.
- More info: https://doc.traefik.io/traefik/v3.4/routing/services/#sticky-sessions
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
properties:
cookie:
description: Cookie defines the sticky cookie configuration.
@@ -396,7 +414,7 @@ spec:
sticky:
description: |-
Sticky defines the sticky sessions configuration.
- More info: https://doc.traefik.io/traefik/v3.4/routing/services/#sticky-sessions
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
properties:
cookie:
description: Cookie defines the sticky cookie configuration.
@@ -493,7 +511,7 @@ spec:
- type: integer
- type: string
description: |-
- Interval defines the frequency of the health check calls.
+ Interval defines the frequency of the health check calls for healthy targets.
Default: 30s
x-kubernetes-int-or-string: true
method:
@@ -529,6 +547,15 @@ spec:
Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.
Default: 5s
x-kubernetes-int-or-string: true
+ unhealthyInterval:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ UnhealthyInterval defines the frequency of the health check calls for unhealthy targets.
+ When UnhealthyInterval is not defined, it defaults to the Interval value.
+ Default: 30s
+ x-kubernetes-int-or-string: true
type: object
kind:
description: Kind defines the kind of the Service.
@@ -600,7 +627,7 @@ spec:
sticky:
description: |-
Sticky defines the sticky sessions configuration.
- More info: https://doc.traefik.io/traefik/v3.4/routing/services/#sticky-sessions
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/http/load-balancing/service/#sticky-sessions
properties:
cookie:
description: Cookie defines the sticky cookie configuration.
@@ -668,7 +695,7 @@ spec:
sticky:
description: |-
Sticky defines whether sticky sessions are enabled.
- More info: https://doc.traefik.io/traefik/v3.4/routing/providers/kubernetes-crd/#stickiness-and-load-balancing
+ More info: https://doc.traefik.io/traefik/v3.5/reference/routing-configuration/kubernetes/crd/http/traefikservice/#stickiness-and-load-balancing
properties:
cookie:
description: Cookie defines the sticky cookie configuration.
diff --git a/docs/content/reference/install-configuration/api-dashboard.md b/docs/content/reference/install-configuration/api-dashboard.md
index ed485d499..9f03454ca 100644
--- a/docs/content/reference/install-configuration/api-dashboard.md
+++ b/docs/content/reference/install-configuration/api-dashboard.md
@@ -155,11 +155,12 @@ enabing the dashboard [here](https://github.com/traefik/traefik-helm-chart/blob/
| Field | Description | Default | Required |
|:-----------|:---------------------------------|:--------|:---------|
-| `api` | Enable api/dashboard. When set to `true`, its sub option `api.dashboard` is also set to true.| false | No |
-| `api.dashboard` | Enable dashboard. | false | No |
-| `api.debug` | Enable additional endpoints for debugging and profiling. | false | No |
-| `api.disabledashboardad` | Disable the advertisement from the dashboard. | false | No |
-| `api.insecure` | Enable the API and the dashboard on the entryPoint named traefik.| false | No |
+| `api` | Enable api/dashboard. When set to `true`, its sub option `api.dashboard` is also set to true.| false | No |
+| api.basepath | Defines the base path where the API and Dashboard will be exposed. | / | No |
+| `api.dashboard` | Enable dashboard. | false | No |
+| `api.debug` | Enable additional endpoints for debugging and profiling. | false | No |
+| `api.disabledashboardad` | Disable the advertisement from the dashboard. | false | No |
+| `api.insecure` | Enable the API and the dashboard on the entryPoint named traefik.| false | No |
## Endpoints
@@ -167,37 +168,42 @@ All the following endpoints must be accessed with a `GET` HTTP request.
| Path | Description |
|--------------------------------|---------------------------------------------------------------------------------------------|
-| `/api/http/routers` | Lists all the HTTP routers information. |
-| `/api/http/routers/{name}` | Returns the information of the HTTP router specified by `name`. |
-| `/api/http/services` | Lists all the HTTP services information. |
-| `/api/http/services/{name}` | Returns the information of the HTTP service specified by `name`. |
-| `/api/http/middlewares` | Lists all the HTTP middlewares information. |
-| `/api/http/middlewares/{name}` | Returns the information of the HTTP middleware specified by `name`. |
-| `/api/tcp/routers` | Lists all the TCP routers information. |
-| `/api/tcp/routers/{name}` | Returns the information of the TCP router specified by `name`. |
-| `/api/tcp/services` | Lists all the TCP services information. |
-| `/api/tcp/services/{name}` | Returns the information of the TCP service specified by `name`. |
-| `/api/tcp/middlewares` | Lists all the TCP middlewares information. |
-| `/api/tcp/middlewares/{name}` | Returns the information of the TCP middleware specified by `name`. |
-| `/api/udp/routers` | Lists all the UDP routers information. |
-| `/api/udp/routers/{name}` | Returns the information of the UDP router specified by `name`. |
-| `/api/udp/services` | Lists all the UDP services information. |
-| `/api/udp/services/{name}` | Returns the information of the UDP service specified by `name`. |
-| `/api/entrypoints` | Lists all the entry points information. |
-| `/api/entrypoints/{name}` | Returns the information of the entry point specified by `name`. |
-| `/api/overview` | Returns statistic information about HTTP, TCP and about enabled features and providers. |
-| `/api/rawdata` | Returns information about dynamic configurations, errors, status and dependency relations. |
-| `/api/version` | Returns information about Traefik version. |
-| `/debug/vars` | See the [expvar](https://golang.org/pkg/expvar/) Go documentation. |
-| `/debug/pprof/` | See the [pprof Index](https://golang.org/pkg/net/http/pprof/#Index) Go documentation. |
-| `/debug/pprof/cmdline` | See the [pprof Cmdline](https://golang.org/pkg/net/http/pprof/#Cmdline) Go documentation. |
-| `/debug/pprof/profile` | See the [pprof Profile](https://golang.org/pkg/net/http/pprof/#Profile) Go documentation. |
-| `/debug/pprof/symbol` | See the [pprof Symbol](https://golang.org/pkg/net/http/pprof/#Symbol) Go documentation. |
-| `/debug/pprof/trace` | See the [pprof Trace](https://golang.org/pkg/net/http/pprof/#Trace) Go documentation. |
+| `/api/http/routers` | Lists all the HTTP routers information. |
+| `/api/http/routers/{name}` | Returns the information of the HTTP router specified by `name`. |
+| `/api/http/services` | Lists all the HTTP services information. |
+| `/api/http/services/{name}` | Returns the information of the HTTP service specified by `name`. |
+| `/api/http/middlewares` | Lists all the HTTP middlewares information. |
+| `/api/http/middlewares/{name}` | Returns the information of the HTTP middleware specified by `name`. |
+| `/api/tcp/routers` | Lists all the TCP routers information. |
+| `/api/tcp/routers/{name}` | Returns the information of the TCP router specified by `name`. |
+| `/api/tcp/services` | Lists all the TCP services information. |
+| `/api/tcp/services/{name}` | Returns the information of the TCP service specified by `name`. |
+| `/api/tcp/middlewares` | Lists all the TCP middlewares information. |
+| `/api/tcp/middlewares/{name}` | Returns the information of the TCP middleware specified by `name`. |
+| `/api/udp/routers` | Lists all the UDP routers information. |
+| `/api/udp/routers/{name}` | Returns the information of the UDP router specified by `name`. |
+| `/api/udp/services` | Lists all the UDP services information. |
+| `/api/udp/services/{name}` | Returns the information of the UDP service specified by `name`. |
+| `/api/entrypoints` | Lists all the entry points information. |
+| `/api/entrypoints/{name}` | Returns the information of the entry point specified by `name`. |
+| `/api/overview` | Returns statistic information about HTTP, TCP and about enabled features and providers. |
+| `/api/rawdata` | Returns information about dynamic configurations, errors, status and dependency relations. |
+| `/api/version` | Returns information about Traefik version. |
+| `/debug/vars` | See the [expvar](https://golang.org/pkg/expvar/) Go documentation. |
+| `/debug/pprof/` | See the [pprof Index](https://golang.org/pkg/net/http/pprof/#Index) Go documentation. |
+| `/debug/pprof/cmdline` | See the [pprof Cmdline](https://golang.org/pkg/net/http/pprof/#Cmdline) Go documentation. |
+| `/debug/pprof/profile` | See the [pprof Profile](https://golang.org/pkg/net/http/pprof/#Profile) Go documentation. |
+| `/debug/pprof/symbol` | See the [pprof Symbol](https://golang.org/pkg/net/http/pprof/#Symbol) Go documentation. |
+| `/debug/pprof/trace` | See the [pprof Trace](https://golang.org/pkg/net/http/pprof/#Trace) Go documentation. |
+
+
+!!! note "Base Path Configuration"
+
+ By default, Traefik exposes its API and Dashboard under the `/` base path. It's possible to configure it with `api.basepath`. When configured, all endpoints (api, dashboard, debug) are using it.
## Dashboard
-The dashboard is available at the same location as the [API](../../operations/api.md), but by default on the path `/dashboard/`.
+The dashboard is available at the same location as the API, but by default on the path `/dashboard/`.
!!! note
diff --git a/docs/content/reference/install-configuration/boot-environment.md b/docs/content/reference/install-configuration/boot-environment.md
index 223977752..ca4f01c59 100644
--- a/docs/content/reference/install-configuration/boot-environment.md
+++ b/docs/content/reference/install-configuration/boot-environment.md
@@ -7,14 +7,14 @@ description: "Read the official Traefik documentation to get started with config
Traefik Proxy’s configuration is divided into two main categories:
-- **Static Configuration**: Defines parameters that require Traefik to restart when changed. This includes entry points, providers, API/dashboard settings, and logging levels.
-- **Dynamic Configuration**: Involves elements that can be updated without restarting Traefik, such as routers, services, and middlewares.
+- **Install Configuration**: (formerly known as the static configuration) Defines parameters that require Traefik to restart when changed. This includes entry points, providers, API/dashboard settings, and logging levels.
+- **Routing Configuration**: (formerly known as the dynamic configuration) Involves elements that can be updated without restarting Traefik, such as routers, services, and middlewares.
-This section focuses on setting up the static configuration, which is essential for Traefik’s initial boot.
+This section focuses on setting up the install configuration, which is essential for Traefik’s initial boot.
## Configuration Methods
-Traefik offers multiple methods to define static configuration.
+Traefik offers multiple methods to define install configuration.
!!! warning "Note"
It’s crucial to choose one method and stick to it, as mixing different configuration options is not supported and can lead to unexpected behavior.
@@ -28,7 +28,7 @@ Here are the methods available for configuring the Traefik proxy:
## File
-You can define the static configuration in a file using formats like YAML or TOML.
+You can define the install configuration in a file using formats like YAML or TOML.
### Configuration Example
@@ -69,7 +69,7 @@ log:
### Configuration File
-At startup, Traefik searches for static configuration in a file named `traefik.yml` (or `traefik.yaml` or `traefik.toml`) in the following directories:
+At startup, Traefik searches for install configuration in a file named `traefik.yml` (or `traefik.yaml` or `traefik.toml`) in the following directories:
- `/etc/traefik/`
- `$XDG_CONFIG_HOME/`
@@ -84,7 +84,7 @@ traefik --configFile=foo/bar/myconfigfile.yml
## CLI
-Using the CLI, you can pass static configuration directly as command-line arguments when starting Traefik.
+Using the CLI, you can pass install configuration directly as command-line arguments when starting Traefik.
### Configuration Example
@@ -99,7 +99,7 @@ traefik \
## Environment Variables
-You can also set the static configuration using environment variables. Each option corresponds to an environment variable prefixed with `TRAEFIK_`.
+You can also set the install configuration using environment variables. Each option corresponds to an environment variable prefixed with `TRAEFIK_`.
### Configuration Example
@@ -109,7 +109,7 @@ TRAEFIK_ENTRYPOINTS_WEB_ADDRESS=":80" TRAEFIK_ENTRYPOINTS_WEBSECURE_ADDRESS=":44
## Helm
-When deploying Traefik Proxy using Helm in a Kubernetes cluster, the static configuration is defined in a `values.yaml` file.
+When deploying Traefik Proxy using Helm in a Kubernetes cluster, the install configuration is defined in a `values.yaml` file.
You can find the official Traefik Helm chart on [GitHub](https://github.com/traefik/traefik-helm-chart/blob/master/traefik/VALUES.md)
diff --git a/docs/content/reference/install-configuration/configuration-options.md b/docs/content/reference/install-configuration/configuration-options.md
new file mode 100644
index 000000000..596c69283
--- /dev/null
+++ b/docs/content/reference/install-configuration/configuration-options.md
@@ -0,0 +1,491 @@
+
+# Install Configuration Options
+## Configuration Options
+
+| Field | Description | Default |
+|:-------|:------------|:-------|
+| accesslog | Access log settings. | false |
+| accesslog.addinternals | Enables access log for internal services (ping, dashboard, etc...). | false |
+| accesslog.bufferingsize | Number of access log lines to process in a buffered way. | 0 |
+| accesslog.fields.defaultmode | Default mode for fields: keep | drop | keep |
+| | Default mode for fields: keep | drop | redact | drop |
+| | Override mode for headers | |
+| accesslog.fields.names._name_ | Override mode for fields | |
+| accesslog.filepath | Access log file path. Stdout is used when omitted or empty. | |
+| accesslog.filters.minduration | Keep access logs when request took longer than the specified duration. | 0 |
+| accesslog.filters.retryattempts | Keep access logs when at least one retry happened. | false |
+| accesslog.filters.statuscodes | Keep access logs with status codes in the specified range. | |
+| accesslog.format | Access log format: json, common, or genericCLF | common |
+| accesslog.otlp | Settings for OpenTelemetry. | false |
+| accesslog.otlp.grpc | gRPC configuration for the OpenTelemetry collector. | false |
+| accesslog.otlp.grpc.endpoint | Sets the gRPC endpoint (host:port) of the collector. | localhost:4317 |
+| | Headers sent with payload. | |
+| accesslog.otlp.grpc.insecure | Disables client transport security for the exporter. | false |
+| accesslog.otlp.grpc.tls.ca | TLS CA | |
+| accesslog.otlp.grpc.tls.cert | TLS cert | |
+| accesslog.otlp.grpc.tls.insecureskipverify | TLS insecure skip verify | false |
+| accesslog.otlp.grpc.tls.key | TLS key | |
+| accesslog.otlp.http | HTTP configuration for the OpenTelemetry collector. | false |
+| accesslog.otlp.http.endpoint | Sets the HTTP endpoint (scheme://host:port/path) of the collector. | https://localhost:4318 |
+| | Headers sent with payload. | |
+| accesslog.otlp.http.tls.ca | TLS CA | |
+| accesslog.otlp.http.tls.cert | TLS cert | |
+| accesslog.otlp.http.tls.insecureskipverify | TLS insecure skip verify | false |
+| accesslog.otlp.http.tls.key | TLS key | |
+| accesslog.otlp.resourceattributes._name_ | Defines additional resource attributes (key:value). | |
+| accesslog.otlp.servicename | Defines the service name resource attribute. | traefik |
+| api | Enable api/dashboard. | false |
+| api.basepath | Defines the base path where the API and Dashboard will be exposed. | / |
+| api.dashboard | Activate dashboard. | true |
+| api.debug | Enable additional endpoints for debugging and profiling. | false |
+| api.disabledashboardad | Disable ad in the dashboard. | false |
+| api.insecure | Activate API directly on the entryPoint named traefik. | false |
+| certificatesresolvers._name_ | Certificates resolvers configuration. | false |
+| certificatesresolvers._name_.acme.cacertificates | Specify the paths to PEM encoded CA Certificates that can be used to authenticate an ACME server with an HTTPS certificate not issued by a CA in the system-wide trusted root list. | |
+| certificatesresolvers._name_.acme.caserver | CA server to use. | https://acme-v02.api.letsencrypt.org/directory |
+| certificatesresolvers._name_.acme.caservername | Specify the CA server name that can be used to authenticate an ACME server with an HTTPS certificate not issued by a CA in the system-wide trusted root list. | |
+| certificatesresolvers._name_.acme.casystemcertpool | Define if the certificates pool must use a copy of the system cert pool. | false |
+| certificatesresolvers._name_.acme.certificatesduration | Certificates' duration in hours. | 2160 |
+| | Timeout for receiving the response headers when communicating with the ACME server. | 30 |
+| certificatesresolvers._name_.acme.clienttimeout | Timeout for a complete HTTP transaction with the ACME server. | 120 |
+| certificatesresolvers._name_.acme.dnschallenge | Activate DNS-01 Challenge. | false |
+| certificatesresolvers._name_.acme.dnschallenge.delaybeforecheck | (Deprecated) Assume DNS propagates after a delay in seconds rather than finding and querying nameservers. | 0 |
+| certificatesresolvers._name_.acme.dnschallenge.disablepropagationcheck | (Deprecated) Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready. [not recommended] | false |
+| certificatesresolvers._name_.acme.dnschallenge.propagation | DNS propagation checks configuration | false |
+| certificatesresolvers._name_.acme.dnschallenge.propagation.delaybeforechecks | Defines the delay before checking the challenge TXT record propagation. | 0 |
+| certificatesresolvers._name_.acme.dnschallenge.propagation.disableanschecks | Disables the challenge TXT record propagation checks against authoritative nameservers. | false |
+| certificatesresolvers._name_.acme.dnschallenge.propagation.disablechecks | Disables the challenge TXT record propagation checks (not recommended). | false |
+| certificatesresolvers._name_.acme.dnschallenge.propagation.requireallrns | Requires the challenge TXT record to be propagated to all recursive nameservers. | false |
+| certificatesresolvers._name_.acme.dnschallenge.provider | Use a DNS-01 based challenge provider rather than HTTPS. | |
+| certificatesresolvers._name_.acme.dnschallenge.resolvers | Use following DNS servers to resolve the FQDN authority. | |
+| certificatesresolvers._name_.acme.eab.hmacencoded | Base64 encoded HMAC key from External CA. | |
+| certificatesresolvers._name_.acme.eab.kid | Key identifier from External CA. | |
+| certificatesresolvers._name_.acme.email | Email address used for registration. | |
+| certificatesresolvers._name_.acme.emailaddresses | CSR email addresses to use. | |
+| certificatesresolvers._name_.acme.httpchallenge | Activate HTTP-01 Challenge. | false |
+| certificatesresolvers._name_.acme.httpchallenge.delay | Delay between the creation of the challenge and the validation. | 0 |
+| certificatesresolvers._name_.acme.httpchallenge.entrypoint | HTTP challenge EntryPoint | |
+| certificatesresolvers._name_.acme.keytype | KeyType used for generating certificate private key. Allow value 'EC256', 'EC384', 'RSA2048', 'RSA4096', 'RSA8192'. | RSA4096 |
+| certificatesresolvers._name_.acme.preferredchain | Preferred chain to use. | |
+| certificatesresolvers._name_.acme.profile | Certificate profile to use. | |
+| certificatesresolvers._name_.acme.storage | Storage to use. | acme.json |
+| certificatesresolvers._name_.acme.tlschallenge | Activate TLS-ALPN-01 Challenge. | true |
+| certificatesresolvers._name_.tailscale | Enables Tailscale certificate resolution. | true |
+| core.defaultrulesyntax | Defines the rule parser default syntax (v2 or v3) | v3 |
+| entrypoints._name_ | Entry points definition. | false |
+| entrypoints._name_.address | Entry point address. | |
+| entrypoints._name_.allowacmebypass | Enables handling of ACME TLS and HTTP challenges with custom routers. | false |
+| entrypoints._name_.asdefault | Adds this EntryPoint to the list of default EntryPoints to be used on routers that don't have any Entrypoint defined. | false |
+| | List of Connection headers that are allowed to pass through the middleware chain before being removed. | |
+| | Trust all forwarded headers. | false |
+| | Trust only forwarded headers from selected IPs. | |
+| entrypoints._name_.http | HTTP configuration. | |
+| entrypoints._name_.http.encodequerysemicolons | Defines whether request query semicolons should be URLEncoded. | false |
+| | Maximum size of request headers in bytes. | 1048576 |
+| entrypoints._name_.http.middlewares | Default middlewares for the routers linked to the entry point. | |
+| entrypoints._name_.http.redirections.entrypoint.permanent | Applies a permanent redirection. | true |
+| entrypoints._name_.http.redirections.entrypoint.priority | Priority of the generated router. | 9223372036854775806 |
+| entrypoints._name_.http.redirections.entrypoint.scheme | Scheme used for the redirection. | https |
+| entrypoints._name_.http.redirections.entrypoint.to | Targeted entry point of the redirection. | |
+| entrypoints._name_.http.sanitizepath | Defines whether to enable request path sanitization (removal of /./, /../ and multiple slash sequences). | true |
+| entrypoints._name_.http.tls | Default TLS configuration for the routers linked to the entry point. | false |
+| entrypoints._name_.http.tls.certresolver | Default certificate resolver for the routers linked to the entry point. | |
+| entrypoints._name_.http.tls.domains | Default TLS domains for the routers linked to the entry point. | |
+| entrypoints._name_.http.tls.domains[0].main | Default subject name. | |
+| entrypoints._name_.http.tls.domains[0].sans | Subject alternative names. | |
+| entrypoints._name_.http.tls.options | Default TLS options for the routers linked to the entry point. | |
+| entrypoints._name_.http2.maxconcurrentstreams | Specifies the number of concurrent streams per connection that each client is allowed to initiate. | 250 |
+| entrypoints._name_.http3 | HTTP/3 configuration. | false |
+| entrypoints._name_.http3.advertisedport | UDP port to advertise, on which HTTP/3 is available. | 0 |
+| entrypoints._name_.observability.accesslogs | Enables access-logs for this entryPoint. | true |
+| entrypoints._name_.observability.metrics | Enables metrics for this entryPoint. | true |
+| entrypoints._name_.observability.traceverbosity | Defines the tracing verbosity level for this entryPoint. | minimal |
+| entrypoints._name_.observability.tracing | Enables tracing for this entryPoint. | true |
+| entrypoints._name_.proxyprotocol | Proxy-Protocol configuration. | false |
+| entrypoints._name_.proxyprotocol.insecure | Trust all. | false |
+| entrypoints._name_.proxyprotocol.trustedips | Trust only selected IPs. | |
+| entrypoints._name_.reuseport | Enables EntryPoints from the same or different processes listening on the same TCP/UDP port. | false |
+| entrypoints._name_.transport.keepalivemaxrequests | Maximum number of requests before closing a keep-alive connection. | 0 |
+| entrypoints._name_.transport.keepalivemaxtime | Maximum duration before closing a keep-alive connection. | 0 |
+| entrypoints._name_.transport.lifecycle.gracetimeout | Duration to give active requests a chance to finish before Traefik stops. | 10 |
+| entrypoints._name_.transport.lifecycle.requestacceptgracetimeout | Duration to keep accepting requests before Traefik initiates the graceful shutdown procedure. | 0 |
+| entrypoints._name_.transport.respondingtimeouts.idletimeout | IdleTimeout is the maximum amount duration an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout is set. | 180 |
+| entrypoints._name_.transport.respondingtimeouts.readtimeout | ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. | 60 |
+| entrypoints._name_.transport.respondingtimeouts.writetimeout | WriteTimeout is the maximum duration before timing out writes of the response. If zero, no timeout is set. | 0 |
+| entrypoints._name_.udp.timeout | Timeout defines how long to wait on an idle session before releasing the related resources. | 3 |
+| experimental.abortonpluginfailure | Defines whether all plugins must be loaded successfully for Traefik to start. | false |
+| experimental.fastproxy | Enables the FastProxy implementation. | false |
+| experimental.fastproxy.debug | Enable debug mode for the FastProxy implementation. | false |
+| experimental.kubernetesgateway | (Deprecated) Allow the Kubernetes gateway api provider usage. | false |
+| experimental.kubernetesingressnginx | Allow the Kubernetes Ingress NGINX provider usage. | false |
+| experimental.localplugins._name_ | Local plugins configuration. | false |
+| experimental.localplugins._name_.modulename | Plugin's module name. | |
+| experimental.localplugins._name_.settings | Plugin's settings (works only for wasm plugins). | |
+| experimental.localplugins._name_.settings.envs | Environment variables to forward to the wasm guest. | |
+| experimental.localplugins._name_.settings.mounts | Directory to mount to the wasm guest. | |
+| experimental.localplugins._name_.settings.useunsafe | Allow the plugin to use unsafe package. | false |
+| experimental.otlplogs | Enables the OpenTelemetry logs integration. | false |
+| experimental.plugins._name_.hash | plugin's hash to validate' | |
+| experimental.plugins._name_.modulename | plugin's module name. | |
+| experimental.plugins._name_.settings | Plugin's settings (works only for wasm plugins). | |
+| experimental.plugins._name_.settings.envs | Environment variables to forward to the wasm guest. | |
+| experimental.plugins._name_.settings.mounts | Directory to mount to the wasm guest. | |
+| experimental.plugins._name_.settings.useunsafe | Allow the plugin to use unsafe package. | false |
+| experimental.plugins._name_.version | plugin's version. | |
+| global.checknewversion | Periodically check if a new version has been released. | true |
+| global.sendanonymoususage | Periodically send anonymous usage statistics. If the option is not specified, it will be disabled by default. | false |
+| global.updatercallbacks | Callback urls for updater script (example: https://localhost:8080/callback) | |
+| hostresolver | Enable CNAME Flattening. | false |
+| hostresolver.cnameflattening | A flag to enable/disable CNAME flattening | false |
+| hostresolver.resolvconfig | resolv.conf used for DNS resolving | /etc/resolv.conf |
+| hostresolver.resolvdepth | The maximal depth of DNS recursive resolving | 5 |
+| log | Traefik log settings. | false |
+| log.compress | Determines if the rotated log files should be compressed using gzip. | false |
+| log.filepath | Traefik log file path. Stdout is used when omitted or empty. | |
+| log.format | Traefik log format: json | common | common |
+| log.level | Log level set to traefik logs. | ERROR |
+| log.maxage | Maximum number of days to retain old log files based on the timestamp encoded in their filename. | 0 |
+| log.maxbackups | Maximum number of old log files to retain. | 0 |
+| log.maxsize | Maximum size in megabytes of the log file before it gets rotated. | 0 |
+| log.nocolor | When using the 'common' format, disables the colorized output. | false |
+| log.otlp | Settings for OpenTelemetry. | false |
+| log.otlp.grpc | gRPC configuration for the OpenTelemetry collector. | false |
+| log.otlp.grpc.endpoint | Sets the gRPC endpoint (host:port) of the collector. | localhost:4317 |
+| | Headers sent with payload. | |
+| log.otlp.grpc.insecure | Disables client transport security for the exporter. | false |
+| log.otlp.grpc.tls.ca | TLS CA | |
+| log.otlp.grpc.tls.cert | TLS cert | |
+| log.otlp.grpc.tls.insecureskipverify | TLS insecure skip verify | false |
+| log.otlp.grpc.tls.key | TLS key | |
+| log.otlp.http | HTTP configuration for the OpenTelemetry collector. | false |
+| log.otlp.http.endpoint | Sets the HTTP endpoint (scheme://host:port/path) of the collector. | https://localhost:4318 |
+| | Headers sent with payload. | |
+| log.otlp.http.tls.ca | TLS CA | |
+| log.otlp.http.tls.cert | TLS cert | |
+| log.otlp.http.tls.insecureskipverify | TLS insecure skip verify | false |
+| log.otlp.http.tls.key | TLS key | |
+| log.otlp.resourceattributes._name_ | Defines additional resource attributes (key:value). | |
+| log.otlp.servicename | Defines the service name resource attribute. | traefik |
+| metrics.addinternals | Enables metrics for internal services (ping, dashboard, etc...). | false |
+| metrics.datadog | Datadog metrics exporter type. | false |
+| metrics.datadog.addentrypointslabels | Enable metrics on entry points. | true |
+| metrics.datadog.address | Datadog's address. | localhost:8125 |
+| metrics.datadog.addrouterslabels | Enable metrics on routers. | false |
+| metrics.datadog.addserviceslabels | Enable metrics on services. | true |
+| metrics.datadog.prefix | Prefix to use for metrics collection. | traefik |
+| metrics.datadog.pushinterval | Datadog push interval. | 10 |
+| metrics.influxdb2 | InfluxDB v2 metrics exporter type. | false |
+| metrics.influxdb2.addentrypointslabels | Enable metrics on entry points. | true |
+| metrics.influxdb2.additionallabels._name_ | Additional labels (influxdb tags) on all metrics | |
+| metrics.influxdb2.address | InfluxDB v2 address. | http://localhost:8086 |
+| metrics.influxdb2.addrouterslabels | Enable metrics on routers. | false |
+| metrics.influxdb2.addserviceslabels | Enable metrics on services. | true |
+| metrics.influxdb2.bucket | InfluxDB v2 bucket ID. | |
+| metrics.influxdb2.org | InfluxDB v2 org ID. | |
+| metrics.influxdb2.pushinterval | InfluxDB v2 push interval. | 10 |
+| metrics.influxdb2.token | InfluxDB v2 access token. | |
+| metrics.otlp | OpenTelemetry metrics exporter type. | false |
+| metrics.otlp.addentrypointslabels | Enable metrics on entry points. | true |
+| metrics.otlp.addrouterslabels | Enable metrics on routers. | false |
+| metrics.otlp.addserviceslabels | Enable metrics on services. | true |
+| metrics.otlp.explicitboundaries | Boundaries for latency metrics. | 0.005000, 0.010000, 0.025000, 0.050000, 0.075000, 0.100000, 0.250000, 0.500000, 0.750000, 1.000000, 2.500000, 5.000000, 7.500000, 10.000000 |
+| metrics.otlp.grpc | gRPC configuration for the OpenTelemetry collector. | false |
+| metrics.otlp.grpc.endpoint | Sets the gRPC endpoint (host:port) of the collector. | localhost:4317 |
+| | Headers sent with payload. | |
+| metrics.otlp.grpc.insecure | Disables client transport security for the exporter. | false |
+| metrics.otlp.grpc.tls.ca | TLS CA | |
+| metrics.otlp.grpc.tls.cert | TLS cert | |
+| metrics.otlp.grpc.tls.insecureskipverify | TLS insecure skip verify | false |
+| metrics.otlp.grpc.tls.key | TLS key | |
+| metrics.otlp.http | HTTP configuration for the OpenTelemetry collector. | false |
+| metrics.otlp.http.endpoint | Sets the HTTP endpoint (scheme://host:port/path) of the collector. | https://localhost:4318 |
+| | Headers sent with payload. | |
+| metrics.otlp.http.tls.ca | TLS CA | |
+| metrics.otlp.http.tls.cert | TLS cert | |
+| metrics.otlp.http.tls.insecureskipverify | TLS insecure skip verify | false |
+| metrics.otlp.http.tls.key | TLS key | |
+| metrics.otlp.pushinterval | Period between calls to collect a checkpoint. | 10 |
+| metrics.otlp.resourceattributes._name_ | Defines additional resource attributes (key:value). | |
+| metrics.otlp.servicename | Defines the service name resource attribute. | traefik |
+| metrics.prometheus | Prometheus metrics exporter type. | false |
+| metrics.prometheus.addentrypointslabels | Enable metrics on entry points. | true |
+| metrics.prometheus.addrouterslabels | Enable metrics on routers. | false |
+| metrics.prometheus.addserviceslabels | Enable metrics on services. | true |
+| metrics.prometheus.buckets | Buckets for latency metrics. | 0.100000, 0.300000, 1.200000, 5.000000 |
+| metrics.prometheus.entrypoint | EntryPoint | traefik |
+| | Defines the extra labels for the requests_total metrics, and for each of them, the request header containing the value for this label. | |
+| metrics.prometheus.manualrouting | Manual routing | false |
+| metrics.statsd | StatsD metrics exporter type. | false |
+| metrics.statsd.addentrypointslabels | Enable metrics on entry points. | true |
+| metrics.statsd.address | StatsD address. | localhost:8125 |
+| metrics.statsd.addrouterslabels | Enable metrics on routers. | false |
+| metrics.statsd.addserviceslabels | Enable metrics on services. | true |
+| metrics.statsd.prefix | Prefix to use for metrics collection. | traefik |
+| metrics.statsd.pushinterval | StatsD push interval. | 10 |
+| ocsp | OCSP configuration. | false |
+| ocsp.responderoverrides._name_ | Defines a map of OCSP responders to replace for querying OCSP servers. | |
+| ping | Enable ping. | false |
+| ping.entrypoint | EntryPoint | traefik |
+| ping.manualrouting | Manual routing | false |
+| ping.terminatingstatuscode | Terminating status code | 503 |
+| providers.consul | Enables Consul provider. | false |
+| providers.consul.endpoints | KV store endpoints. | 127.0.0.1:8500 |
+| providers.consul.namespaces | Sets the namespaces used to discover the configuration (Consul Enterprise only). | |
+| providers.consul.rootkey | Root key used for KV store. | traefik |
+| providers.consul.tls.ca | TLS CA | |
+| providers.consul.tls.cert | TLS cert | |
+| providers.consul.tls.insecureskipverify | TLS insecure skip verify | false |
+| providers.consul.tls.key | TLS key | |
+| providers.consul.token | Per-request ACL token. | |
+| providers.consulcatalog | Enables Consul Catalog provider. | false |
+| providers.consulcatalog.cache | Use local agent caching for catalog reads. | false |
+| providers.consulcatalog.connectaware | Enable Consul Connect support. | false |
+| providers.consulcatalog.connectbydefault | Consider every service as Connect capable by default. | false |
+| providers.consulcatalog.constraints | Constraints is an expression that Traefik matches against the container's labels to determine whether to create any route for that container. | |
+| providers.consulcatalog.defaultrule | Default rule. | Host(`{{ normalize .Name }}`) |
+| providers.consulcatalog.endpoint.address | The address of the Consul server | |
+| providers.consulcatalog.endpoint.datacenter | Data center to use. If not provided, the default agent data center is used | |
+| providers.consulcatalog.endpoint.endpointwaittime | WaitTime limits how long a Watch will block. If not provided, the agent default values will be used | 0 |
+| providers.consulcatalog.endpoint.httpauth.password | Basic Auth password | |
+| providers.consulcatalog.endpoint.httpauth.username | Basic Auth username | |
+| providers.consulcatalog.endpoint.scheme | The URI scheme for the Consul server | |
+| providers.consulcatalog.endpoint.tls.ca | TLS CA | |
+| providers.consulcatalog.endpoint.tls.cert | TLS cert | |
+| providers.consulcatalog.endpoint.tls.insecureskipverify | TLS insecure skip verify | false |
+| providers.consulcatalog.endpoint.tls.key | TLS key | |
+| providers.consulcatalog.endpoint.token | Token is used to provide a per-request ACL token which overrides the agent's default token | |
+| providers.consulcatalog.exposedbydefault | Expose containers by default. | true |
+| providers.consulcatalog.namespaces | Sets the namespaces used to discover services (Consul Enterprise only). | |
+| providers.consulcatalog.prefix | Prefix for consul service tags. | traefik |
+| providers.consulcatalog.refreshinterval | Interval for check Consul API. | 15 |
+| providers.consulcatalog.requireconsistent | Forces the read to be fully consistent. | false |
+| providers.consulcatalog.servicename | Name of the Traefik service in Consul Catalog (needs to be registered via the orchestrator or manually). | traefik |
+| providers.consulcatalog.stale | Use stale consistency for catalog reads. | false |
+| providers.consulcatalog.strictchecks | A list of service health statuses to allow taking traffic. | passing, warning |
+| providers.consulcatalog.watch | Watch Consul API events. | false |
+| providers.docker | Enables Docker provider. | false |
+| providers.docker.allowemptyservices | Disregards the Docker containers health checks with respect to the creation or removal of the corresponding services. | false |
+| providers.docker.constraints | Constraints is an expression that Traefik matches against the container's labels to determine whether to create any route for that container. | |
+| providers.docker.defaultrule | Default rule. | Host(`{{ normalize .Name }}`) |
+| providers.docker.endpoint | Docker server endpoint. Can be a TCP or a Unix socket endpoint. | unix:///var/run/docker.sock |
+| providers.docker.exposedbydefault | Expose containers by default. | true |
+| providers.docker.httpclienttimeout | Client timeout for HTTP connections. | 0 |
+| providers.docker.labelmap | Label shorthands. | |
+| providers.docker.labelmap[0].from | Shorthand label. | |
+| providers.docker.labelmap[0].to | Full label with templates. | |
+| providers.docker.labelmap[0].value | Optional override; used instead of user input if set. | |
+| providers.docker.network | Default Docker network used. | |
+| providers.docker.password | Password for Basic HTTP authentication. | |
+| providers.docker.tls.ca | TLS CA | |
+| providers.docker.tls.cert | TLS cert | |
+| providers.docker.tls.insecureskipverify | TLS insecure skip verify | false |
+| providers.docker.tls.key | TLS key | |
+| providers.docker.usebindportip | Use the ip address from the bound port, rather than from the inner network. | false |
+| providers.docker.username | Username for Basic HTTP authentication. | |
+| providers.docker.watch | Watch Docker events. | true |
+| providers.ecs | Enables AWS ECS provider. | false |
+| providers.ecs.accesskeyid | AWS credentials access key ID to use for making requests. | |
+| providers.ecs.autodiscoverclusters | Auto discover cluster. | false |
+| providers.ecs.clusters | ECS Cluster names. | default |
+| providers.ecs.constraints | Constraints is an expression that Traefik matches against the container's labels to determine whether to create any route for that container. | |
+| providers.ecs.defaultrule | Default rule. | Host(`{{ normalize .Name }}`) |
+| providers.ecs.ecsanywhere | Enable ECS Anywhere support. | false |
+| providers.ecs.exposedbydefault | Expose services by default. | true |
+| providers.ecs.healthytasksonly | Determines whether to discover only healthy tasks. | false |
+| providers.ecs.refreshseconds | Polling interval (in seconds). | 15 |
+| providers.ecs.region | AWS region to use for requests. | |
+| providers.ecs.secretaccesskey | AWS credentials access key to use for making requests. | |
+| providers.etcd | Enables Etcd provider. | false |
+| providers.etcd.endpoints | KV store endpoints. | 127.0.0.1:2379 |
+| providers.etcd.password | Password for authentication. | |
+| providers.etcd.rootkey | Root key used for KV store. | traefik |
+| providers.etcd.tls.ca | TLS CA | |
+| providers.etcd.tls.cert | TLS cert | |
+| providers.etcd.tls.insecureskipverify | TLS insecure skip verify | false |
+| providers.etcd.tls.key | TLS key | |
+| providers.etcd.username | Username for authentication. | |
+| providers.file.debugloggeneratedtemplate | Enable debug logging of generated configuration template. | false |
+| providers.file.directory | Load dynamic configuration from one or more .yml or .toml files in a directory. | |
+| providers.file.filename | Load dynamic configuration from a file. | |
+| providers.file.watch | Watch provider. | true |
+| providers.http | Enables HTTP provider. | false |
+| providers.http.endpoint | Load configuration from this endpoint. | |
+| | Define custom headers to be sent to the endpoint. | |
+| providers.http.pollinterval | Polling interval for endpoint. | 5 |
+| providers.http.polltimeout | Polling timeout for endpoint. | 5 |
+| providers.http.tls.ca | TLS CA | |
+| providers.http.tls.cert | TLS cert | |
+| providers.http.tls.insecureskipverify | TLS insecure skip verify | false |
+| providers.http.tls.key | TLS key | |
+| providers.kubernetescrd | Enables Kubernetes CRD provider. | false |
+| providers.kubernetescrd.allowcrossnamespace | Allow cross namespace resource reference. | false |
+| providers.kubernetescrd.allowemptyservices | Allow the creation of services without endpoints. | false |
+| providers.kubernetescrd.allowexternalnameservices | Allow ExternalName services. | false |
+| providers.kubernetescrd.certauthfilepath | Kubernetes certificate authority file path (not needed for in-cluster client). | |
+| providers.kubernetescrd.disableclusterscoperesources | Disables the lookup of cluster scope resources (incompatible with IngressClasses and NodePortLB enabled services). | false |
+| providers.kubernetescrd.endpoint | Kubernetes server endpoint (required for external cluster client). | |
+| providers.kubernetescrd.ingressclass | Value of kubernetes.io/ingress.class annotation to watch for. | |
+| providers.kubernetescrd.labelselector | Kubernetes label selector to use. | |
+| providers.kubernetescrd.namespaces | Kubernetes namespaces. | |
+| providers.kubernetescrd.nativelbbydefault | Defines whether to use Native Kubernetes load-balancing mode by default. | false |
+| providers.kubernetescrd.throttleduration | Ingress refresh throttle duration | 0 |
+| providers.kubernetescrd.token | Kubernetes bearer token (not needed for in-cluster client). It accepts either a token value or a file path to the token. | |
+| providers.kubernetesgateway | Enables Kubernetes Gateway API provider. | false |
+| providers.kubernetesgateway.certauthfilepath | Kubernetes certificate authority file path (not needed for in-cluster client). | |
+| providers.kubernetesgateway.endpoint | Kubernetes server endpoint (required for external cluster client). | |
+| providers.kubernetesgateway.experimentalchannel | Toggles Experimental Channel resources support (TCPRoute, TLSRoute...). | false |
+| providers.kubernetesgateway.labelselector | Kubernetes label selector to select specific GatewayClasses. | |
+| providers.kubernetesgateway.namespaces | Kubernetes namespaces. | |
+| providers.kubernetesgateway.nativelbbydefault | Defines whether to use Native Kubernetes load-balancing by default. | false |
+| providers.kubernetesgateway.statusaddress.hostname | Hostname used for Kubernetes Gateway status address. | |
+| providers.kubernetesgateway.statusaddress.ip | IP used to set Kubernetes Gateway status address. | |
+| providers.kubernetesgateway.statusaddress.service | Published Kubernetes Service to copy status addresses from. | |
+| providers.kubernetesgateway.statusaddress.service.name | Name of the Kubernetes service. | |
+| providers.kubernetesgateway.statusaddress.service.namespace | Namespace of the Kubernetes service. | |
+| providers.kubernetesgateway.throttleduration | Kubernetes refresh throttle duration | 0 |
+| providers.kubernetesgateway.token | Kubernetes bearer token (not needed for in-cluster client). It accepts either a token value or a file path to the token. | |
+| providers.kubernetesingress | Enables Kubernetes Ingress provider. | false |
+| providers.kubernetesingress.allowemptyservices | Allow creation of services without endpoints. | false |
+| providers.kubernetesingress.allowexternalnameservices | Allow ExternalName services. | false |
+| providers.kubernetesingress.certauthfilepath | Kubernetes certificate authority file path (not needed for in-cluster client). | |
+| providers.kubernetesingress.disableclusterscoperesources | Disables the lookup of cluster scope resources (incompatible with IngressClasses and NodePortLB enabled services). | false |
+| providers.kubernetesingress.disableingressclasslookup | Disables the lookup of IngressClasses (Deprecated, please use DisableClusterScopeResources). | false |
+| providers.kubernetesingress.endpoint | Kubernetes server endpoint (required for external cluster client). | |
+| providers.kubernetesingress.ingressclass | Value of kubernetes.io/ingress.class annotation or IngressClass name to watch for. | |
+| providers.kubernetesingress.ingressendpoint.hostname | Hostname used for Kubernetes Ingress endpoints. | |
+| providers.kubernetesingress.ingressendpoint.ip | IP used for Kubernetes Ingress endpoints. | |
+| providers.kubernetesingress.ingressendpoint.publishedservice | Published Kubernetes Service to copy status from. | |
+| providers.kubernetesingress.labelselector | Kubernetes Ingress label selector to use. | |
+| providers.kubernetesingress.namespaces | Kubernetes namespaces. | |
+| providers.kubernetesingress.nativelbbydefault | Defines whether to use Native Kubernetes load-balancing mode by default. | false |
+| providers.kubernetesingress.strictprefixmatching | Make prefix matching strictly comply with the Kubernetes Ingress specification (path-element-wise matching instead of character-by-character string matching). | false |
+| providers.kubernetesingress.throttleduration | Ingress refresh throttle duration | 0 |
+| providers.kubernetesingress.token | Kubernetes bearer token (not needed for in-cluster client). It accepts either a token value or a file path to the token. | |
+| providers.kubernetesingressnginx | Enables Kubernetes Ingress NGINX provider. | false |
+| providers.kubernetesingressnginx.certauthfilepath | Kubernetes certificate authority file path (not needed for in-cluster client). | |
+| providers.kubernetesingressnginx.controllerclass | Ingress Class Controller value this controller satisfies. | k8s.io/ingress-nginx |
+| providers.kubernetesingressnginx.defaultbackendservice | Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form 'namespace/name'. | |
+| providers.kubernetesingressnginx.disablesvcexternalname | Disable support for Services of type ExternalName. | false |
+| providers.kubernetesingressnginx.endpoint | Kubernetes server endpoint (required for external cluster client). | |
+| providers.kubernetesingressnginx.ingressclass | Name of the ingress class this controller satisfies. | nginx |
+| providers.kubernetesingressnginx.ingressclassbyname | Define if Ingress Controller should watch for Ingress Class by Name together with Controller Class. | false |
+| providers.kubernetesingressnginx.publishservice | Service fronting the Ingress controller. Takes the form 'namespace/name'. | |
+| providers.kubernetesingressnginx.publishstatusaddress | Customized address (or addresses, separated by comma) to set as the load-balancer status of Ingress objects this controller satisfies. | |
+| providers.kubernetesingressnginx.throttleduration | Ingress refresh throttle duration. | 0 |
+| providers.kubernetesingressnginx.token | Kubernetes bearer token (not needed for in-cluster client). It accepts either a token value or a file path to the token. | |
+| providers.kubernetesingressnginx.watchingresswithoutclass | Define if Ingress Controller should also watch for Ingresses without an IngressClass or the annotation specified. | false |
+| providers.kubernetesingressnginx.watchnamespace | Namespace the controller watches for updates to Kubernetes objects. All namespaces are watched if this parameter is left empty. | |
+| providers.kubernetesingressnginx.watchnamespaceselector | Selector selects namespaces the controller watches for updates to Kubernetes objects. | |
+| providers.nomad | Enables Nomad provider. | false |
+| providers.nomad.allowemptyservices | Allow the creation of services without endpoints. | false |
+| providers.nomad.constraints | Constraints is an expression that Traefik matches against the Nomad service's tags to determine whether to create route(s) for that service. | |
+| providers.nomad.defaultrule | Default rule. | Host(`{{ normalize .Name }}`) |
+| providers.nomad.endpoint.address | The address of the Nomad server, including scheme and port. | http://127.0.0.1:4646 |
+| providers.nomad.endpoint.endpointwaittime | WaitTime limits how long a Watch will block. If not provided, the agent default values will be used | 0 |
+| providers.nomad.endpoint.region | Nomad region to use. If not provided, the local agent region is used. | |
+| providers.nomad.endpoint.tls.ca | TLS CA | |
+| providers.nomad.endpoint.tls.cert | TLS cert | |
+| providers.nomad.endpoint.tls.insecureskipverify | TLS insecure skip verify | false |
+| providers.nomad.endpoint.tls.key | TLS key | |
+| providers.nomad.endpoint.token | Token is used to provide a per-request ACL token. | |
+| providers.nomad.exposedbydefault | Expose Nomad services by default. | true |
+| providers.nomad.namespaces | Sets the Nomad namespaces used to discover services. | |
+| providers.nomad.prefix | Prefix for nomad service tags. | traefik |
+| providers.nomad.refreshinterval | Interval for polling Nomad API. | 15 |
+| providers.nomad.stale | Use stale consistency for catalog reads. | false |
+| providers.nomad.throttleduration | Watch throttle duration. | 0 |
+| providers.nomad.watch | Watch Nomad Service events. | false |
+| providers.plugin._name_ | Plugins configuration. | |
+| providers.providersthrottleduration | Backends throttle duration: minimum duration between 2 events from providers before applying a new configuration. It avoids unnecessary reloads if multiples events are sent in a short amount of time. | 2 |
+| providers.redis | Enables Redis provider. | false |
+| providers.redis.db | Database to be selected after connecting to the server. | 0 |
+| providers.redis.endpoints | KV store endpoints. | 127.0.0.1:6379 |
+| providers.redis.password | Password for authentication. | |
+| providers.redis.rootkey | Root key used for KV store. | traefik |
+| providers.redis.sentinel.latencystrategy | Defines whether to route commands to the closest master or replica nodes (mutually exclusive with RandomStrategy and ReplicaStrategy). | false |
+| providers.redis.sentinel.mastername | Name of the master. | |
+| providers.redis.sentinel.password | Password for Sentinel authentication. | |
+| providers.redis.sentinel.randomstrategy | Defines whether to route commands randomly to master or replica nodes (mutually exclusive with LatencyStrategy and ReplicaStrategy). | false |
+| providers.redis.sentinel.replicastrategy | Defines whether to route all commands to replica nodes (mutually exclusive with LatencyStrategy and RandomStrategy). | false |
+| providers.redis.sentinel.usedisconnectedreplicas | Use replicas disconnected with master when cannot get connected replicas. | false |
+| providers.redis.sentinel.username | Username for Sentinel authentication. | |
+| providers.redis.tls.ca | TLS CA | |
+| providers.redis.tls.cert | TLS cert | |
+| providers.redis.tls.insecureskipverify | TLS insecure skip verify | false |
+| providers.redis.tls.key | TLS key | |
+| providers.redis.username | Username for authentication. | |
+| providers.rest | Enables Rest provider. | false |
+| providers.rest.insecure | Activate REST Provider directly on the entryPoint named traefik. | false |
+| providers.swarm | Enables Docker Swarm provider. | false |
+| providers.swarm.allowemptyservices | Disregards the Docker containers health checks with respect to the creation or removal of the corresponding services. | false |
+| providers.swarm.constraints | Constraints is an expression that Traefik matches against the container's labels to determine whether to create any route for that container. | |
+| providers.swarm.defaultrule | Default rule. | Host(`{{ normalize .Name }}`) |
+| providers.swarm.endpoint | Docker server endpoint. Can be a TCP or a Unix socket endpoint. | unix:///var/run/docker.sock |
+| providers.swarm.exposedbydefault | Expose containers by default. | true |
+| providers.swarm.httpclienttimeout | Client timeout for HTTP connections. | 0 |
+| providers.swarm.labelmap | Label shorthands. | |
+| providers.swarm.labelmap[0].from | Shorthand label. | |
+| providers.swarm.labelmap[0].to | Full label with templates. | |
+| providers.swarm.labelmap[0].value | Optional override; used instead of user input if set. | |
+| providers.swarm.network | Default Docker network used. | |
+| providers.swarm.password | Password for Basic HTTP authentication. | |
+| providers.swarm.refreshseconds | Polling interval for swarm mode. | 15 |
+| providers.swarm.tls.ca | TLS CA | |
+| providers.swarm.tls.cert | TLS cert | |
+| providers.swarm.tls.insecureskipverify | TLS insecure skip verify | false |
+| providers.swarm.tls.key | TLS key | |
+| providers.swarm.usebindportip | Use the ip address from the bound port, rather than from the inner network. | false |
+| providers.swarm.username | Username for Basic HTTP authentication. | |
+| providers.swarm.watch | Watch Docker events. | true |
+| providers.zookeeper | Enables ZooKeeper provider. | false |
+| providers.zookeeper.endpoints | KV store endpoints. | 127.0.0.1:2181 |
+| providers.zookeeper.password | Password for authentication. | |
+| providers.zookeeper.rootkey | Root key used for KV store. | traefik |
+| providers.zookeeper.username | Username for authentication. | |
+| serverstransport.forwardingtimeouts.dialtimeout | The amount of time to wait until a connection to a backend server can be established. If zero, no timeout exists. | 30 |
+| serverstransport.forwardingtimeouts.idleconntimeout | The maximum period for which an idle HTTP keep-alive connection will remain open before closing itself | 90 |
+| | The amount of time to wait for a server's response headers after fully writing the request (including its body, if any). If zero, no timeout exists. | 0 |
+| serverstransport.insecureskipverify | Disable SSL certificate verification. | false |
+| serverstransport.maxidleconnsperhost | If non-zero, controls the maximum idle (keep-alive) to keep per-host. If zero, DefaultMaxIdleConnsPerHost is used. If negative, disables connection reuse. | 200 |
+| serverstransport.rootcas | Add cert file for self-signed certificate. | |
+| serverstransport.spiffe | Defines the SPIFFE configuration. | false |
+| serverstransport.spiffe.ids | Defines the allowed SPIFFE IDs (takes precedence over the SPIFFE TrustDomain). | |
+| serverstransport.spiffe.trustdomain | Defines the allowed SPIFFE trust domain. | |
+| spiffe.workloadapiaddr | Defines the workload API address. | |
+| tcpserverstransport.dialkeepalive | Defines the interval between keep-alive probes for an active network connection. If zero, keep-alive probes are sent with a default value (currently 15 seconds), if supported by the protocol and operating system. Network protocols or operating systems that do not support keep-alives ignore this field. If negative, keep-alive probes are disabled | 15 |
+| tcpserverstransport.dialtimeout | Defines the amount of time to wait until a connection to a backend server can be established. If zero, no timeout exists. | 30 |
+| tcpserverstransport.terminationdelay | Defines the delay to wait before fully terminating the connection, after one connected peer has closed its writing capability. | 0 |
+| tcpserverstransport.tls | Defines the TLS configuration. | false |
+| tcpserverstransport.tls.insecureskipverify | Disables SSL certificate verification. | false |
+| tcpserverstransport.tls.rootcas | Defines a list of CA secret used to validate self-signed certificate | |
+| tcpserverstransport.tls.spiffe | Defines the SPIFFE TLS configuration. | false |
+| tcpserverstransport.tls.spiffe.ids | Defines the allowed SPIFFE IDs (takes precedence over the SPIFFE TrustDomain). | |
+| tcpserverstransport.tls.spiffe.trustdomain | Defines the allowed SPIFFE trust domain. | |
+| tracing | Tracing configuration. | false |
+| tracing.addinternals | Enables tracing for internal services (ping, dashboard, etc...). | false |
+| | Request headers to add as attributes for server and client spans. | |
+| | Response headers to add as attributes for server and client spans. | |
+| tracing.globalattributes._name_ | (Deprecated) Defines additional resource attributes (key:value). | |
+| tracing.otlp | Settings for OpenTelemetry. | false |
+| tracing.otlp.grpc | gRPC configuration for the OpenTelemetry collector. | false |
+| tracing.otlp.grpc.endpoint | Sets the gRPC endpoint (host:port) of the collector. | localhost:4317 |
+| | Headers sent with payload. | |
+| tracing.otlp.grpc.insecure | Disables client transport security for the exporter. | false |
+| tracing.otlp.grpc.tls.ca | TLS CA | |
+| tracing.otlp.grpc.tls.cert | TLS cert | |
+| tracing.otlp.grpc.tls.insecureskipverify | TLS insecure skip verify | false |
+| tracing.otlp.grpc.tls.key | TLS key | |
+| tracing.otlp.http | HTTP configuration for the OpenTelemetry collector. | false |
+| tracing.otlp.http.endpoint | Sets the HTTP endpoint (scheme://host:port/path) of the collector. | https://localhost:4318 |
+| | Headers sent with payload. | |
+| tracing.otlp.http.tls.ca | TLS CA | |
+| tracing.otlp.http.tls.cert | TLS cert | |
+| tracing.otlp.http.tls.insecureskipverify | TLS insecure skip verify | false |
+| tracing.otlp.http.tls.key | TLS key | |
+| tracing.resourceattributes._name_ | Defines additional resource attributes (key:value). | |
+| tracing.safequeryparams | Query params to not redact. | |
+| tracing.samplerate | Sets the rate between 0.0 and 1.0 of requests to trace. | 1.000000 |
+| tracing.servicename | Defines the service name resource attribute. | traefik |
diff --git a/docs/content/reference/install-configuration/entrypoints.md b/docs/content/reference/install-configuration/entrypoints.md
index 5b313f58b..9a41e3bc3 100644
--- a/docs/content/reference/install-configuration/entrypoints.md
+++ b/docs/content/reference/install-configuration/entrypoints.md
@@ -18,11 +18,38 @@ entryPoints:
to: websecure
scheme: https
permanent: true
+ observability:
+ accessLogs: false
+ metrics: false
+ tracing: false
websecure:
address: :443
- tls: {}
- middlewares:
+ http:
+ tls: {}
+ middlewares:
+ - auth@kubernetescrd
+ - strip@kubernetescrd
+```
+
+```toml tab="File (TOML)"
+[entryPoints]
+ [entryPoints.web]
+ address = ":80"
+ [entryPoints.web.http]
+ [entryPoints.web.http.redirections]
+ entryPoint = "websecure"
+ scheme = "https"
+ permanent = true
+ [entryPoints.web.observability]
+ accessLogs = false
+ metrics = false
+ tracing = false
+
+ [entryPoints.websecure]
+ address = ":443"
+ [entryPoints.websecure.tls]
+ [entryPoints.websecure.middlewares]
- auth@kubernetescrd
- strip@kubernetescrd
```
@@ -43,6 +70,9 @@ additionalArguments:
- --entryPoints.web.http.redirections.to=websecure
- --entryPoints.web.http.redirections.scheme=https
- --entryPoints.web.http.redirections.permanent=true
+ - --entryPoints.web.observability.accessLogs=false
+ - --entryPoints.web.observability.metrics=false
+ - --entryPoints.web.observability.tracing=false
```
!!! tip
@@ -54,39 +84,40 @@ additionalArguments:
## Configuration Options
-| Field | Description | Default | Required |
-|:----------------------------------------------------------------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
-| `address` | Define the port, and optionally the hostname, on which to listen for incoming connections and packets.
It also defines the protocol to use (TCP or UDP).
If no protocol is specified, the default is TCP. The format is:`[host]:port[/tcp\|/udp]`. | - | Yes |
-| `accessLogs` | Defines whether a router attached to this EntryPoint produces access-logs by default. Nonetheless, a router defining its own observability configuration will opt-out from this default. | true | No |
-| `asDefault` | Mark the `entryPoint` to be in the list of default `entryPoints`.
`entryPoints`in this list are used (by default) on HTTP and TCP routers that do not define their own `entryPoints` option.
More information [here](#asdefault). | false | No |
-| `forwardedHeaders.trustedIPs` | Set the IPs or CIDR from where Traefik trusts the forwarded headers information (`X-Forwarded-*`). | - | No |
-| `forwardedHeaders.insecure` | Set the insecure mode to always trust the forwarded headers information (`X-Forwarded-*`).
We recommend to use this option only for tests purposes, not in production. | false | No |
-| `http.redirections.`
`entryPoint.to` | The target element to enable (permanent) redirecting of all incoming requests on an entry point to another one.
The target element can be an entry point name (ex: `websecure`), or a port (`:443`). | - | Yes |
-| `http.redirections.`
`entryPoint.scheme` | The target scheme to use for (permanent) redirection of all incoming requests. | https | No |
-| `http.redirections.`
`entryPoint.permanent` | Enable permanent redirecting of all incoming requests on an entry point to another one changing the scheme.
The target element, it can be an entry point name (ex: `websecure`), or a port (`:443`). | false | No |
-| `http.redirections.`
`entryPoint.priority` | Default priority applied to the routers attached to the `entryPoint`. | MaxInt32-1 (2147483646) | No |
-| `http.encodeQuerySemicolons` | Enable query semicolons encoding.
Use this option to avoid non-encoded semicolons to be interpreted as query parameter separators by Traefik.
When using this option, the non-encoded semicolons characters in query will be transmitted encoded to the backend.
More information [here](#encodequerysemicolons). | false | No |
-| `http.sanitizePath` | Defines whether to enable the request path sanitization.
More information [here](#sanitizepath). | false | No |
-| `http.middlewares` | Set the list of middlewares that are prepended by default to the list of middlewares of each router associated to the named entry point.
More information [here](#httpmiddlewares). | - | No |
-| `http.tls` | Enable TLS on every router attached to the `entryPoint`.
If no certificate are set, a default self-signed certificate is generates by Traefik.
We recommend to not use self signed certificates in production. | - | No |
-| `http.tls.options` | Apply TLS options on every router attached to the `entryPoint`.
The TLS options can be overidden per router.
More information in the [dedicated section](../../routing/providers/kubernetes-crd.md#kind-tlsoption). | - | No |
-| `http.tls.certResolver` | Apply a certificate resolver on every router attached to the `entryPoint`.
The TLS options can be overidden per router.
More information in the [dedicated section](../install-configuration/tls/certificate-resolvers/overview.md). | - | No |
-| `http2.maxConcurrentStreams` | Set the number of concurrent streams per connection that each client is allowed to initiate.
The value must be greater than zero. | 250 | No |
-| `http3` | Enable HTTP/3 protocol on the `entryPoint`.
HTTP/3 requires a TCP `entryPoint`. as HTTP/3 always starts as a TCP connection that then gets upgraded to UDP. In most scenarios, this `entryPoint` is the same as the one used for TLS traffic.
More information [here](#http3. | - | No |
-| `http3.advertisedPort` | Set the UDP port to advertise as the HTTP/3 authority.
It defaults to the entryPoint's address port.
It can be used to override the authority in the `alt-svc` header, for example if the public facing port is different from where Traefik is listening. | - | No |
-| `metrics` | Defines whether a router attached to this EntryPoint produces metrics by default. Nonetheless, a router defining its own observability configuration will opt-out from this default. | true | No |
-| `proxyProtocol.trustedIPs` | Enable PROXY protocol with Trusted IPs.
Traefik supports [PROXY protocol](https://www.haproxy.org/download/2.0/doc/proxy-protocol.txt) version 1 and 2.
If PROXY protocol header parsing is enabled for the entry point, this entry point can accept connections with or without PROXY protocol headers.
If the PROXY protocol header is passed, then the version is determined automatically.
More information [here](#proxyprotocol-and-load-balancers). | - | No |
-| `proxyProtocol.insecure` | Enable PROXY protocol trusting every incoming connection.
Every remote client address will be replaced (`trustedIPs`) won't have any effect).
Traefik supports [PROXY protocol](https://www.haproxy.org/download/2.0/doc/proxy-protocol.txt) version 1 and 2.
If PROXY protocol header parsing is enabled for the entry point, this entry point can accept connections with or without PROXY protocol headers.
If the PROXY protocol header is passed, then the version is determined automatically.
We recommend to use this option only for tests purposes, not in production.
More information [here](#proxyprotocol-and-load-balancers). | - | No |
-| `reusePort` | Enable `entryPoints` from the same or different processes listening on the same TCP/UDP port by utilizing the `SO_REUSEPORT` socket option.
It also allows the kernel to act like a load balancer to distribute incoming connections between entry points..
More information [here](#reuseport). | false | No |
-| `tracing` | Defines whether a router attached to this EntryPoint produces traces by default. Nonetheless, a router defining its own observability configuration will opt-out from this default. | true | No |
-| `transport.`
`respondingTimeouts.`
`readTimeout` | Set the timeouts for incoming requests to the Traefik instance. This is the maximum duration for reading the entire request, including the body. Setting them has no effect for UDP `entryPoints`.
If zero, no timeout exists.
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds. | 60s (seconds) | No |
-| `transport.`
`respondingTimeouts.`
`writeTimeout` | Maximum duration before timing out writes of the response.
It covers the time from the end of the request header read to the end of the response write.
If zero, no timeout exists.
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds. | 0s (seconds) | No |
-| `transport.`
`respondingTimeouts.`
`idleTimeout` | Maximum duration an idle (keep-alive) connection will remain idle before closing itself.
If zero, no timeout exists
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds | 180s (seconds) | No |
-| `transport.`
`lifeCycle.`
`graceTimeOut` | Set the duration to give active requests a chance to finish before Traefik stops.
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds
In this time frame no new requests are accepted. | 10s (seconds) | No |
-| `transport.`
`lifeCycle.`
`requestAcceptGraceTimeout` | Set the duration to keep accepting requests prior to initiating the graceful termination period (as defined by the `transportlifeCycle.graceTimeOut` option).
This option is meant to give downstream load-balancers sufficient time to take Traefik out of rotation.
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds | 0s (seconds) | No |
-| `transport.`
`keepAliveMaxRequests` | Set the maximum number of requests Traefik can handle before sending a `Connection: Close` header to the client (for HTTP2, Traefik sends a GOAWAY).
Zero means no limit. | 0 | No |
-| `transport.`
`keepAliveMaxTime` | Set the maximum duration Traefik can handle requests before sending a `Connection: Close` header to the client (for HTTP2, Traefik sends a GOAWAY). Zero means no limit. | 0s (seconds) | No |
-| `udp.timeout` | Define how long to wait on an idle session before releasing the related resources.
The Timeout value must be greater than zero. | 3s (seconds)| No |
+| Field | Description | Default | Required |
+|:----------------------------------------------------------------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------|:---------|
+| `address` | Define the port, and optionally the hostname, on which to listen for incoming connections and packets.
It also defines the protocol to use (TCP or UDP).
If no protocol is specified, the default is TCP. The format is:`[host]:port[/tcp\|/udp] | - | Yes |
+| `asDefault` | Mark the `entryPoint` to be in the list of default `entryPoints`.
`entryPoints`in this list are used (by default) on HTTP and TCP routers that do not define their own `entryPoints` option.
More information [here](#asdefault). | false | No |
+| | Set the IPs or CIDR from where Traefik trusts the forwarded headers information (`X-Forwarded-*`). | - | No |
+| | Set the insecure mode to always trust the forwarded headers information (`X-Forwarded-*`).
We recommend to use this option only for tests purposes, not in production. | false | No |
+| `http.redirections.`
`entryPoint.to` | The target element to enable (permanent) redirecting of all incoming requests on an entry point to another one.
The target element can be an entry point name (ex: `websecure`), or a port (`:443`). | - | Yes |
+| `http.redirections.`
`entryPoint.scheme` | The target scheme to use for (permanent) redirection of all incoming requests. | https | No |
+| `http.redirections.`
`entryPoint.permanent` | Enable permanent redirecting of all incoming requests on an entry point to another one changing the scheme.
The target element, it can be an entry point name (ex: `websecure`), or a port (`:443`). | false | No |
+| `http.redirections.`
`entryPoint.priority` | Default priority applied to the routers attached to the `entryPoint`. | MaxInt32-1 (2147483646) | No |
+| `http.encodeQuerySemicolons` | Enable query semicolons encoding.
Use this option to avoid non-encoded semicolons to be interpreted as query parameter separators by Traefik.
When using this option, the non-encoded semicolons characters in query will be transmitted encoded to the backend.
More information [here](#encodequerysemicolons). | false | No |
+| `http.sanitizePath` | Defines whether to enable the request path sanitization.
More information [here](#sanitizepath). | false | No |
+| `http.middlewares` | Set the list of middlewares that are prepended by default to the list of middlewares of each router associated to the named entry point.
More information [here](#httpmiddlewares). | - | No |
+| `http.tls` | Enable TLS on every router attached to the `entryPoint`.
If no certificate are set, a default self-signed certificate is generated by Traefik.
We recommend to not use self signed certificates in production. | - | No |
+| `http.tls.options` | Apply TLS options on every router attached to the `entryPoint`.
The TLS options can be overidden per router.
More information in the [dedicated section](../../routing/providers/kubernetes-crd.md#kind-tlsoption). | - | No |
+| `http.tls.certResolver` | Apply a certificate resolver on every router attached to the `entryPoint`.
The TLS options can be overidden per router.
More information in the [dedicated section](../install-configuration/tls/certificate-resolvers/overview.md). | - | No |
+| `http2.maxConcurrentStreams` | Set the number of concurrent streams per connection that each client is allowed to initiate.
The value must be greater than zero. | 250 | No |
+| `http3` | Enable HTTP/3 protocol on the `entryPoint`.
HTTP/3 requires a TCP `entryPoint`. as HTTP/3 always starts as a TCP connection that then gets upgraded to UDP. In most scenarios, this `entryPoint` is the same as the one used for TLS traffic.
More information [here](#http3). | - | No |
+| `http3.advertisedPort` | Set the UDP port to advertise as the HTTP/3 authority.
It defaults to the entryPoint's address port.
It can be used to override the authority in the `alt-svc` header, for example if the public facing port is different from where Traefik is listening. | - | No |
+| `observability.accessLogs` | Defines whether a router attached to this EntryPoint produces access-logs by default. Nonetheless, a router defining its own observability configuration will opt-out from this default. | true | No |
+| `observability.metrics` | Defines whether a router attached to this EntryPoint produces metrics by default. Nonetheless, a router defining its own observability configuration will opt-out from this default. | true | No |
+| `observability.tracing` | Defines whether a router attached to this EntryPoint produces traces by default. Nonetheless, a router defining its own observability configuration will opt-out from this default. | true | No |
+| `observability.traceVerbosity` | Defines the tracing verbosity level for routers attached to this EntryPoint. Possible values: `minimal` (default), `detailed`. Routers can override this value in their own observability configuration.
More information [here](#traceverbosity). | minimal | No |
+| `proxyProtocol.trustedIPs` | Enable PROXY protocol with Trusted IPs.
Traefik supports [PROXY protocol](https://www.haproxy.org/download/2.0/doc/proxy-protocol.txt) version 1 and 2.
If PROXY protocol header parsing is enabled for the entry point, this entry point can accept connections with or without PROXY protocol headers.
If the PROXY protocol header is passed, then the version is determined automatically.
More information [here](#proxyprotocol-and-load-balancers). | - | No |
+| `proxyProtocol.insecure` | Enable PROXY protocol trusting every incoming connection.
Every remote client address will be replaced (`trustedIPs`) won't have any effect).
Traefik supports [PROXY protocol](https://www.haproxy.org/download/2.0/doc/proxy-protocol.txt) version 1 and 2.
If PROXY protocol header parsing is enabled for the entry point, this entry point can accept connections with or without PROXY protocol headers.
If the PROXY protocol header is passed, then the version is determined automatically.
We recommend to use this option only for tests purposes, not in production.
More information [here](#proxyprotocol-and-load-balancers). | - | No |
+| `reusePort` | Enable `entryPoints` from the same or different processes listening on the same TCP/UDP port by utilizing the `SO_REUSEPORT` socket option.
It also allows the kernel to act like a load balancer to distribute incoming connections between entry points.
More information [here](#reuseport). | false | No |
+| `transport.`
`respondingTimeouts.`
`readTimeout` | Set the timeouts for incoming requests to the Traefik instance. This is the maximum duration for reading the entire request, including the body. Setting them has no effect for UDP `entryPoints`.
If zero, no timeout exists.
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds. | 60s (seconds) | No |
+| `transport.`
`respondingTimeouts.`
`writeTimeout` | Maximum duration before timing out writes of the response.
It covers the time from the end of the request header read to the end of the response write.
If zero, no timeout exists.
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds. | 0s (seconds) | No |
+| `transport.`
`respondingTimeouts.`
`idleTimeout` | Maximum duration an idle (keep-alive) connection will remain idle before closing itself.
If zero, no timeout exists
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds | 180s (seconds) | No |
+| `transport.`
`lifeCycle.`
`graceTimeOut` | Set the duration to give active requests a chance to finish before Traefik stops.
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds
In this time frame no new requests are accepted. | 10s (seconds) | No |
+| `transport.`
`lifeCycle.`
`requestAcceptGraceTimeout` | Set the duration to keep accepting requests prior to initiating the graceful termination period (as defined by the `transportlifeCycle.graceTimeOut` option).
This option is meant to give downstream load-balancers sufficient time to take Traefik out of rotation.
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds | 0s (seconds) | No |
+| `transport.`
`keepAliveMaxRequests` | Set the maximum number of requests Traefik can handle before sending a `Connection: Close` header to the client (for HTTP2, Traefik sends a GOAWAY).
Zero means no limit. | 0 | No |
+| `transport.`
`keepAliveMaxTime` | Set the maximum duration Traefik can handle requests before sending a `Connection: Close` header to the client (for HTTP2, Traefik sends a GOAWAY). Zero means no limit. | 0s (seconds) | No |
+| `udp.timeout` | Define how long to wait on an idle session before releasing the related resources.
The Timeout value must be greater than zero. | 3s (seconds) | No |
### asDefault
@@ -121,18 +152,20 @@ are applied after the ones declared on the Entrypoint)
entryPoints:
web:
address: :80
- middlewares:
- - auth@kubernetescrd
- - strip@file
+ http:
+ middlewares:
+ - auth@kubernetescrd
+ - strip@file
```
```yaml tab="Helm Chart Values"
ports:
web:
port: :80
- middlewares:
- - auth@kubernetescrd
- - strip@file
+ http:
+ middlewares:
+ - auth@kubernetescrd
+ - strip@file
```
### encodeQuerySemicolons
@@ -141,10 +174,10 @@ Behavior examples:
| EncodeQuerySemicolons | Request Query | Resulting Request Query |
|-----------------------|---------------------|-------------------------|
-| false | foo=bar;baz=bar | foo=bar&baz=bar |
-| true | foo=bar;baz=bar | foo=bar%3Bbaz=bar |
-| false | foo=bar&baz=bar;foo | foo=bar&baz=bar&foo |
-| true | foo=bar&baz=bar;foo | foo=bar&baz=bar%3Bfoo |
+| false | foo=bar;baz=bar | foo=bar&baz=bar |
+| true | foo=bar;baz=bar | foo=bar%3Bbaz=bar |
+| false | foo=bar&baz=bar;foo | foo=bar&baz=bar&foo |
+| true | foo=bar&baz=bar;foo | foo=bar&baz=bar%3Bfoo |
### SanitizePath
@@ -164,14 +197,14 @@ it can lead to unsafe routing when the `sanitizePath` option is set to `false`.
| SanitizePath | Request Path | Resulting Request Path |
|--------------|-----------------|------------------------|
-| false | /./foo/bar | /./foo/bar |
-| true | /./foo/bar | /foo/bar |
-| false | /foo/../bar | /foo/../bar |
-| true | /foo/../bar | /bar |
-| false | /foo/bar// | /foo/bar// |
-| true | /foo/bar// | /foo/bar/ |
-| false | /./foo/../bar// | /./foo/../bar// |
-| true | /./foo/../bar// | /bar/ |
+| false | /./foo/bar | /./foo/bar |
+| true | /./foo/bar | /foo/bar |
+| false | /foo/../bar | /foo/../bar |
+| true | /foo/../bar | /bar |
+| false | /foo/bar// | /foo/bar// |
+| true | /foo/bar// | /foo/bar/ |
+| false | /./foo/../bar// | /./foo/../bar// |
+| true | /./foo/../bar// | /bar/ |
### HTTP3
@@ -184,7 +217,7 @@ only routers with TLS enabled will be usable with HTTP/3.
### ProxyProtocol and Load-Balancers
-The replacement of the remote client address will occur only for IP addresses listed in `trustedIPs`. This is where yoåu specify your load balancer IPs or CIDR ranges.
+The replacement of the remote client address will occur only for IP addresses listed in `trustedIPs`. This is where you specify your load balancer IPs or CIDR ranges.
When queuing Traefik behind another load-balancer, make sure to configure
PROXY protocol on both sides.
@@ -242,3 +275,13 @@ Use the `reusePort` option with the other option `transport.lifeCycle.gracetimeo
to do
canary deployments against Traefik itself. Like upgrading Traefik version
or reloading the static configuration without any service downtime.
+
+#### Trace Verbosity
+
+`observability.traceVerbosity` defines the tracing verbosity level for routers attached to this EntryPoint.
+Routers can override this value in their own observability configuration.
+
+Possible values are:
+
+- `minimal`: produces a single server span and one client span for each request processed by a router.
+- `detailed`: enables the creation of additional spans for each middleware executed for each request processed by a router.
diff --git a/docs/content/reference/install-configuration/observability/healthcheck.md b/docs/content/reference/install-configuration/observability/healthcheck.md
index 742480286..d207095c1 100644
--- a/docs/content/reference/install-configuration/observability/healthcheck.md
+++ b/docs/content/reference/install-configuration/observability/healthcheck.md
@@ -36,7 +36,7 @@ whose default value is `traefik` (port `8080`).
| Path | Method | Description |
|---------|---------------|-----------------------------------------------------------------------------------------------------|
-| `/ping` | `GET`, `HEAD` | An endpoint to check for Traefik process liveness. Return a code `200` with the content: `OK` |
+| `/ping` | `GET`, `HEAD` | An endpoint to check for Traefik process liveness. Return a code `200` with the content: `OK` |
### Configuration Example
@@ -58,9 +58,9 @@ ping: {}
| Field | Description | Default | Required |
|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `ping.entryPoint` | Enables `/ping` on a dedicated EntryPoint. | traefik | No |
-| `ping.manualRouting` | Disables the default internal router in order to allow one to create a custom router for the `ping@internal` service when set to `true`. | false | No |
-| `ping.terminatingStatusCode` | Defines the status code for the ping handler during a graceful shut down. See more information [here](#terminatingstatuscode) | 503 | No |
+| `ping.entryPoint` | Enables `/ping` on a dedicated EntryPoint. | traefik | No |
+| `ping.manualRouting` | Disables the default internal router in order to allow one to create a custom router for the `ping@internal` service when set to `true`. | false | No |
+| `ping.terminatingStatusCode` | Defines the status code for the ping handler during a graceful shut down. See more information [here](#terminatingstatuscode) | 503 | No |
#### `terminatingStatusCode`
diff --git a/docs/content/reference/install-configuration/observability/healthcheck/cli.md b/docs/content/reference/install-configuration/observability/healthcheck/cli.md
new file mode 100644
index 000000000..a68f80d83
--- /dev/null
+++ b/docs/content/reference/install-configuration/observability/healthcheck/cli.md
@@ -0,0 +1,28 @@
+---
+title: "Traefik Health Check CLI Command Documentation"
+description: "In Traefik Proxy, the healthcheck CLI command lets you check the health of your Traefik instances. Read the technical documentation for configuration examples and options."
+---
+
+# Healthcheck Command
+
+Checking the Health of your Traefik Instances.
+{: .subtitle }
+
+## Usage
+
+The healthcheck command allows you to make a request to the `/ping` endpoint (defined in the install (static) configuration) to check the health of Traefik. Its exit status is `0` if Traefik is healthy and `1` otherwise.
+
+This can be used with [HEALTHCHECK](https://docs.docker.com/engine/reference/builder/#healthcheck) instruction or any other health check orchestration mechanism.
+
+```sh
+traefik healthcheck [command] [flags] [arguments]
+```
+
+Example:
+
+```sh
+$ traefik healthcheck
+OK: http://:8082/ping
+```
+
+The command uses the [ping](./ping.md) endpoint that is defined in the Traefik install (static) configuration.
diff --git a/docs/content/reference/install-configuration/observability/healthcheck/ping.md b/docs/content/reference/install-configuration/observability/healthcheck/ping.md
new file mode 100644
index 000000000..7b8372129
--- /dev/null
+++ b/docs/content/reference/install-configuration/observability/healthcheck/ping.md
@@ -0,0 +1,66 @@
+---
+title: "Traefik Ping Option Documentation"
+description: "In Traefik Proxy, the option Ping lets you check the health of your Traefik instances. Read the technical documentation for configuration examples and options."
+---
+
+# Ping
+
+Checking the Health of your Traefik Instances
+{: .subtitle }
+
+The `ping` options allows you to enable the ping endpoint to check Traefik liveness.
+
+The ping endpoint is reachable using the path `/ping` and the methods `GET`and `HEAD`.
+
+If the Traefik instance is alive, it returns the `200` HTTP code with the content: `OK`.
+
+## Configuration Example
+
+To enable the API handler:
+
+```yaml tab="File (YAML)"
+ping: {}
+```
+
+```toml tab="File (TOML)"
+[ping]
+```
+
+```bash tab="CLI"
+--ping=true
+```
+
+## Configuration Options
+
+The `ping` option is defined in the install (static) configuration.
+You can define it using the same [configuration methods](../../boot-environment.md#configuration-methods) as Traefik.
+
+| Field | Description | Default | Required |
+|:------|:----------------------------------------------------------|:---------------------|:---------|
+| `ping.entryPoint` | Enables `/ping` on a dedicated EntryPoint. | traefik | No |
+| `ping.manualRouting` | Disables the default internal router in order to allow one to create a custom router for the `ping@internal` service when set to `true`. | false | No |
+| `ping.terminatingStatusCode` | Defines the status code for the ping handler during a graceful shut down. See more information [here](#terminatingstatuscode) | 503 | No |
+
+### `terminatingStatusCode`
+
+During the period in which Traefik is gracefully shutting down, the ping handler
+returns a `503` status code by default.
+If Traefik is behind, for example a load-balancer
+doing health checks (such as the Kubernetes LivenessProbe), another code might
+be expected as the signal for graceful termination.
+In that case, the terminatingStatusCode can be used to set the code returned by the ping
+handler during termination.
+
+```yaml tab="File (YAML)"
+ping:
+ terminatingStatusCode: 204
+```
+
+```toml tab="File (TOML)"
+[ping]
+ terminatingStatusCode = 204
+```
+
+```bash tab="CLI"
+--ping.terminatingStatusCode=204
+```
diff --git a/docs/content/reference/install-configuration/observability/logs-and-accesslogs.md b/docs/content/reference/install-configuration/observability/logs-and-accesslogs.md
index d13226ad4..7fab52d14 100644
--- a/docs/content/reference/install-configuration/observability/logs-and-accesslogs.md
+++ b/docs/content/reference/install-configuration/observability/logs-and-accesslogs.md
@@ -35,17 +35,112 @@ The section below describe how to configure Traefik logs using the static config
| Field | Description | Default | Required |
|:-----------|:----------------------------|:--------|:---------|
-| `log.filePath` | By default, the logs are written to the standard output.
You can configure a file path instead using the `filePath` option.| - | No |
-| `log.format` | Log format (`common`or `json`).
The fields displayed with the format `common` cannot be customized. | "common" | No |
-| `log.level` | Log level (`TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`, `FATAL`, and `PANIC`)| ERROR | No |
-| `log.noColor` | When using the format `common`, disables the colorized output. | false | No |
-| `log.maxSize` | Maximum size in megabytes of the log file before it gets rotated. | 100MB | No |
-| `log.maxAge` | Maximum number of days to retain old log files based on the timestamp encoded in their filename.
A day is defined as 24 hours and may not exactly correspond to calendar days due to daylight savings, leap seconds, etc.
By default files are not removed based on their age. | 0 | No |
-| `log.maxBackups` | Maximum number of old log files to retain.
The default is to retain all old log files. | 0 | No |
-| `log.compress` | Compress log files in gzip after rotation. | false | No |
+| `log.filePath` | By default, the logs are written to the standard output.
You can configure a file path instead using the `filePath` option. When `filePath` is specified, Traefik will write logs only to that file (not to standard output).| - | No |
+| `log.format` | Log format (`common`or `json`).
The fields displayed with the format `common` cannot be customized. | "common" | No |
+| `log.level` | Log level (`TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`, `FATAL`, and `PANIC`)| ERROR | No |
+| `log.noColor` | When using the format `common`, disables the colorized output. | false | No |
+| `log.maxSize` | Maximum size in megabytes of the log file before it gets rotated. | 100MB | No |
+| `log.maxAge` | Maximum number of days to retain old log files based on the timestamp encoded in their filename.
A day is defined as 24 hours and may not exactly correspond to calendar days due to daylight savings, leap seconds, etc.
By default files are not removed based on their age. | 0 | No |
+| `log.maxBackups` | Maximum number of old log files to retain.
The default is to retain all old log files. | 0 | No |
+| `log.compress` | Compress log files in gzip after rotation. | false | No |
+
+### OpenTelemetry
+
+Traefik supports OpenTelemetry for logging. To enable OpenTelemetry, you need to set the following in the static configuration:
+
+```yaml tab="File (YAML)"
+experimental:
+ otlpLogs: true
+```
+
+```toml tab="File (TOML)"
+[experimental]
+ otlpLogs = true
+```
+
+```sh tab="CLI"
+--experimental.otlpLogs=true
+```
+
+!!! warning
+ This is an experimental feature.
+
+!!! note "Stdio logs remain available"
+ When OTLP logging is enabled, standard output (stdio) logs are still available and will continue to be written alongside OTLP exports.
+
+#### Configuration Example
+
+```yaml tab="File (YAML)"
+experimental:
+ otlpLogs: true
+
+log:
+ otlp:
+ http:
+ endpoint: https://collector:4318/v1/logs
+ headers:
+ Authorization: Bearer auth_asKXRhIMplM7El1JENjrotGouS1LYRdL
+```
+
+```toml tab="File (TOML)"
+[experimental]
+ otlpLogs = true
+
+[log.otlp]
+ http.endpoint = "https://collector:4318/v1/logs"
+ http.headers.Authorization = "Bearer auth_asKXRhIMplM7El1JENjrotGouS1LYRdL"
+```
+
+```sh tab="CLI"
+--experimental.otlpLogs=true
+--log.otlp.http.endpoint=https://collector:4318/v1/logs
+--log.otlp.http.headers.Authorization=Bearer auth_asKXRhIMplM7El1JENjrotGouS1LYRdL
+```
+
+#### Configuration Options
+
+| Field | Description | Default | Required |
+|:---------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------|:---------|
+| `log.otlp.serviceName` | Service name used in selected backend. | "traefik" | No |
+| `log.otlp.resourceAttributes` | Defines additional resource attributes to be sent to the collector. See [resourceAttributes](#resourceattributes) for details. | [] | No |
+| `log.otlp.http` | This instructs the exporter to send logs to the OpenTelemetry Collector using HTTP. | | No |
+| `log.otlp.http.endpoint` | The endpoint of the OpenTelemetry Collector. (format=`://:`) | `https://localhost:4318/v1/logs` | No |
+| | Additional headers sent with logs by the exporter to the OpenTelemetry Collector. | [ ] | No |
+| `log.otlp.http.tls` | Defines the Client TLS configuration used by the exporter to send logs to the OpenTelemetry Collector. | | No |
+| `log.otlp.http.tls.ca` | The path to the certificate authority used for the secure connection to the OpenTelemetry Collector, it defaults to the system bundle. | | No |
+| `log.otlp.http.tls.cert` | The path to the certificate to use for the OpenTelemetry Collector. | | No |
+| `log.otlp.http.tls.key` | The path to the key to use for the OpenTelemetry Collector. | | No |
+| `log.otlp.http.tls.insecureSkipVerify` | Instructs the OpenTelemetry Collector to accept any certificate presented by the server regardless of the hostname in the certificate. | false | No |
+| `log.otlp.grpc` | This instructs the exporter to send logs to the OpenTelemetry Collector using gRPC. | | No |
+| `log.otlp.grpc.endpoint` | The endpoint of the OpenTelemetry Collector. (format=`:`) | `localhost:4317` | No |
+| | Additional headers sent with logs by the exporter to the OpenTelemetry Collector. | [ ] | No |
+| `log.otlp.grpc.insecure` | Instructs the exporter to send logs to the OpenTelemetry Collector using an insecure protocol. | false | No |
+| `log.otlp.grpc.tls` | Defines the Client TLS configuration used by the exporter to send logs to the OpenTelemetry Collector. | | No |
+| `log.otlp.grpc.tls.ca` | The path to the certificate authority used for the secure connection to the OpenTelemetry Collector, it defaults to the system bundle. | | No |
+| `log.otlp.grpc.tls.cert` | The path to the certificate to use for the OpenTelemetry Collector. | | No |
+| `log.otlp.grpc.tls.key` | The path to the key to use for the OpenTelemetry Collector. | | No |
+| `log.otlp.grpc.tls.insecureSkipVerify` | Instructs the OpenTelemetry Collector to accept any certificate presented by the server regardless of the hostname in the certificate. | false | No |
+
+#### resourceAttributes
+
+The `resourceAttributes` option allows setting the resource attributes sent along the traces.
+Traefik also supports the `OTEL_RESOURCE_ATTRIBUTES` env variable to set up the resource attributes.
+
+!!! info "Kubernetes Resource Attributes Detection"
+
+ Additionally, Traefik automatically discovers the following [Kubernetes resource attributes](https://opentelemetry.io/docs/specs/semconv/non-normative/k8s-attributes/) when running in a Kubernetes cluster:
+
+ - `k8s.namespace.name`
+ - `k8s.pod.uid`
+ - `k8s.pod.name`
+
+ Note that this automatic detection can fail, like if the Traefik pod is running in host network mode.
+ In this case, you should provide the attributes with the option or the env variable.
## AccessLogs
+Access logs concern everything that happens to the requests handled by Traefik.
+
### Configuration Example
```yaml tab="File (YAML)"
@@ -117,21 +212,112 @@ The section below describes how to configure Traefik access logs using the stati
| Field | Description | Default | Required |
|:-----------|:--------------------------|:--------|:---------|
-| `accesslog.filePath` | By default, the access logs are written to the standard output.
You can configure a file path instead using the `filePath` option.| | No |
-| `accesslog.format` | By default, logs are written using the Common Log Format (CLF).
To write logs in JSON, use `json` in the `format` option.
If the given format is unsupported, the default (CLF) is used instead.
More information about CLF fields [here](#clf-format-fields). | "common" | No |
-| `accesslog.bufferingSize` | To write the logs in an asynchronous fashion, specify a `bufferingSize` option.
This option represents the number of log lines Traefik will keep in memory before writing them to the selected output.
In some cases, this option can greatly help performances.| 0 | No |
-| `accesslog.addInternals` | Enables access logs for internal resources (e.g.: `ping@internal`). | false | No |
-| `accesslog.filters.statusCodes` | Limit the access logs to requests with a status codes in the specified range. | false | No |
-| `accesslog.filters.retryAttempts` | Keep the access logs when at least one retry has happened. | false | No |
-| `accesslog.filters.minDuration` | Keep access logs when requests take longer than the specified duration (provided in seconds or as a valid duration format, see [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration)). | 0 | No |
-| `accesslog.fields.defaultMode` | Mode to apply by default to the access logs fields (`keep`, `redact` or `drop`). | keep | No |
-| `accesslog.fields.names` | Set the fields list to display in the access logs (format `name:mode`).
Available fields list [here](#available-fields). | - | No |
-| `accesslog.headers.defaultMode` | Mode to apply by default to the access logs headers (`keep`, `redact` or `drop`). | drop | No |
-| `accesslog.headers.names` | Set the headers list to display in the access logs (format `name:mode`). | - | No |
+| `accesslog.filePath` | By default, the access logs are written to the standard output.
You can configure a file path instead using the `filePath` option.| | No |
+| `accesslog.format` | By default, logs are written using the Traefik Common Log Format (CLF).
Available formats: [`common`](#traefik-clf-format-fields) (Traefik extended CLF), [`genericCLF`](#generic-clf-format-fields) (standard CLF compatible with analyzers), or [`json`](#json-format-fields).
If the given format is unsupported, the default (`common`) is used instead. | "common" | No |
+| `accesslog.bufferingSize` | To write the logs in an asynchronous fashion, specify a `bufferingSize` option.
This option represents the number of log lines Traefik will keep in memory before writing them to the selected output.
In some cases, this option can greatly help performances.| 0 | No |
+| `accesslog.addInternals` | Enables access logs for internal resources (e.g.: `ping@internal`). | false | No |
+| `accesslog.filters.statusCodes` | Limit the access logs to requests with a status codes in the specified range. | [ ] | No |
+| `accesslog.filters.retryAttempts` | Keep the access logs when at least one retry has happened. | false | No |
+| `accesslog.filters.minDuration` | Keep access logs when requests take longer than the specified duration (provided in seconds or as a valid duration format, see [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration)). | 0 | No |
+| `accesslog.fields.defaultMode` | Mode to apply by default to the access logs fields (`keep`, `redact` or `drop`). | keep | No |
+| `accesslog.fields.names` | Set the fields list to display in the access logs (format `name:mode`).
Available fields list [here](#json-format-fields). | [ ] | No |
+| | Mode to apply by default to the access logs headers (`keep`, `redact` or `drop`). | drop | No |
+| | Set the headers list to display in the access logs (format `name:mode`). | [ ] | No |
-#### CLF format fields
+### OpenTelemetry
-Below the fields displayed with the CLF format:
+Traefik supports OpenTelemetry for access logs. To enable OpenTelemetry, you need to set the following in the static configuration:
+
+```yaml tab="File (YAML)"
+experimental:
+ otlpLogs: true
+```
+
+```toml tab="File (TOML)"
+[experimental]
+ otlpLogs = true
+```
+
+```sh tab="CLI"
+--experimental.otlpLogs=true
+```
+
+!!! warning
+ This is an experimental feature.
+
+#### Configuration Example
+
+```yaml tab="File (YAML)"
+experimental:
+ otlpLogs: true
+
+accesslog:
+ otlp:
+ http:
+ endpoint: https://collector:4318/v1/logs
+ headers:
+ Authorization: Bearer auth_asKXRhIMplM7El1JENjrotGouS1LYRdL
+```
+
+```toml tab="File (TOML)"
+[experimental]
+ otlpLogs = true
+
+[accesslog.otlp]
+ http.endpoint = "https://collector:4318/v1/logs"
+ http.headers.Authorization = "Bearer auth_asKXRhIMplM7El1JENjrotGouS1LYRdL"
+```
+
+```yaml tab="CLI"
+--experimental.otlpLogs=true
+--accesslog.otlp.http.endpoint=https://collector:4318/v1/logs
+--accesslog.otlp.http.headers.Authorization=Bearer auth_asKXRhIMplM7El1JENjrotGouS1LYRdL
+```
+
+#### Configuration Options
+
+| Field | Description | Default | Required |
+|:---------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------|:---------|
+| `accesslog.otlp.serviceName` | Defines the service name resource attribute. | "traefik" | No |
+| `accesslog.otlp.resourceAttributes` | Defines additional resource attributes to be sent to the collector. See [resourceAttributes](#resourceattributes_1) for details. | [] | No |
+| `accesslog.otlp.http` | This instructs the exporter to send access logs to the OpenTelemetry Collector using HTTP. | | No |
+| `accesslog.otlp.http.endpoint` | The endpoint of the OpenTelemetry Collector. (format=`://:`) | `https://localhost:4318/v1/logs` | No |
+| | Additional headers sent with access logs by the exporter to the OpenTelemetry Collector. | [ ] | No |
+| `accesslog.otlp.http.tls` | Defines the Client TLS configuration used by the exporter to send access logs to the OpenTelemetry Collector. | | No |
+| `accesslog.otlp.http.tls.ca` | The path to the certificate authority used for the secure connection to the OpenTelemetry Collector, it defaults to the system bundle. | | No |
+| `accesslog.otlp.http.tls.cert` | The path to the certificate to use for the OpenTelemetry Collector. | | No |
+| `accesslog.otlp.http.tls.key` | The path to the key to use for the OpenTelemetry Collector. | | No |
+| `accesslog.otlp.http.tls.insecureSkipVerify` | Instructs the OpenTelemetry Collector to accept any certificate presented by the server regardless of the hostname in the certificate. | false | No |
+| `accesslog.otlp.grpc` | This instructs the exporter to send access logs to the OpenTelemetry Collector using gRPC. | | No |
+| `accesslog.otlp.grpc.endpoint` | The endpoint of the OpenTelemetry Collector. (format=`:`) | `localhost:4317` | No |
+| | Additional headers sent with access logs by the exporter to the OpenTelemetry Collector. | [ ] | No |
+| `accesslog.otlp.grpc.insecure` | Instructs the exporter to send access logs to the OpenTelemetry Collector using an insecure protocol. | false | No |
+| `accesslog.otlp.grpc.tls` | Defines the Client TLS configuration used by the exporter to send access logs to the OpenTelemetry Collector. | | No |
+| `accesslog.otlp.grpc.tls.ca` | The path to the certificate authority used for the secure connection to the OpenTelemetry Collector, it defaults to the system bundle. | | No |
+| `accesslog.otlp.grpc.tls.cert` | The path to the certificate to use for the OpenTelemetry Collector. | | No |
+| `accesslog.otlp.grpc.tls.key` | The path to the key to use for the OpenTelemetry Collector. | | No |
+| `accesslog.otlp.grpc.tls.insecureSkipVerify` | Instructs the OpenTelemetry Collector to accept any certificate presented by the server regardless of the hostname in the certificate. | false | No |
+
+#### resourceAttributes
+
+The `resourceAttributes` option allows setting the resource attributes sent along the traces.
+Traefik also supports the `OTEL_RESOURCE_ATTRIBUTES` env variable to set up the resource attributes.
+
+!!! info "Kubernetes Resource Attributes Detection"
+
+ Additionally, Traefik automatically discovers the following [Kubernetes resource attributes](https://opentelemetry.io/docs/specs/semconv/non-normative/k8s-attributes/) when running in a Kubernetes cluster:
+
+ - `k8s.namespace.name`
+ - `k8s.pod.uid`
+ - `k8s.pod.name`
+
+ Note that this automatic detection can fail, like if the Traefik pod is running in host network mode.
+ In this case, you should provide the attributes with the option or the env variable.
+
+### Traefik CLF format fields
+
+It's the default format provided by Traefik.
+Below the fields displayed with the Traefik CLF format:
```html
- []
@@ -140,46 +326,56 @@ Below the fields displayed with the CLF format:
"" "" ms
```
-#### Available Fields
+### Generic CLF format fields
+
+Below the fields displayed with the generic CLF format:
+
+```html
+ - []
+" "
+"" ""
+```
+
+### JSON format fields
| Field | Description |
|-------------------------|------------------|
-| `StartUTC` | The time at which request processing started. |
-| `StartLocal` | The local time at which request processing started. |
-| `Duration` | The total time taken (in nanoseconds) by processing the response, including the origin server's time but not the log writing time. |
-| `RouterName` | The name of the Traefik router. |
-| `ServiceName` | The name of the Traefik backend. |
-| `ServiceURL` | The URL of the Traefik backend. |
-| `ServiceAddr` | The IP:port of the Traefik backend (extracted from `ServiceURL`). |
-| `ClientAddr` | The remote address in its original form (usually IP:port). |
-| `ClientHost` | The remote IP address from which the client request was received. |
-| `ClientPort` | The remote TCP port from which the client request was received. |
-| `ClientUsername` | The username provided in the URL, if present. |
-| `RequestAddr` | The HTTP Host header (usually IP:port). This is treated as not a header by the Go API. |
-| `RequestHost` | The HTTP Host server name (not including port). |
-| `RequestPort` | The TCP port from the HTTP Host. |
-| `RequestMethod` | The HTTP method. |
-| `RequestPath` | The HTTP request URI, not including the scheme, host or port. |
-| `RequestProtocol` | The version of HTTP requested. |
-| `RequestScheme` | The HTTP scheme requested `http` or `https`. |
-| `RequestLine` | The `RequestMethod`, + `RequestPath` and `RequestProtocol`. |
-| `RequestContentSize` | The number of bytes in the request entity (a.k.a. body) sent by the client. |
-| `OriginDuration` | The time taken (in nanoseconds) by the origin server ('upstream') to return its response. |
-| `OriginContentSize` | The content length specified by the origin server, or 0 if unspecified. |
-| `OriginStatus` | The HTTP status code returned by the origin server. If the request was handled by this Traefik instance (e.g. with a redirect), then this value will be absent (0). |
-| `OriginStatusLine` | `OriginStatus` + Status code explanation |
-| `DownstreamStatus` | The HTTP status code returned to the client. |
-| `DownstreamStatusLine` | The `DownstreamStatus` and status code explanation. |
-| `DownstreamContentSize` | The number of bytes in the response entity returned to the client. This is in addition to the "Content-Length" header, which may be present in the origin response. |
-| `RequestCount` | The number of requests received since the Traefik instance started. |
-| `GzipRatio` | The response body compression ratio achieved. |
-| `Overhead` | The processing time overhead (in nanoseconds) caused by Traefik. |
-| `RetryAttempts` | The amount of attempts the request was retried. |
-| `TLSVersion` | The TLS version used by the connection (e.g. `1.2`) (if connection is TLS). |
-| `TLSCipher` | The TLS cipher used by the connection (e.g. `TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA`) (if connection is TLS). |
-| `TLSClientSubject` | The string representation of the TLS client certificate's Subject (e.g. `CN=username,O=organization`). |
+| `StartUTC` | The time at which request processing started. |
+| `StartLocal` | The local time at which request processing started. |
+| `Duration` | The total time taken (in nanoseconds) by processing the response, including the origin server's time but not the log writing time. |
+| `RouterName` | The name of the Traefik router. |
+| `ServiceName` | The name of the Traefik backend. |
+| `ServiceURL` | The URL of the Traefik backend. |
+| `ServiceAddr` | The IP:port of the Traefik backend (extracted from `ServiceURL`). |
+| `ClientAddr` | The remote address in its original form (usually IP:port). |
+| `ClientHost` | The remote IP address from which the client request was received. |
+| `ClientPort` | The remote TCP port from which the client request was received. |
+| `ClientUsername` | The username provided in the URL, if present. |
+| `RequestAddr` | The HTTP Host header (usually IP:port). This is treated as not a header by the Go API. |
+| `RequestHost` | The HTTP Host server name (not including port). |
+| `RequestPort` | The TCP port from the HTTP Host. |
+| `RequestMethod` | The HTTP method. |
+| `RequestPath` | The HTTP request URI, not including the scheme, host or port. |
+| `RequestProtocol` | The version of HTTP requested. |
+| `RequestScheme` | The HTTP scheme requested `http` or `https`. |
+| `RequestLine` | The `RequestMethod`, + `RequestPath` and `RequestProtocol`. |
+| `RequestContentSize` | The number of bytes in the request entity (a.k.a. body) sent by the client. |
+| `OriginDuration` | The time taken (in nanoseconds) by the origin server ('upstream') to return its response. |
+| `OriginContentSize` | The content length specified by the origin server, or 0 if unspecified. |
+| `OriginStatus` | The HTTP status code returned by the origin server. If the request was handled by this Traefik instance (e.g. with a redirect), then this value will be absent (0). |
+| `OriginStatusLine` | `OriginStatus` + Status code explanation |
+| `DownstreamStatus` | The HTTP status code returned to the client. |
+| `DownstreamStatusLine` | The `DownstreamStatus` and status code explanation. |
+| `DownstreamContentSize` | The number of bytes in the response entity returned to the client. This is in addition to the "Content-Length" header, which may be present in the origin response. |
+| `RequestCount` | The number of requests received since the Traefik instance started. |
+| `GzipRatio` | The response body compression ratio achieved. |
+| `Overhead` | The processing time overhead (in nanoseconds) caused by Traefik. |
+| `RetryAttempts` | The amount of attempts the request was retried. |
+| `TLSVersion` | The TLS version used by the connection (e.g. `1.2`) (if connection is TLS). |
+| `TLSCipher` | The TLS cipher used by the connection (e.g. `TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA`) (if connection is TLS). |
+| `TLSClientSubject` | The string representation of the TLS client certificate's Subject (e.g. `CN=username,O=organization`). |
-#### Log Rotation
+### Log Rotation
Traefik close and reopen its log files, assuming they're configured, on receipt of a USR1 signal.
This allows the logs to be rotated and processed by an external program, such as `logrotate`.
@@ -187,7 +383,7 @@ This allows the logs to be rotated and processed by an external program, such as
!!! warning
This does not work on Windows due to the lack of USR signals.
-#### Time Zones
+### Time Zones
Traefik will timestamp each log line in UTC time by default.
@@ -199,11 +395,9 @@ It is possible to configure the Traefik to timestamp in a specific timezone by e
Example utilizing Docker Compose:
```yaml
-version: "3.7"
-
services:
traefik:
- image: traefik:v3.4
+ image: traefik:v3.5
environment:
- TZ=US/Alaska
command:
diff --git a/docs/content/reference/install-configuration/observability/metrics.md b/docs/content/reference/install-configuration/observability/metrics.md
index c2c6f4bd0..979fb230d 100644
--- a/docs/content/reference/install-configuration/observability/metrics.md
+++ b/docs/content/reference/install-configuration/observability/metrics.md
@@ -60,29 +60,47 @@ metrics:
### Configuration Options
-| Field | Description | Default | Required |
-|:-----------|---------------|:--------|:---------|
-| `metrics.addInternals` | Enables metrics for internal resources (e.g.: `ping@internal`). | false | No |
-| `metrics.otlp.addEntryPointsLabels` | Enable metrics on entry points. | true | No |
-| `metrics.otlp.addRoutersLabels` | Enable metrics on routers. | false | No |
-| `metrics.otlp.addServicesLabels` | Enable metrics on services.| true | No |
-| `metrics.otlp.explicitBoundaries` | Explicit boundaries for Histogram data points. | ".005, .01, .025, .05, .1, .25, .5, 1, 2.5, 5, 10" | No |
-| `metrics.otlp.pushInterval` | Interval at which metrics are sent to the OpenTelemetry Collector. | 10s | No |
-| `metrics.otlp.http` | This instructs the exporter to send the metrics to the OpenTelemetry Collector using HTTP.
Setting the sub-options with their default values. | null/false | No |
-| `metrics.otlp.http.endpoint` | URL of the OpenTelemetry Collector to send metrics to.
Format="`://:`" | "http://localhost:4318/v1/metrics" | Yes |
-| `metrics.otlp.http.headers` | Additional headers sent with metrics by the exporter to the OpenTelemetry Collector. | - | No |
-| `metrics.otlp.http.tls.ca` | Path to the certificate authority used for the secure connection to the OpenTelemetry Collector,
it defaults to the system bundle. | "" | No |
-| `metrics.otlp.http.tls.cert` | Path to the public certificate used for the secure connection to the OpenTelemetry Collector.
When using this option, setting the `key` option is required. | "" | No |
-| `metrics.otlp.http.tls.key` | This instructs the exporter to send the metrics to the OpenTelemetry Collector using HTTP.
Setting the sub-options with their default values. | null/false | No |
-| `metrics.otlp.http.tls.insecureskipverify` | Allow the TLS connection to the OpenTelemetry Collector accepts any certificate presented by the server regardless of the hostnames it covers. | false | Yes |
-| `metrics.otlp.grpc` | This instructs the exporter to send metrics to the OpenTelemetry Collector using gRPC. | null/false | No |
-| `metrics.otlp.grpc.endpoint` | Address of the OpenTelemetry Collector to send metrics to.
Format="`:`" | "localhost:4317" | Yes |
-| `metrics.otlp.grpc.headers` | Additional headers sent with metrics by the exporter to the OpenTelemetry Collector. | - | No |
-| `metrics.otlp.http.grpc.insecure` |Allows exporter to send metrics to the OpenTelemetry Collector without using a secured protocol. | false | Yes |
-| `metrics.otlp.grpc.tls.ca` | Path to the certificate authority used for the secure connection to the OpenTelemetry Collector,
it defaults to the system bundle. | - | No |
-| `metrics.otlp.grpc.tls.cert` | Path to the public certificate used for the secure connection to the OpenTelemetry Collector.
When using this option, setting the `key` option is required. | - | No |
-| `metrics.otlp.grpc.tls.key` | This instructs the exporter to send the metrics to the OpenTelemetry Collector using HTTP.
Setting the sub-options with their default values. | null/false | No |
-| `metrics.otlp.grpc.tls.insecureskipverify` | Allow the TLS connection to the OpenTelemetry Collector accepts any certificate presented by the server regardless of the hostnames it covers. | false | Yes |
+| Field | Description | Default | Required |
+|:-------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------------------------|:---------|
+| `metrics.addInternals` | Enables metrics for internal resources (e.g.: `ping@internal`). | false | No |
+| `metrics.otlp.serviceName` | Defines the service name resource attribute. | "traefik" | No |
+| `metrics.otlp.resourceAttributes` | Defines additional resource attributes to be sent to the collector. See [resourceAttributes](#resourceattributes) for details. | [] | No |
+| `metrics.otlp.addEntryPointsLabels` | Enable metrics on entry points. | true | No |
+| `metrics.otlp.addRoutersLabels` | Enable metrics on routers. | false | No |
+| `metrics.otlp.addServicesLabels` | Enable metrics on services. | true | No |
+| `metrics.otlp.explicitBoundaries` | Explicit boundaries for Histogram data points. | ".005, .01, .025, .05, .1, .25, .5, 1, 2.5, 5, 10" | No |
+| `metrics.otlp.pushInterval` | Interval at which metrics are sent to the OpenTelemetry Collector. | 10s | No |
+| `metrics.otlp.http` | This instructs the exporter to send the metrics to the OpenTelemetry Collector using HTTP.
Setting the sub-options with their default values. | null/false | No |
+| `metrics.otlp.http.endpoint` | URL of the OpenTelemetry Collector to send metrics to.
Format="`://:`" | "https://localhost:4318/v1/metrics" | Yes |
+| | Additional headers sent with metrics by the exporter to the OpenTelemetry Collector. | - | No |
+| `metrics.otlp.http.tls.ca` | Path to the certificate authority used for the secure connection to the OpenTelemetry Collector,
it defaults to the system bundle. | "" | No |
+| `metrics.otlp.http.tls.cert` | Path to the public certificate used for the secure connection to the OpenTelemetry Collector.
When using this option, setting the `key` option is required. | "" | No |
+| `metrics.otlp.http.tls.key` | This instructs the exporter to send the metrics to the OpenTelemetry Collector using HTTP.
Setting the sub-options with their default values. | null/false | No |
+| `metrics.otlp.http.tls.insecureskipverify` | Allow the TLS connection to the OpenTelemetry Collector accepts any certificate presented by the server regardless of the hostnames it covers. | false | Yes |
+| `metrics.otlp.grpc` | This instructs the exporter to send metrics to the OpenTelemetry Collector using gRPC. | null/false | No |
+| `metrics.otlp.grpc.endpoint` | Address of the OpenTelemetry Collector to send metrics to.
Format="`:`" | "localhost:4317" | Yes |
+| | Additional headers sent with metrics by the exporter to the OpenTelemetry Collector. | - | No |
+| `metrics.otlp.grpc.insecure` | Allows exporter to send metrics to the OpenTelemetry Collector without using a secured protocol. | false | Yes |
+| `metrics.otlp.grpc.tls.ca` | Path to the certificate authority used for the secure connection to the OpenTelemetry Collector,
it defaults to the system bundle. | - | No |
+| `metrics.otlp.grpc.tls.cert` | Path to the public certificate used for the secure connection to the OpenTelemetry Collector.
When using this option, setting the `key` option is required. | - | No |
+| `metrics.otlp.grpc.tls.key` | This instructs the exporter to send the metrics to the OpenTelemetry Collector using HTTP.
Setting the sub-options with their default values. | null/false | No |
+| `metrics.otlp.grpc.tls.insecureskipverify` | Allow the TLS connection to the OpenTelemetry Collector accepts any certificate presented by the server regardless of the hostnames it covers. | false | Yes |
+
+### resourceAttributes
+
+The `resourceAttributes` option allows setting the resource attributes sent along the traces.
+Traefik also supports the `OTEL_RESOURCE_ATTRIBUTES` env variable to set up the resource attributes.
+
+!!! info "Kubernetes Resource Attributes Detection"
+
+ Additionally, Traefik automatically discovers the following [Kubernetes resource attributes](https://opentelemetry.io/docs/specs/semconv/non-normative/k8s-attributes/) when running in a Kubernetes cluster:
+
+ - `k8s.namespace.name`
+ - `k8s.pod.uid`
+ - `k8s.pod.name`
+
+ Note that this automatic detection can fail, like if the Traefik pod is running in host network mode.
+ In this case, you should provide the attributes with the option or the env variable.
## Vendors
@@ -110,13 +128,13 @@ metrics:
| Field | Description | Default | Required |
|:------|:-------------------------------|:---------------------|:---------|
-| `metrics.addInternals` | Enables metrics for internal resources (e.g.: `ping@internal`). | false | No |
-| `datadog.address` | Defines the address for the exporter to send metrics to datadog-agent. More information [here](#address)| `127.0.0.1:8125` | Yes |
-| `datadog.addEntryPointsLabels` | Enable metrics on entry points. | true | No |
-| `datadog.addRoutersLabels` | Enable metrics on routers. | false | No |
-| `datadog.addServicesLabels` | Enable metrics on services. | true | No |
-| `datadog.pushInterval` | Defines the interval used by the exporter to push metrics to datadog-agent. | 10s | No |
-| `datadog.prefix` | Defines the prefix to use for metrics collection. | "traefik" | No |
+| `metrics.addInternals` | Enables metrics for internal resources (e.g.: `ping@internal`). | false | No |
+| `datadog.address` | Defines the address for the exporter to send metrics to datadog-agent. More information [here](#address)| `127.0.0.1:8125` | Yes |
+| `datadog.addEntryPointsLabels` | Enable metrics on entry points. | true | No |
+| `datadog.addRoutersLabels` | Enable metrics on routers. | false | No |
+| `datadog.addServicesLabels` | Enable metrics on services. | true | No |
+| `datadog.pushInterval` | Defines the interval used by the exporter to push metrics to datadog-agent. | 10s | No |
+| `datadog.prefix` | Defines the prefix to use for metrics collection. | "traefik" | No |
##### `address`
@@ -168,16 +186,16 @@ metrics:
| Field | Description | Default | Required |
|:-----------|-------------------------|:--------|:---------|
-| `metrics.addInternal` | Enables metrics for internal resources (e.g.: `ping@internal`). | false | No |
-| `metrics.influxDB2.addEntryPointsLabels` | Enable metrics on entry points. | true | No |
-| `metrics.influxDB2.addRoutersLabels` | Enable metrics on routers. | false | No |
-| `metrics.influxDB2.addServicesLabels` | Enable metrics on services.| true | No |
-| `metrics.influxDB2.additionalLabels` | Additional labels (InfluxDB tags) on all metrics. | - | No |
-| `metrics.influxDB2.pushInterval` | The interval used by the exporter to push metrics to InfluxDB server. | 10s | No |
-| `metrics.influxDB2.address` | Address of the InfluxDB v2 instance. | "http://localhost:8086" | Yes |
-| `metrics.influxDB2.token` | Token with which to connect to InfluxDB v2. | - | Yes |
-| `metrics.influxDB2.org` | Organisation where metrics will be stored. | - | Yes |
-| `metrics.influxDB2.bucket` | Bucket where metrics will be stored. | - | Yes |
+| `metrics.addInternal` | Enables metrics for internal resources (e.g.: `ping@internal`). | false | No |
+| `metrics.influxDB2.addEntryPointsLabels` | Enable metrics on entry points. | true | No |
+| `metrics.influxDB2.addRoutersLabels` | Enable metrics on routers. | false | No |
+| `metrics.influxDB2.addServicesLabels` | Enable metrics on services.| true | No |
+| `metrics.influxDB2.additionalLabels` | Additional labels (InfluxDB tags) on all metrics. | - | No |
+| `metrics.influxDB2.pushInterval` | The interval used by the exporter to push metrics to InfluxDB server. | 10s | No |
+| `metrics.influxDB2.address` | Address of the InfluxDB v2 instance. | "http://localhost:8086" | Yes |
+| `metrics.influxDB2.token` | Token with which to connect to InfluxDB v2. | - | Yes |
+| `metrics.influxDB2.org` | Organisation where metrics will be stored. | - | Yes |
+| `metrics.influxDB2.bucket` | Bucket where metrics will be stored. | - | Yes |
### Prometheus
@@ -213,14 +231,14 @@ metrics:
| Field | Description | Default | Required |
|:-----------|---------------------|:--------|:---------|
-| `metrics.prometheus.addInternals` | Enables metrics for internal resources (e.g.: `ping@internals`). | false | No |
-| `metrics.prometheus.addEntryPointsLabels` | Enable metrics on entry points. | true | No |
-| `metrics.prometheus.addRoutersLabels` | Enable metrics on routers. | false | No |
-| `metrics.prometheus.addServicesLabels` | Enable metrics on services.| true | No |
-| `metrics.prometheus.buckets` | Buckets for latency metrics. |"0.100000, 0.300000, 1.200000, 5.000000" | No |
-| `metrics.prometheus.manualRouting` | Set to _true_, it disables the default internal router in order to allow creating a custom router for the `prometheus@internal` service. | false | No |
-| `metrics.prometheus.entryPoint` | Traefik Entrypoint name used to expose metrics. | "traefik" | No |
-| `metrics.prometheus.headerLabels` | Defines extra labels extracted from request headers for the `requests_total` metrics.
More information [here](#headerlabels). | | Yes |
+| `metrics.addInternals` | Enables metrics for internal resources (e.g.: `ping@internals`). | false | No |
+| `metrics.prometheus.addEntryPointsLabels` | Enable metrics on entry points. | true | No |
+| `metrics.prometheus.addRoutersLabels` | Enable metrics on routers. | false | No |
+| `metrics.prometheus.addServicesLabels` | Enable metrics on services.| true | No |
+| `metrics.prometheus.buckets` | Buckets for latency metrics. |"0.100000, 0.300000, 1.200000, 5.000000" | No |
+| `metrics.prometheus.manualRouting` | Set to _true_, it disables the default internal router in order to allow creating a custom router for the `prometheus@internal` service. | false | No |
+| `metrics.prometheus.entryPoint` | Traefik Entrypoint name used to expose metrics. | "traefik" | No |
+| | Defines extra labels extracted from request headers for the `requests_total` metrics.
More information [here](#headerlabels). | | Yes |
##### headerLabels
@@ -286,13 +304,13 @@ metrics:
| Field | Description | Default | Required |
|:-----------|:-------------------------|:--------|:---------|
-| `metrics.addInternals` | Enables metrics for internal resources (e.g.: `ping@internals`). | false | No |
-| `metrics.statsD.addEntryPointsLabels` | Enable metrics on entry points. | true | No |
-| `metrics.statsD.addRoutersLabels` | Enable metrics on routers. | false | No |
-| `metrics.statsD.addServicesLabels` | Enable metrics on services.| true | No |
-| `metrics.statsD.pushInterval` | The interval used by the exporter to push metrics to DataDog server. | 10s | No |
-| `metrics.statsD.address` | Address instructs exporter to send metrics to statsd at this address. | "127.0.0.1:8125" | Yes |
-| `metrics.statsD.prefix` | The prefix to use for metrics collection. | "traefik" | No |
+| `metrics.addInternals` | Enables metrics for internal resources (e.g.: `ping@internals`). | false | No |
+| `metrics.statsD.addEntryPointsLabels` | Enable metrics on entry points. | true | No |
+| `metrics.statsD.addRoutersLabels` | Enable metrics on routers. | false | No |
+| `metrics.statsD.addServicesLabels` | Enable metrics on services.| true | No |
+| `metrics.statsD.pushInterval` | The interval used by the exporter to push metrics to DataDog server. | 10s | No |
+| `metrics.statsD.address` | Address instructs exporter to send metrics to statsd at this address. | "127.0.0.1:8125" | Yes |
+| `metrics.statsD.prefix` | The prefix to use for metrics collection. | "traefik" | No |
## Metrics Provided
@@ -301,42 +319,42 @@ metrics:
=== "OpenTelemetry"
| Metric | Type | [Labels](#labels) | Description |
|----------------------------|-------|--------------------------|--------------------------------------------------------------------|
- | `traefik_config_reloads_total` | Count | | The total count of configuration reloads. |
- | `traefik_config_last_reload_success` | Gauge | | The timestamp of the last configuration reload success. |
- | `traefik_open_connections` | Gauge | `entrypoint`, `protocol` | The current count of open connections, by entrypoint and protocol. |
- | `traefik_tls_certs_not_after` | Gauge | | The expiration date of certificates. |
+ | `traefik_config_reloads_total` | Count | | The total count of configuration reloads. |
+ | `traefik_config_last_reload_success` | Gauge | | The timestamp of the last configuration reload success. |
+ | `traefik_open_connections` | Gauge | `entrypoint`, `protocol` | The current count of open connections, by entrypoint and protocol. |
+ | `traefik_tls_certs_not_after` | Gauge | | The expiration date of certificates. |
=== "Prometheus"
| Metric | Type | [Labels](#labels) | Description |
|----------------------------|-------|--------------------------|--------------------------------------------------------------------|
- | `traefik_config_reloads_total` | Count | | The total count of configuration reloads. |
- | `traefik_config_last_reload_success` | Gauge | | The timestamp of the last configuration reload success. |
- | `traefik_open_connections` | Gauge | `entrypoint`, `protocol` | The current count of open connections, by entrypoint and protocol. |
- | `traefik_tls_certs_not_after` | Gauge | | The expiration date of certificates. |
+ | `traefik_config_reloads_total` | Count | | The total count of configuration reloads. |
+ | `traefik_config_last_reload_success` | Gauge | | The timestamp of the last configuration reload success. |
+ | `traefik_open_connections` | Gauge | `entrypoint`, `protocol` | The current count of open connections, by entrypoint and protocol. |
+ | `traefik_tls_certs_not_after` | Gauge | | The expiration date of certificates. |
=== "Datadog"
| Metric | Type | [Labels](#labels) | Description |
|----------------------------|-------|--------------------------|--------------------------------------------------------------------|
- | `config.reload.total` | Count | | The total count of configuration reloads. |
- | `config.reload.lastSuccessTimestamp` | Gauge | | The timestamp of the last configuration reload success. |
- | `open.connections` | Gauge | `entrypoint`, `protocol` | The current count of open connections, by entrypoint and protocol. |
- | `tls.certs.notAfterTimestamp` | Gauge | | The expiration date of certificates. |
+ | `config.reload.total` | Count | | The total count of configuration reloads. |
+ | `config.reload.lastSuccessTimestamp` | Gauge | | The timestamp of the last configuration reload success. |
+ | `open.connections` | Gauge | `entrypoint`, `protocol` | The current count of open connections, by entrypoint and protocol. |
+ | `tls.certs.notAfterTimestamp` | Gauge | | The expiration date of certificates. |
=== "InfluxDB2"
| Metric | Type | [Labels](#labels) | Description |
|----------------------------|-------|--------------------------|--------------------------------------------------------------------|
- | `traefik.config.reload.total` | Count | | The total count of configuration reloads. |
- | `traefik.config.reload.lastSuccessTimestamp` | Gauge | | The timestamp of the last configuration reload success. |
- | `traefik.open.connections` | Gauge | `entrypoint`, `protocol` | The current count of open connections, by entrypoint and protocol. |
- | `traefik.tls.certs.notAfterTimestamp` | Gauge | | The expiration date of certificates. |
+ | `traefik.config.reload.total` | Count | | The total count of configuration reloads. |
+ | `traefik.config.reload.lastSuccessTimestamp` | Gauge | | The timestamp of the last configuration reload success. |
+ | `traefik.open.connections` | Gauge | `entrypoint`, `protocol` | The current count of open connections, by entrypoint and protocol. |
+ | `traefik.tls.certs.notAfterTimestamp` | Gauge | | The expiration date of certificates. |
=== "StatsD"
| Metric | Type | [Labels](#labels) | Description |
|----------------------------|-------|--------------------------|--------------------------------------------------------------------|
- | `{prefix}.config.reload.total` | Count | | The total count of configuration reloads. |
- | `{prefix}.config.reload.lastSuccessTimestamp` | Gauge | | The timestamp of the last configuration reload success. |
- | `{prefix}.open.connections` | Gauge | `entrypoint`, `protocol` | The current count of open connections, by entrypoint and protocol. |
- | `{prefix}.tls.certs.notAfterTimestamp` | Gauge | | The expiration date of certificates. |
+ | `{prefix}.config.reload.total` | Count | | The total count of configuration reloads. |
+ | `{prefix}.config.reload.lastSuccessTimestamp` | Gauge | | The timestamp of the last configuration reload success. |
+ | `{prefix}.open.connections` | Gauge | `entrypoint`, `protocol` | The current count of open connections, by entrypoint and protocol. |
+ | `{prefix}.tls.certs.notAfterTimestamp` | Gauge | | The expiration date of certificates. |
!!! note "\{prefix\} Default Value"
By default, \{prefix\} value is `traefik`.
@@ -347,8 +365,8 @@ Here is a comprehensive list of labels that are provided by the global metrics:
| Label | Description | example |
|--------------|----------------------------------------|----------------------|
-| `entrypoint` | Entrypoint that handled the connection | "example_entrypoint" |
-| `protocol` | Connection protocol | "TCP" |
+| `entrypoint` | Entrypoint that handled the connection | "example_entrypoint" |
+| `protocol` | Connection protocol | "TCP" |
### OpenTelemetry Semantic Conventions
@@ -358,7 +376,7 @@ Traefik Proxy follows [official OpenTelemetry semantic conventions v1.23.1](http
| Metric | Type | [Labels](#labels) | Description |
|----------|-----------|-------------------------|------------------|
-| `http.server.request.duration` | Histogram | `error.type`, `http.request.method`, `http.response.status_code`, `network.protocol.name`, `server.address`, `server.port`, `url.scheme` | Duration of HTTP server requests |
+| `http.server.request.duration` | Histogram | `error.type`, `http.request.method`, `http.response.status_code`, `network.protocol.name`, `server.address`, `server.port`, `url.scheme` | Duration of HTTP server requests |
##### Labels
@@ -366,35 +384,35 @@ Here is a comprehensive list of labels that are provided by the metrics:
| Label | Description | example |
|-----------------------------|--------|---------------|
-| `error.type` | Describes a class of error the operation ended with | "500" |
-| `http.request.method` | HTTP request method | "GET" |
-| `http.response.status_code` | HTTP response status code | "200" |
-| `network.protocol.name` | OSI application layer or non-OSI equivalent | "http/1.1" |
-| `network.protocol.version` | Version of the protocol specified in `network.protocol.name` | "1.1" |
-| `server.address` | Name of the local HTTP server that received the request | "example.com" |
-| `server.port` | Port of the local HTTP server that received the request | "80" |
-| `url.scheme` | The URI scheme component identifying the used protocol | "http" |
+| `error.type` | Describes a class of error the operation ended with | "500" |
+| `http.request.method` | HTTP request method | "GET" |
+| `http.response.status_code` | HTTP response status code | "200" |
+| `network.protocol.name` | OSI application layer or non-OSI equivalent | "http/1.1" |
+| `network.protocol.version` | Version of the protocol specified in `network.protocol.name` | "1.1" |
+| `server.address` | Name of the local HTTP server that received the request | "example.com" |
+| `server.port` | Port of the local HTTP server that received the request | "80" |
+| `url.scheme` | The URI scheme component identifying the used protocol | "http" |
#### HTTP Client
| Metric | Type | [Labels](#labels) | Description |
|-------------------------------|-----------|-----------------|--------|
-| `http.client.request.duration` | Histogram | `error.type`, `http.request.method`, `http.response.status_code`, `network.protocol.name`, `server.address`, `server.port`, `url.scheme` | Duration of HTTP client requests |
+| `http.client.request.duration` | Histogram | `error.type`, `http.request.method`, `http.response.status_code`, `network.protocol.name`, `server.address`, `server.port`, `url.scheme` | Duration of HTTP client requests |
##### Labels
Here is a comprehensive list of labels that are provided by the metrics:
-| Label | Description | example |
-|------ -----|------------|---------------|
-| `error.type` | Describes a class of error the operation ended with | "500" |
-| `http.request.method` | HTTP request method | "GET" |
-| `http.response.status_code` | HTTP response status code | "200" |
-| `network.protocol.name` | OSI application layer or non-OSI equivalent | "http/1.1" |
-| `network.protocol.version` | Version of the protocol specified in `network.protocol.name` | "1.1" |
-| `server.address` | Name of the local HTTP server that received the request | "example.com" |
-| `server.port` | Port of the local HTTP server that received the request | "80" |
-| `url.scheme` | The URI scheme component identifying the used protocol | "http" |
+| Label | Description | example |
+|----------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------|---------------|
+| `error.type` | Describes a class of error the operation ended with | "500" |
+| `http.request.method` | HTTP request method | "GET" |
+| `http.response.status_code` | HTTP response status code | "200" |
+| `network.protocol.name` | OSI application layer or non-OSI equivalent | "http/1.1" |
+| `network.protocol.version` | Version of the protocol specified in `network.protocol.name` | "1.1" |
+| `server.address` | Name of the local HTTP server that received the request | "example.com" |
+| `server.port` | Port of the local HTTP server that received the request | "80" |
+| `url.scheme` | The URI scheme component identifying the used protocol | "http" |
### HTTP Metrics
@@ -406,51 +424,51 @@ On top of the official OpenTelemetry semantic conventions, Traefik provides its
| Metric | Type | [Labels](#labels) | Description |
|-----------------------|-----------|--------------------|--------------------------|
- | `traefik_entrypoint_requests_total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total count of HTTP requests received by an entrypoint. |
- | `traefik_entrypoint_requests_tls_total` | Count | `tls_version`, `tls_cipher`, `entrypoint` | The total count of HTTPS requests received by an entrypoint. |
- | `traefik_entrypoint_request_duration_seconds` | Histogram | `code`, `method`, `protocol`, `entrypoint` | Request processing duration histogram on an entrypoint. |
- | `traefik_entrypoint_requests_bytes_total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP requests in bytes handled by an entrypoint. |
- | `traefik_entrypoint_responses_bytes_total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP responses in bytes handled by an entrypoint. |
+ | `traefik_entrypoint_requests_total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total count of HTTP requests received by an entrypoint. |
+ | `traefik_entrypoint_requests_tls_total` | Count | `tls_version`, `tls_cipher`, `entrypoint` | The total count of HTTPS requests received by an entrypoint. |
+ | `traefik_entrypoint_request_duration_seconds` | Histogram | `code`, `method`, `protocol`, `entrypoint` | Request processing duration histogram on an entrypoint. |
+ | `traefik_entrypoint_requests_bytes_total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP requests in bytes handled by an entrypoint. |
+ | `traefik_entrypoint_responses_bytes_total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP responses in bytes handled by an entrypoint. |
=== "Prometheus"
| Metric | Type | [Labels](#labels) | Description |
|-----------------------|-----------|------------------------|-------------------------|
- | `traefik_entrypoint_requests_total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total count of HTTP requests received by an entrypoint. |
- | `traefik_entrypoint_requests_tls_total` | Count | `tls_version`, `tls_cipher`, `entrypoint` | The total count of HTTPS requests received by an entrypoint. |
- | `traefik_entrypoint_request_duration_seconds` | Histogram | `code`, `method`, `protocol`, `entrypoint` | Request processing duration histogram on an entrypoint. |
- | `traefik_entrypoint_requests_bytes_total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP requests in bytes handled by an entrypoint. |
- | `traefik_entrypoint_responses_bytes_total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP responses in bytes handled by an entrypoint. |
+ | `traefik_entrypoint_requests_total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total count of HTTP requests received by an entrypoint. |
+ | `traefik_entrypoint_requests_tls_total` | Count | `tls_version`, `tls_cipher`, `entrypoint` | The total count of HTTPS requests received by an entrypoint. |
+ | `traefik_entrypoint_request_duration_seconds` | Histogram | `code`, `method`, `protocol`, `entrypoint` | Request processing duration histogram on an entrypoint. |
+ | `traefik_entrypoint_requests_bytes_total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP requests in bytes handled by an entrypoint. |
+ | `traefik_entrypoint_responses_bytes_total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP responses in bytes handled by an entrypoint. |
=== "Datadog"
| Metric | Type | [Labels](#labels) | Description |
|-----------------------|-----------|------------------|---------------------------|
- | `entrypoint.requests.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total count of HTTP requests received by an entrypoint. |
- | `entrypoint.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `entrypoint` | The total count of HTTPS requests received by an entrypoint. |
- | `entrypoint.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `entrypoint` | Request processing duration histogram on an entrypoint. |
- | `entrypoint.requests.bytes.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP requests in bytes handled by an entrypoint. |
- | `entrypoint.responses.bytes.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP responses in bytes handled by an entrypoint. |
+ | `entrypoint.requests.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total count of HTTP requests received by an entrypoint. |
+ | `entrypoint.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `entrypoint` | The total count of HTTPS requests received by an entrypoint. |
+ | `entrypoint.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `entrypoint` | Request processing duration histogram on an entrypoint. |
+ | `entrypoint.requests.bytes.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP requests in bytes handled by an entrypoint. |
+ | `entrypoint.responses.bytes.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP responses in bytes handled by an entrypoint. |
=== "InfluxDB2"
| Metric | Type | [Labels](#labels) | Description |
|------------|-----------|-------------------|-----------------|
- | `traefik.entrypoint.requests.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total count of HTTP requests received by an entrypoint. |
- | `traefik.entrypoint.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `entrypoint` | The total count of HTTPS requests received by an entrypoint. |
- | `traefik.entrypoint.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `entrypoint` | Request processing duration histogram on an entrypoint. |
- | `traefik.entrypoint.requests.bytes.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP requests in bytes handled by an entrypoint. |
- | `traefik.entrypoint.responses.bytes.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP responses in bytes handled by an entrypoint. |
+ | `traefik.entrypoint.requests.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total count of HTTP requests received by an entrypoint. |
+ | `traefik.entrypoint.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `entrypoint` | The total count of HTTPS requests received by an entrypoint. |
+ | `traefik.entrypoint.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `entrypoint` | Request processing duration histogram on an entrypoint. |
+ | `traefik.entrypoint.requests.bytes.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP requests in bytes handled by an entrypoint. |
+ | `traefik.entrypoint.responses.bytes.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP responses in bytes handled by an entrypoint. |
=== "StatsD"
| Metric | Type | [Labels](#labels) | Description |
|----------------------------|-------|--------------------------|--------------------------------------------------------------------|
- | `{prefix}.entrypoint.requests.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total count of HTTP requests received by an entrypoint. |
- | `{prefix}.entrypoint.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `entrypoint` | The total count of HTTPS requests received by an entrypoint. |
- | `{prefix}.entrypoint.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `entrypoint` | Request processing duration histogram on an entrypoint. |
- | `{prefix}.entrypoint.requests.bytes.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP requests in bytes handled by an entrypoint. |
- | `{prefix}.entrypoint.responses.bytes.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP responses in bytes handled by an entrypoint. |
+ | `{prefix}.entrypoint.requests.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total count of HTTP requests received by an entrypoint. |
+ | `{prefix}.entrypoint.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `entrypoint` | The total count of HTTPS requests received by an entrypoint. |
+ | `{prefix}.entrypoint.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `entrypoint` | Request processing duration histogram on an entrypoint. |
+ | `{prefix}.entrypoint.requests.bytes.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP requests in bytes handled by an entrypoint. |
+ | `{prefix}.entrypoint.responses.bytes.total` | Count | `code`, `method`, `protocol`, `entrypoint` | The total size of HTTP responses in bytes handled by an entrypoint. |
!!! note "\{prefix\} Default Value"
By default, \{prefix\} value is `traefik`.
@@ -461,51 +479,51 @@ On top of the official OpenTelemetry semantic conventions, Traefik provides its
| Metric | Type | [Labels](#labels) | Description |
|-----------------------|-----------|----------------------|--------------------------------|
- | `traefik_router_requests_total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total count of HTTP requests handled by a router. |
- | `traefik_router_requests_tls_total` | Count | `tls_version`, `tls_cipher`, `router`, `service` | The total count of HTTPS requests handled by a router. |
- | `traefik_router_request_duration_seconds` | Histogram | `code`, `method`, `protocol`, `router`, `service` | Request processing duration histogram on a router. |
- | `traefik_router_requests_bytes_total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP requests in bytes handled by a router. |
- | `traefik_router_responses_bytes_total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP responses in bytes handled by a router. |
+ | `traefik_router_requests_total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total count of HTTP requests handled by a router. |
+ | `traefik_router_requests_tls_total` | Count | `tls_version`, `tls_cipher`, `router`, `service` | The total count of HTTPS requests handled by a router. |
+ | `traefik_router_request_duration_seconds` | Histogram | `code`, `method`, `protocol`, `router`, `service` | Request processing duration histogram on a router. |
+ | `traefik_router_requests_bytes_total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP requests in bytes handled by a router. |
+ | `traefik_router_responses_bytes_total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP responses in bytes handled by a router. |
=== "Prometheus"
| Metric | Type | [Labels](#labels) | Description |
|-----------------------|-----------|---------------------------------------------------|----------------------------------------------------------------|
- | `traefik_router_requests_total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total count of HTTP requests handled by a router. |
- | `traefik_router_requests_tls_total` | Count | `tls_version`, `tls_cipher`, `router`, `service` | The total count of HTTPS requests handled by a router. |
- | `traefik_router_request_duration_seconds` | Histogram | `code`, `method`, `protocol`, `router`, `service` | Request processing duration histogram on a router. |
- | `traefik_router_requests_bytes_total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP requests in bytes handled by a router. |
- | `traefik_router_responses_bytes_total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP responses in bytes handled by a router. |
+ | `traefik_router_requests_total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total count of HTTP requests handled by a router. |
+ | `traefik_router_requests_tls_total` | Count | `tls_version`, `tls_cipher`, `router`, `service` | The total count of HTTPS requests handled by a router. |
+ | `traefik_router_request_duration_seconds` | Histogram | `code`, `method`, `protocol`, `router`, `service` | Request processing duration histogram on a router. |
+ | `traefik_router_requests_bytes_total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP requests in bytes handled by a router. |
+ | `traefik_router_responses_bytes_total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP responses in bytes handled by a router. |
=== "Datadog"
| Metric | Type | [Labels](#labels) | Description |
|-------------|-----------|---------------|---------------------|
- | `router.requests.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total count of HTTP requests handled by a router. |
- | `router.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `router`, `service` | The total count of HTTPS requests handled by a router. |
- | `router.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `router`, `service` | Request processing duration histogram on a router. |
- | `router.requests.bytes.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP requests in bytes handled by a router. |
- | `router.responses.bytes.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP responses in bytes handled by a router. |
+ | `router.requests.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total count of HTTP requests handled by a router. |
+ | `router.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `router`, `service` | The total count of HTTPS requests handled by a router. |
+ | `router.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `router`, `service` | Request processing duration histogram on a router. |
+ | `router.requests.bytes.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP requests in bytes handled by a router. |
+ | `router.responses.bytes.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP responses in bytes handled by a router. |
=== "InfluxDB2"
| Metric | Type | [Labels](#labels) | Description |
|-----------------------|-----------|---------------------------------------------------|----------------------------------------------------------------|
- | `traefik.router.requests.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total count of HTTP requests handled by a router. |
- | `traefik.router.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `router`, `service` | The total count of HTTPS requests handled by a router. |
- | `traefik.router.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `router`, `service` | Request processing duration histogram on a router. |
- | `traefik.router.requests.bytes.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP requests in bytes handled by a router. |
- | `traefik.router.responses.bytes.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP responses in bytes handled by a router. |
+ | `traefik.router.requests.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total count of HTTP requests handled by a router. |
+ | `traefik.router.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `router`, `service` | The total count of HTTPS requests handled by a router. |
+ | `traefik.router.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `router`, `service` | Request processing duration histogram on a router. |
+ | `traefik.router.requests.bytes.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP requests in bytes handled by a router. |
+ | `traefik.router.responses.bytes.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP responses in bytes handled by a router. |
=== "StatsD"
| Metric | Type | [Labels](#labels) | Description |
|-----------------------|-----------|---------------|-------------|
- | `{prefix}.router.requests.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total count of HTTP requests handled by a router. |
- | `{prefix}.router.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `router`, `service` | The total count of HTTPS requests handled by a router. |
- | `{prefix}.router.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `router`, `service` | Request processing duration histogram on a router. |
- | `{prefix}.router.requests.bytes.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP requests in bytes handled by a router. |
- | `{prefix}.router.responses.bytes.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP responses in bytes handled by a router. |
+ | `{prefix}.router.requests.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total count of HTTP requests handled by a router. |
+ | `{prefix}.router.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `router`, `service` | The total count of HTTPS requests handled by a router. |
+ | `{prefix}.router.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `router`, `service` | Request processing duration histogram on a router. |
+ | `{prefix}.router.requests.bytes.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP requests in bytes handled by a router. |
+ | `{prefix}.router.responses.bytes.total` | Count | `code`, `method`, `protocol`, `router`, `service` | The total size of HTTP responses in bytes handled by a router. |
!!! note "\{prefix\} Default Value"
By default, \{prefix\} value is `traefik`.
@@ -516,61 +534,61 @@ On top of the official OpenTelemetry semantic conventions, Traefik provides its
| Metric | Type | Labels | Description |
|-----------------------|-----------|------------|------------|
- | `traefik_service_requests_total` | Count | `code`, `method`, `protocol`, `service` | The total count of HTTP requests processed on a service. |
- | `traefik_service_requests_tls_total` | Count | `tls_version`, `tls_cipher`, `service` | The total count of HTTPS requests processed on a service. |
- | `traefik_service_request_duration_seconds` | Histogram | `code`, `method`, `protocol`, `service` | Request processing duration histogram on a service. |
- | `traefik_service_retries_total` | Count | `service` | The count of requests retries on a service. |
- | `traefik_service_server_up` | Gauge | `service`, `url` | Current service's server status, 0 for a down or 1 for up. |
- | `traefik_service_requests_bytes_total` | Count | `code`, `method`, `protocol`, `service` | The total size of requests in bytes received by a service. |
- | `traefik_service_responses_bytes_total` | Count | `code`, `method`, `protocol`, `service` | The total size of responses in bytes returned by a service. |
+ | `traefik_service_requests_total` | Count | `code`, `method`, `protocol`, `service` | The total count of HTTP requests processed on a service. |
+ | `traefik_service_requests_tls_total` | Count | `tls_version`, `tls_cipher`, `service` | The total count of HTTPS requests processed on a service. |
+ | `traefik_service_request_duration_seconds` | Histogram | `code`, `method`, `protocol`, `service` | Request processing duration histogram on a service. |
+ | `traefik_service_retries_total` | Count | `service` | The count of requests retries on a service. |
+ | `traefik_service_server_up` | Gauge | `service`, `url` | Current service's server status, 0 for a down or 1 for up. Only for services configured with healthcheck. |
+ | `traefik_service_requests_bytes_total` | Count | `code`, `method`, `protocol`, `service` | The total size of requests in bytes received by a service. |
+ | `traefik_service_responses_bytes_total` | Count | `code`, `method`, `protocol`, `service` | The total size of responses in bytes returned by a service. |
=== "Prometheus"
| Metric | Type | Labels | Description |
|-----------------------|-----------|-------|------------|
- | `traefik_service_requests_total` | Count | `code`, `method`, `protocol`, `service` | The total count of HTTP requests processed on a service. |
- | `traefik_service_requests_tls_total` | Count | `tls_version`, `tls_cipher`, `service` | The total count of HTTPS requests processed on a service. |
- | `traefik_service_request_duration_seconds` | Histogram | `code`, `method`, `protocol`, `service` | Request processing duration histogram on a service. |
- | `traefik_service_retries_total` | Count | `service` | The count of requests retries on a service. |
- | `traefik_service_server_up` | Gauge | `service`, `url` | Current service's server status, 0 for a down or 1 for up. |
- | `traefik_service_requests_bytes_total` | Count | `code`, `method`, `protocol`, `service` | The total size of requests in bytes received by a service. |
- | `traefik_service_responses_bytes_total` | Count | `code`, `method`, `protocol`, `service` | The total size of responses in bytes returned by a service. |
+ | `traefik_service_requests_total` | Count | `code`, `method`, `protocol`, `service` | The total count of HTTP requests processed on a service. |
+ | `traefik_service_requests_tls_total` | Count | `tls_version`, `tls_cipher`, `service` | The total count of HTTPS requests processed on a service. |
+ | `traefik_service_request_duration_seconds` | Histogram | `code`, `method`, `protocol`, `service` | Request processing duration histogram on a service. |
+ | `traefik_service_retries_total` | Count | `service` | The count of requests retries on a service. |
+ | `traefik_service_server_up` | Gauge | `service`, `url` | Current service's server status, 0 for a down or 1 for up. Only for services configured with healthcheck. |
+ | `traefik_service_requests_bytes_total` | Count | `code`, `method`, `protocol`, `service` | The total size of requests in bytes received by a service. |
+ | `traefik_service_responses_bytes_total` | Count | `code`, `method`, `protocol`, `service` | The total size of responses in bytes returned by a service. |
=== "Datadog"
| Metric | Type | Labels | Description |
|-----------------------|-----------|--------|------------------|
- | `service.requests.total` | Count | `code`, `method`, `protocol`, `service` | The total count of HTTP requests processed on a service. |
- | `router.service.tls.total` | Count | `tls_version`, `tls_cipher`, `service` | The total count of HTTPS requests processed on a service. |
- | `service.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `service` | Request processing duration histogram on a service. |
- | `service.retries.total` | Count | `service` | The count of requests retries on a service. |
- | `service.server.up` | Gauge | `service`, `url` | Current service's server status, 0 for a down or 1 for up. |
- | `service.requests.bytes.total` | Count | `code`, `method`, `protocol`, `service` | The total size of requests in bytes received by a service. |
- | `service.responses.bytes.total` | Count | `code`, `method`, `protocol`, `service` | The total size of responses in bytes returned by a service. |
+ | `service.requests.total` | Count | `code`, `method`, `protocol`, `service` | The total count of HTTP requests processed on a service. |
+ | `router.service.tls.total` | Count | `tls_version`, `tls_cipher`, `service` | The total count of HTTPS requests processed on a service. |
+ | `service.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `service` | Request processing duration histogram on a service. |
+ | `service.retries.total` | Count | `service` | The count of requests retries on a service. |
+ | `service.server.up` | Gauge | `service`, `url` | Current service's server status, 0 for a down or 1 for up. Only for services configured with healthcheck. |
+ | `service.requests.bytes.total` | Count | `code`, `method`, `protocol`, `service` | The total size of requests in bytes received by a service. |
+ | `service.responses.bytes.total` | Count | `code`, `method`, `protocol`, `service` | The total size of responses in bytes returned by a service. |
=== "InfluxDB2"
| Metric | Type | Labels | Description |
|-----------------------|-----------|-----------------------------------------|-------------------------------------------------------------|
- | `traefik.service.requests.total` | Count | `code`, `method`, `protocol`, `service` | The total count of HTTP requests processed on a service. |
- | `traefik.service.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `service` | The total count of HTTPS requests processed on a service. |
- | `traefik.service.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `service` | Request processing duration histogram on a service. |
- | `traefik.service.retries.total` | Count | `service` | The count of requests retries on a service. |
- | `traefik.service.server.up` | Gauge | `service`, `url` | Current service's server status, 0 for a down or 1 for up. |
- | `traefik.service.requests.bytes.total` | Count | `code`, `method`, `protocol`, `service` | The total size of requests in bytes received by a service. |
- | `traefik.service.responses.bytes.total` | Count | `code`, `method`, `protocol`, `service` | The total size of responses in bytes returned by a service. |
+ | `traefik.service.requests.total` | Count | `code`, `method`, `protocol`, `service` | The total count of HTTP requests processed on a service. |
+ | `traefik.service.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `service` | The total count of HTTPS requests processed on a service. |
+ | `traefik.service.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `service` | Request processing duration histogram on a service. |
+ | `traefik.service.retries.total` | Count | `service` | The count of requests retries on a service. |
+ | `traefik.service.server.up` | Gauge | `service`, `url` | Current service's server status, 0 for a down or 1 for up. Only for services configured with healthcheck. |
+ | `traefik.service.requests.bytes.total` | Count | `code`, `method`, `protocol`, `service` | The total size of requests in bytes received by a service. |
+ | `traefik.service.responses.bytes.total` | Count | `code`, `method`, `protocol`, `service` | The total size of responses in bytes returned by a service. |
=== "StatsD"
| Metric | Type | Labels | Description |
|-----------------------|-----------|-----|---------|
- | `{prefix}.service.requests.total` | Count | `code`, `method`, `protocol`, `service` | The total count of HTTP requests processed on a service. |
- | `{prefix}.service.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `service` | The total count of HTTPS requests processed on a service. |
- | `{prefix}.service.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `service` | Request processing duration histogram on a service. |
- | `{prefix}.service.retries.total` | Count | `service` | The count of requests retries on a service. |
- | `{prefix}.service.server.up` | Gauge | `service`, `url` | Current service's server status, 0 for a down or 1 for up. |
- | `{prefix}.service.requests.bytes.total` | Count | `code`, `method`, `protocol`, `service` | The total size of requests in bytes received by a service. |
- | `{prefix}.service.responses.bytes.total` | Count | `code`, `method`, `protocol`, `service` | The total size of responses in bytes returned by a service. |
+ | `{prefix}.service.requests.total` | Count | `code`, `method`, `protocol`, `service` | The total count of HTTP requests processed on a service. |
+ | `{prefix}.service.requests.tls.total` | Count | `tls_version`, `tls_cipher`, `service` | The total count of HTTPS requests processed on a service. |
+ | `{prefix}.service.request.duration.seconds` | Histogram | `code`, `method`, `protocol`, `service` | Request processing duration histogram on a service. |
+ | `{prefix}.service.retries.total` | Count | `service` | The count of requests retries on a service. |
+ | `{prefix}.service.server.up` | Gauge | `service`, `url` | Current service's server status, 0 for a down or 1 for up. Only for services configured with healthcheck. |
+ | `{prefix}.service.requests.bytes.total` | Count | `code`, `method`, `protocol`, `service` | The total size of requests in bytes received by a service. |
+ | `{prefix}.service.responses.bytes.total` | Count | `code`, `method`, `protocol`, `service` | The total size of responses in bytes returned by a service. |
!!! note "\{prefix\} Default Value"
By default, \{prefix\} value is `traefik`.
@@ -581,18 +599,18 @@ Here is a comprehensive list of labels that are provided by the metrics:
| Label | Description | example |
|---------------|-------------------|----------------------------|
-| `cn` | Certificate Common Name | "example.com" |
-| `code` | Request code | "200" |
-| `entrypoint` | Entrypoint that handled the request | "example_entrypoint" |
-| `method` | Request Method | "GET" |
-| `protocol` | Request protocol | "http" |
-| `router` | Router that handled the request | "example_router" |
-| `sans` | Certificate Subject Alternative NameS | "example.com" |
-| `serial` | Certificate Serial Number | "123..." |
-| `service` | Service that handled the request | "example_service@provider" |
-| `tls_cipher` | TLS cipher used for the request | "TLS_FALLBACK_SCSV" |
-| `tls_version` | TLS version used for the request | "1.0" |
-| `url` | Service server url | "http://example.com" |
+| `cn` | Certificate Common Name | "example.com" |
+| `code` | Request code | "200" |
+| `entrypoint` | Entrypoint that handled the request | "example_entrypoint" |
+| `method` | Request Method | "GET" |
+| `protocol` | Request protocol | "http" |
+| `router` | Router that handled the request | "example_router" |
+| `sans` | Certificate Subject Alternative NameS | "example.com" |
+| `serial` | Certificate Serial Number | "123..." |
+| `service` | Service that handled the request | "example_service@provider" |
+| `tls_cipher` | TLS cipher used for the request | "TLS_FALLBACK_SCSV" |
+| `tls_version` | TLS version used for the request | "1.0" |
+| `url` | Service server url | "http://example.com" |
!!! info "`method` label value"
diff --git a/docs/content/reference/install-configuration/observability/tracing.md b/docs/content/reference/install-configuration/observability/tracing.md
index f7b4987c1..c3748e5f1 100644
--- a/docs/content/reference/install-configuration/observability/tracing.md
+++ b/docs/content/reference/install-configuration/observability/tracing.md
@@ -36,27 +36,43 @@ tracing: {}
## Configuration Options
-| Field | Description | Default | Required |
-|:-------------------------------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------------------------------|:---------|
-| `tracing.addInternals` | Enables tracing for internal resources (e.g.: `ping@internal`). | false | No |
-| `tracing.serviceName` | Service name used in selected backend. | "traefik" | No |
-| `tracing.sampleRate` | The proportion of requests to trace, specified between 0.0 and 1.0. | 1.0 | No |
-| `tracing.resourceAttributes` | Defines additional resource attributes to be sent to the collector. | [] | No |
-| `tracing.capturedRequestHeaders` | Defines the list of request headers to add as attributes.
It applies to client and server kind spans.| [] | No |
-| `tracing.capturedResponseHeaders` | Defines the list of response headers to add as attributes.
It applies to client and server kind spans.| [] |False |
-| `tracing.safeQueryParams` | By default, all query parameters are redacted.
Defines the list of query parameters to not redact. | [] | No |
-| `tracing.otlp.http` | This instructs the exporter to send the tracing to the OpenTelemetry Collector using HTTP.
Setting the sub-options with their default values. | null/false | No |
-| `tracing.otlp.http.endpoint` | URL of the OpenTelemetry Collector to send tracing to.
Format="`://:`" | "http://localhost:4318/v1/tracing" | Yes |
-| `tracing.otlp.http.headers` | Additional headers sent with tracing by the exporter to the OpenTelemetry Collector. | | No |
-| `tracing.otlp.http.tls.ca` | Path to the certificate authority used for the secure connection to the OpenTelemetry Collector, it defaults to the system bundle. | "" | No |
-| `tracing.otlp.http.tls.cert` | Path to the public certificate used for the secure connection to the OpenTelemetry Collector. When using this option, setting the `key` option is required. | "" | No |
-| `tracing.otlp.http.tls.key` | This instructs the exporter to send the tracing to the OpenTelemetry Collector using HTTP.
Setting the sub-options with their default values. | ""null/false "" | No |
-| `tracing.otlp.http.tls.insecureskipverify` |If `insecureSkipVerify` is `true`, the TLS connection to the OpenTelemetry Collector accepts any certificate presented by the server regardless of the hostnames it covers. | false | Yes |
-| `tracing.otlp.grpc` | This instructs the exporter to send tracing to the OpenTelemetry Collector using gRPC. | false | No |
-| `tracing.otlp.grpc.endpoint` | Address of the OpenTelemetry Collector to send tracing to.
Format="`:`" | "localhost:4317" | Yes |
-| `tracing.otlp.grpc.headers` | Additional headers sent with tracing by the exporter to the OpenTelemetry Collector. | [] | No |
-| `tracing.otlp.grpc.insecure` |Allows exporter to send tracing to the OpenTelemetry Collector without using a secured protocol. | false | Yes |
-| `tracing.otlp.grpc.tls.ca` | Path to the certificate authority used for the secure connection to the OpenTelemetry Collector, it defaults to the system bundle. | "" | No |
-| `tracing.otlp.grpc.tls.cert` | Path to the public certificate used for the secure connection to the OpenTelemetry Collector. When using this option, setting the `key` option is required. | "" | No |
-| `tracing.otlp.grpc.tls.key` | This instructs the exporter to send the tracing to the OpenTelemetry Collector using HTTP.
Setting the sub-options with their default values. | ""null/false "" | No |
-| `tracing.otlp.grpc.tls.insecureskipverify` |If `insecureSkipVerify` is `true`, the TLS connection to the OpenTelemetry Collector accepts any certificate presented by the server regardless of the hostnames it covers. | false | Yes |
+| Field | Description | Default | Required |
+|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------|:---------|
+| `tracing.addInternals` | Enables tracing for internal resources (e.g.: `ping@internal`). | false | No |
+| `tracing.serviceName` | Defines the service name resource attribute. | "traefik" | No |
+| `tracing.resourceAttributes` | Defines additional resource attributes to be sent to the collector. See [resourceAttributes](#resourceattributes) for details. | [] | No |
+| `tracing.sampleRate` | The proportion of requests to trace, specified between 0.0 and 1.0. | 1.0 | No |
+| | Defines the list of request headers to add as attributes.
It applies to client and server kind spans. | [] | No |
+| | Defines the list of response headers to add as attributes.
It applies to client and server kind spans. | [] | False |
+| `tracing.safeQueryParams` | By default, all query parameters are redacted.
Defines the list of query parameters to not redact. | [] | No |
+| `tracing.otlp.http` | This instructs the exporter to send the tracing to the OpenTelemetry Collector using HTTP.
Setting the sub-options with their default values. | null/false | No |
+| `tracing.otlp.http.endpoint` | URL of the OpenTelemetry Collector to send tracing to.
Format="`://:`" | "https://localhost:4318/v1/tracing" | Yes |
+| | Additional headers sent with tracing by the exporter to the OpenTelemetry Collector. | | No |
+| `tracing.otlp.http.tls.ca` | Path to the certificate authority used for the secure connection to the OpenTelemetry Collector, it defaults to the system bundle. | "" | No |
+| `tracing.otlp.http.tls.cert` | Path to the public certificate used for the secure connection to the OpenTelemetry Collector. When using this option, setting the `key` option is required. | "" | No |
+| `tracing.otlp.http.tls.key` | This instructs the exporter to send the tracing to the OpenTelemetry Collector using HTTP.
Setting the sub-options with their default values. | ""null/false "" | No |
+| `tracing.otlp.http.tls.insecureskipverify` | If `insecureSkipVerify` is `true`, the TLS connection to the OpenTelemetry Collector accepts any certificate presented by the server regardless of the hostnames it covers. | false | Yes |
+| `tracing.otlp.grpc` | This instructs the exporter to send tracing to the OpenTelemetry Collector using gRPC. | false | No |
+| `tracing.otlp.grpc.endpoint` | Address of the OpenTelemetry Collector to send tracing to.
Format="`:`" | "localhost:4317" | Yes |
+| | Additional headers sent with tracing by the exporter to the OpenTelemetry Collector. | [] | No |
+| `tracing.otlp.grpc.insecure` | Allows exporter to send tracing to the OpenTelemetry Collector without using a secured protocol. | false | Yes |
+| `tracing.otlp.grpc.tls.ca` | Path to the certificate authority used for the secure connection to the OpenTelemetry Collector, it defaults to the system bundle. | "" | No |
+| `tracing.otlp.grpc.tls.cert` | Path to the public certificate used for the secure connection to the OpenTelemetry Collector. When using this option, setting the `key` option is required. | "" | No |
+| `tracing.otlp.grpc.tls.key` | This instructs the exporter to send the tracing to the OpenTelemetry Collector using HTTP.
Setting the sub-options with their default values. | ""null/false "" | No |
+| `tracing.otlp.grpc.tls.insecureskipverify` | If `insecureSkipVerify` is `true`, the TLS connection to the OpenTelemetry Collector accepts any certificate presented by the server regardless of the hostnames it covers. | false | Yes |
+
+## resourceAttributes
+
+The `resourceAttributes` option allows setting the resource attributes sent along the traces.
+Traefik also supports the `OTEL_RESOURCE_ATTRIBUTES` env variable to set up the resource attributes.
+
+!!! info "Kubernetes Resource Attributes Detection"
+
+ Additionally, Traefik automatically discovers the following [Kubernetes resource attributes](https://opentelemetry.io/docs/specs/semconv/non-normative/k8s-attributes/) when running in a Kubernetes cluster:
+
+ - `k8s.namespace.name`
+ - `k8s.pod.uid`
+ - `k8s.pod.name`
+
+ Note that this automatic detection can fail, like if the Traefik pod is running in host network mode.
+ In this case, you should provide the attributes with the option or the env variable.
diff --git a/docs/content/reference/install-configuration/providers/docker.md b/docs/content/reference/install-configuration/providers/docker.md
index 74e250ae0..eff2a9297 100644
--- a/docs/content/reference/install-configuration/providers/docker.md
+++ b/docs/content/reference/install-configuration/providers/docker.md
@@ -29,7 +29,6 @@ providers:
Attach labels to containers (in your Docker compose file)
```yaml
-version: "3"
services:
my-container:
# ...
@@ -41,22 +40,22 @@ services:
| Field | Description | Default | Required |
|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
-| `providers.docker.endpoint` | Specifies the Docker API endpoint. See [here](#endpoint) for more information| "unix:///var/run/docker.sock" | Yes |
-| `providers.docker.username` | Defines the username for Basic HTTP authentication. This should be used when the Docker daemon socket is exposed through an HTTP proxy that requires Basic HTTP authentication.| "" | No |
-| `providers.docker.password` | Defines the password for Basic HTTP authentication. This should be used when the Docker daemon socket is exposed through an HTTP proxy that requires Basic HTTP authentication.| "" | No |
-| `providers.docker.useBindPortIP` | Instructs Traefik to use the IP/Port attached to the container's binding instead of its inner network IP/Port. See [here](#usebindportip) for more information | false | No |
-| `providers.docker.exposedByDefault` | Expose containers by default through Traefik. See [here](./overview.md#restrict-the-scope-of-service-discovery) for additional information | true | No |
-| `providers.docker.network` | Defines a default docker network to use for connections to all containers. This option can be overridden on a per-container basis with the `traefik.docker.network` label.| "" | No |
-| `providers.docker.defaultRule` | Defines what routing rule to apply to a container if no rule is defined by a label. See [here](#defaultrule) for more information. | ```"Host(`{{ normalize .Name }}`)"``` | No |
-| `providers.docker.httpClientTimeout` | Defines the client timeout (in seconds) for HTTP connections. If its value is 0, no timeout is set. | 0 | No |
-| `providers.docker.watch` | Instructs Traefik to watch Docker events or not. | True | No |
-| `providers.docker.constraints` | Defines an expression that Traefik matches against the container labels to determine whether to create any route for that container. See [here](#constraints) for more information. | "" | No |
-| `providers.docker.allowEmptyServices` | Instructs the provider to create any [servers load balancer](../../../routing/services/index.md#servers-load-balancer) defined for Docker containers regardless of the [healthiness](https://docs.docker.com/engine/reference/builder/#healthcheck) of the corresponding containers. | false | No |
-| `providers.docker.tls.ca` | Defines the path to the certificate authority used for the secure connection to Docker, it defaults to the system bundle. | "" | No |
-| `providers.docker.tls.cert` | Defines the path to the public certificate used for the secure connection to Docker. When using this option, setting the `key` option is required. | "" | Yes |
-| `providers.docker.tls.key` | Defines the path to the private key used for the secure connection to Docker. When using this option, setting the `cert` option is required. | "" | Yes |
-| `providers.docker.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by the Docker server when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.docker.endpoint` | Specifies the Docker API endpoint. See [here](#endpoint) for more information| "unix:///var/run/docker.sock" | Yes |
+| `providers.docker.username` | Defines the username for Basic HTTP authentication. This should be used when the Docker daemon socket is exposed through an HTTP proxy that requires Basic HTTP authentication.| "" | No |
+| `providers.docker.password` | Defines the password for Basic HTTP authentication. This should be used when the Docker daemon socket is exposed through an HTTP proxy that requires Basic HTTP authentication.| "" | No |
+| `providers.docker.useBindPortIP` | Instructs Traefik to use the IP/Port attached to the container's binding instead of its inner network IP/Port. See [here](#usebindportip) for more information | false | No |
+| `providers.docker.exposedByDefault` | Expose containers by default through Traefik. See [here](./overview.md#exposedbydefault-and-traefikenable) for additional information | true | No |
+| `providers.docker.network` | Defines a default docker network to use for connections to all containers. This option can be overridden on a per-container basis with the `traefik.docker.network` label.| "" | No |
+| `providers.docker.defaultRule` | Defines what routing rule to apply to a container if no rule is defined by a label. See [here](#defaultrule) for more information. | ```"Host(`{{ normalize .Name }}`)"``` | No |
+| `providers.docker.httpClientTimeout` | Defines the client timeout (in seconds) for HTTP connections. If its value is 0, no timeout is set. | 0 | No |
+| `providers.docker.watch` | Instructs Traefik to watch Docker events or not. | True | No |
+| `providers.docker.constraints` | Defines an expression that Traefik matches against the container labels to determine whether to create any route for that container. See [here](#constraints) for more information. | "" | No |
+| `providers.docker.allowEmptyServices` | Instructs the provider to create any [servers load balancer](../../../routing/services/index.md#servers-load-balancer) defined for Docker containers regardless of the [healthiness](https://docs.docker.com/engine/reference/builder/#healthcheck) of the corresponding containers. | false | No |
+| `providers.docker.tls.ca` | Defines the path to the certificate authority used for the secure connection to Docker, it defaults to the system bundle. | "" | No |
+| `providers.docker.tls.cert` | Defines the path to the public certificate used for the secure connection to Docker. When using this option, setting the `key` option is required. | "" | Yes |
+| `providers.docker.tls.key` | Defines the path to the private key used for the secure connection to Docker. When using this option, setting the `cert` option is required. | "" | Yes |
+| `providers.docker.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by the Docker server when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
### `endpoint`
@@ -67,8 +66,6 @@ See the [Docker API Access](#docker-api-access) section for more information.
The docker-compose file shares the docker sock with the Traefik container
```yaml
- version: '3'
-
services:
traefik:
image: traefik:v3.1 # The official v3 Traefik docker image
@@ -195,13 +192,13 @@ but still uses the `traefik.http.services..loadbalancer.server.port` that
| port label | Container's binding | Routes to |
|--------------------|----------------------------------------------------|----------------|
- | - | - | IntIP:IntPort |
- | - | ExtPort:IntPort | IntIP:IntPort |
- | - | ExtIp:ExtPort:IntPort | ExtIp:ExtPort |
- | LblPort | - | IntIp:LblPort |
- | LblPort | ExtIp:ExtPort:LblPort | ExtIp:ExtPort |
- | LblPort | ExtIp:ExtPort:OtherPort | IntIp:LblPort |
- | LblPort | ExtIp1:ExtPort1:IntPort1 & ExtIp2:LblPort:IntPort2 | ExtIp2:LblPort |
+ | - | - | IntIP:IntPort |
+ | - | ExtPort:IntPort | IntIP:IntPort |
+ | - | ExtIp:ExtPort:IntPort | ExtIp:ExtPort |
+ | LblPort | - | IntIp:LblPort |
+ | LblPort | ExtIp:ExtPort:LblPort | ExtIp:ExtPort |
+ | LblPort | ExtIp:ExtPort:OtherPort | IntIp:LblPort |
+ | LblPort | ExtIp1:ExtPort1:IntPort1 & ExtIp2:LblPort:IntPort2 | ExtIp2:LblPort |
!!! info ""
In the above table:
@@ -273,6 +270,10 @@ created. If the expression is empty, all detected containers are included.
The expression syntax is based on the `Label("key", "value")`, and `LabelRegex("key", "value")` functions,
as well as the usual boolean logic, as shown in examples below.
+!!! tip "Constraints key limitations"
+
+ Note that `traefik.*` is a reserved label namespace for configuration and can not be used as a key for custom constraints.
+
??? example "Constraints Expression Examples"
```toml
@@ -305,7 +306,7 @@ as well as the usual boolean logic, as shown in examples below.
constraints = "LabelRegex(`a.label.name`, `a.+`)"
```
-For additional information, refer to [Restrict the Scope of Service Discovery](./overview.md#restrict-the-scope-of-service-discovery).
+For additional information, refer to [Restrict the Scope of Service Discovery](./overview.md#exposedbydefault-and-traefikenable).
```yaml tab="File (YAML)"
providers:
diff --git a/docs/content/reference/install-configuration/providers/hashicorp/consul-catalog.md b/docs/content/reference/install-configuration/providers/hashicorp/consul-catalog.md
index 975c0685d..e69717389 100644
--- a/docs/content/reference/install-configuration/providers/hashicorp/consul-catalog.md
+++ b/docs/content/reference/install-configuration/providers/hashicorp/consul-catalog.md
@@ -32,34 +32,34 @@ Attaching tags to services:
| Field | Description | Default | Required |
|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
-| `providers.consulCatalog.refreshInterval` | Defines the polling interval.| 15s | No |
-| `providers.consulCatalog.prefix` | Defines the prefix for Consul Catalog tags defining Traefik labels.| traefik | yes |
-| `providers.consulCatalog.requireConsistent` | Forces the read to be fully consistent. See [here](#requireconsistent) for more information.| false | yes |
-| `providers.consulCatalog.exposedByDefault` | Expose Consul Catalog services by default in Traefik. If set to `false`, services that do not have a `traefik.enable=true` tag will be ignored from the resulting routing configuration. See [here](../overview.md#restrict-the-scope-of-service-discovery). | true | no |
-| `providers.consulCatalog.defaultRule` | The Default Host rule for all services. See [here](#defaultrule) for more information. | ```"Host(`{{ normalize .Name }}`)"``` | No |
-| `providers.consulCatalog.connectAware` | Enable Consul Connect support. If set to `true`, Traefik will be enabled to communicate with Connect services. | false | No |
-| `providers.consulCatalog.connectByDefault` | Consider every service as Connect capable by default. If set to true, Traefik will consider every Consul Catalog service to be Connect capable by default. The option can be overridden on an instance basis with the traefik.consulcatalog.connect tag. | false | No |
-| `providers.consulCatalog.serviceName` | Defines the name of the Traefik service in Consul Catalog. | "traefik" | No |
-| `providers.consulCatalog.constraints` | Defines an expression that Traefik matches against the container labels to determine whether to create any route for that container. See [here](#constraints) for more information. | "" | No |
-| `providers.consulCatalog.namespaces` | Defines the namespaces to query. See [here](#namespaces) for more information. | "" | no |
-| `providers.consulCatalog.stale` | Instruct Traefik to use stale consistency for catalog reads. | false | no |
-| `providers.consulCatalog.cache` | Instruct Traefik to use local agent caching for catalog reads. | false | no |
-| `providers.consulCatalog.endpoint` | Defines the Consul server endpoint. | - | yes |
-| `providers.consulCatalog.endpoint.address` | Defines the address of the Consul server. | 127.0.0.1:8500 | no |
-| `providers.consulCatalog.endpoint.scheme` | Defines the URI scheme for the Consul server. | "" | no |
-| `providers.consulCatalog.endpoint.datacenter` | Defines the datacenter to use. If not provided in Traefik, Consul uses the default agent datacenter. | "" | no |
-| `providers.consulCatalog.endpoint.token` | Defines a per-request ACL token which overwrites the agent's default token. | "" | no |
-| `providers.consulCatalog.endpoint.endpointWaitTime` | Defines a duration for which a `watch` can block. If not provided, the agent default values will be used. | "" | no |
-| `providers.consulCatalog.endpoint.httpAuth` | Defines authentication settings for the HTTP client using HTTP Basic Authentication. | N/A | no |
-| `providers.consulCatalog.endpoint.httpAuth.username` | Defines the username to use for HTTP Basic Authentication. | "" | no |
-| `providers.consulCatalog.endpoint.httpAuth.password` | Defines the password to use for HTTP Basic Authentication. | "" | no |
-| `providers.consulCatalog.strictChecks` | Define which [Consul Service health checks](https://developer.hashicorp.com/consul/docs/services/usage/checks#define-initial-health-check-status) are allowed to take on traffic. | "passing,warning" | no |
-| `providers.consulCatalog.tls.ca` | Defines the path to the certificate authority used for the secure connection to Consul Calatog, it defaults to the system bundle. | "" | No |
-| `providers.consulCatalog.tls.cert` | Defines the path to the public certificate used for the secure connection to Consul Calatog. When using this option, setting the `key` option is required. | "" | Yes |
-| `providers.consulCatalog.tls.key` | Defines the path to the private key used for the secure connection to Consul Catalog. When using this option, setting the `cert` option is required. | "" | Yes |
-| `providers.consulCatalog.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by Consul Catalog when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
-| `providers.consulCatalog.watch` | When set to `true`, watches for Consul changes ([Consul watches checks](https://www.consul.io/docs/dynamic-app-config/watches#checks)). | false | No |
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.consulCatalog.refreshInterval` | Defines the polling interval.| 15s | No |
+| `providers.consulCatalog.prefix` | Defines the prefix for Consul Catalog tags defining Traefik labels.| traefik | yes |
+| `providers.consulCatalog.requireConsistent` | Forces the read to be fully consistent. See [here](#requireconsistent) for more information.| false | yes |
+| `providers.consulCatalog.exposedByDefault` | Expose Consul Catalog services by default in Traefik. If set to `false`, services that do not have a `traefik.enable=true` tag will be ignored from the resulting routing configuration. See [here](../overview.md#exposedbydefault-and-traefikenable). | true | no |
+| `providers.consulCatalog.defaultRule` | The Default Host rule for all services. See [here](#defaultrule) for more information. | ```"Host(`{{ normalize .Name }}`)"``` | No |
+| `providers.consulCatalog.connectAware` | Enable Consul Connect support. If set to `true`, Traefik will be enabled to communicate with Connect services. | false | No |
+| `providers.consulCatalog.connectByDefault` | Consider every service as Connect capable by default. If set to true, Traefik will consider every Consul Catalog service to be Connect capable by default. The option can be overridden on an instance basis with the traefik.consulcatalog.connect tag. | false | No |
+| `providers.consulCatalog.serviceName` | Defines the name of the Traefik service in Consul Catalog. | "traefik" | No |
+| `providers.consulCatalog.constraints` | Defines an expression that Traefik matches against the container labels to determine whether to create any route for that container. See [here](#constraints) for more information. | "" | No |
+| `providers.consulCatalog.namespaces` | Defines the namespaces to query. See [here](#namespaces) for more information. | "" | no |
+| `providers.consulCatalog.stale` | Instruct Traefik to use stale consistency for catalog reads. | false | no |
+| `providers.consulCatalog.cache` | Instruct Traefik to use local agent caching for catalog reads. | false | no |
+| `providers.consulCatalog.endpoint` | Defines the Consul server endpoint. | - | yes |
+| `providers.consulCatalog.endpoint.address` | Defines the address of the Consul server. | 127.0.0.1:8500 | no |
+| `providers.consulCatalog.endpoint.scheme` | Defines the URI scheme for the Consul server. | "" | no |
+| `providers.consulCatalog.endpoint.datacenter` | Defines the datacenter to use. If not provided in Traefik, Consul uses the default agent datacenter. | "" | no |
+| `providers.consulCatalog.endpoint.token` | Defines a per-request ACL token which overwrites the agent's default token. | "" | no |
+| `providers.consulCatalog.endpoint.endpointWaitTime` | Defines a duration for which a `watch` can block. If not provided, the agent default values will be used. | "" | no |
+| `providers.consulCatalog.endpoint.httpAuth` | Defines authentication settings for the HTTP client using HTTP Basic Authentication. | N/A | no |
+| `providers.consulCatalog.endpoint.httpAuth.username` | Defines the username to use for HTTP Basic Authentication. | "" | no |
+| `providers.consulCatalog.endpoint.httpAuth.password` | Defines the password to use for HTTP Basic Authentication. | "" | no |
+| `providers.consulCatalog.strictChecks` | Define which [Consul Service health checks](https://developer.hashicorp.com/consul/docs/services/usage/checks#define-initial-health-check-status) are allowed to take on traffic. | "passing,warning" | no |
+| `providers.consulCatalog.tls.ca` | Defines the path to the certificate authority used for the secure connection to Consul Calatog, it defaults to the system bundle. | "" | No |
+| `providers.consulCatalog.tls.cert` | Defines the path to the public certificate used for the secure connection to Consul Calatog. When using this option, setting the `key` option is required. | "" | Yes |
+| `providers.consulCatalog.tls.key` | Defines the path to the private key used for the secure connection to Consul Catalog. When using this option, setting the `cert` option is required. | "" | Yes |
+| `providers.consulCatalog.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by Consul Catalog when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
+| `providers.consulCatalog.watch` | When set to `true`, watches for Consul changes ([Consul watches checks](https://www.consul.io/docs/dynamic-app-config/watches#checks)). | false | No |
### `requireConsistent`
@@ -112,6 +112,10 @@ created. If the expression is empty, all detected services are included.
The expression syntax is based on the ```Tag(`tag`)```, and ```TagRegex(`tag`)``` functions,
as well as the usual boolean logic, as shown in examples below.
+!!! tip "Constraints key limitations"
+
+ Note that `traefik.*` is a reserved label namespace for configuration and can not be used as a key for custom constraints.
+
??? example "Constraints Expression Examples"
```toml
@@ -162,7 +166,7 @@ providers:
# ...
```
-For additional information, refer to [Restrict the Scope of Service Discovery](../overview.md#restrict-the-scope-of-service-discovery).
+For additional information, refer to [Restrict the Scope of Service Discovery](../overview.md#exposedbydefault-and-traefikenable).
### `namespaces`
diff --git a/docs/content/reference/install-configuration/providers/hashicorp/consul.md b/docs/content/reference/install-configuration/providers/hashicorp/consul.md
index 01c29796f..1f72646ce 100644
--- a/docs/content/reference/install-configuration/providers/hashicorp/consul.md
+++ b/docs/content/reference/install-configuration/providers/hashicorp/consul.md
@@ -26,18 +26,18 @@ providers:
| Field | Description | Default | Required |
|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
-| `providers.consul.endpoints` | Defines the endpoint to access Consul. | "127.0.0.1:8500" | yes |
-| `providers.consul.rootKey` | Defines the root key of the configuration. | "traefik" | yes |
-| `providers.consul.namespaces` | Defines the namespaces to query. See [here](#namespaces) for more information | "" | no |
-| `providers.consul.username` | Defines a username to connect to Consul with. | "" | no |
-| `providers.consul.password` | Defines a password with which to connect to Consul. | "" | no |
-| `providers.consul.token` | Defines a token with which to connect to Consul. | "" | no |
-| `providers.consul.tls` | Defines the TLS configuration used for the secure connection to Consul | - | No |
-| `providers.consul.tls.ca` | Defines the path to the certificate authority used for the secure connection to Consul, it defaults to the system bundle. | - | Yes |
-| `providers.consul.tls.cert` | Defines the path to the public certificate used for the secure connection to Consul. When using this option, setting the `key` option is required. | - | Yes |
-| `providers.consul.tls.key` | Defines the path to the private key used for the secure connection to Consul. When using this option, setting the `cert` option is required. | - | Yes |
-| `providers.consul.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by Consul when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.consul.endpoints` | Defines the endpoint to access Consul. | "127.0.0.1:8500" | yes |
+| `providers.consul.rootKey` | Defines the root key of the configuration. | "traefik" | yes |
+| `providers.consul.namespaces` | Defines the namespaces to query. See [here](#namespaces) for more information | "" | no |
+| `providers.consul.username` | Defines a username to connect to Consul with. | "" | no |
+| `providers.consul.password` | Defines a password with which to connect to Consul. | "" | no |
+| `providers.consul.token` | Defines a token with which to connect to Consul. | "" | no |
+| `providers.consul.tls` | Defines the TLS configuration used for the secure connection to Consul | - | No |
+| `providers.consul.tls.ca` | Defines the path to the certificate authority used for the secure connection to Consul, it defaults to the system bundle. | - | Yes |
+| `providers.consul.tls.cert` | Defines the path to the public certificate used for the secure connection to Consul. When using this option, setting the `key` option is required. | - | Yes |
+| `providers.consul.tls.key` | Defines the path to the private key used for the secure connection to Consul. When using this option, setting the `cert` option is required. | - | Yes |
+| `providers.consul.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by Consul when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
### `namespaces`
diff --git a/docs/content/reference/install-configuration/providers/hashicorp/nomad.md b/docs/content/reference/install-configuration/providers/hashicorp/nomad.md
index 19608cd94..29ddc764e 100644
--- a/docs/content/reference/install-configuration/providers/hashicorp/nomad.md
+++ b/docs/content/reference/install-configuration/providers/hashicorp/nomad.md
@@ -39,25 +39,25 @@ service {
| Field | Description | Default | Required |
|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
-| `providers.nomad.namespaces` | Defines the namespaces in which the nomad services will be discovered.| "" | No |
-| `providers.nomad.refreshInterval` | Defines the polling interval. This option is ignored when the `watch` option is enabled | 15s | No |
-| `providers.nomad.watch` | Enables the watch mode to refresh the configuration on a per-event basis. | false | No |
-| `providers.nomad.throttleDuration` | Defines how often the provider is allowed to handle service events from Nomad. This option is only compatible when the `watch` option is enabled | 0s | No |
-| `providers.nomad.defaultRule` | The Default Host rule for all services. See [here](#defaultrule) for more information | ```"Host(`{{ normalize .Name }}`)"``` | No |
-| `providers.nomad.constraints` | Defines an expression that Traefik matches against the container labels to determine whether to create any route for that container. See [here](#constraints) for more information. | "" | No |
-| `providers.nomad.exposedByDefault` | Expose Nomad services by default in Traefik. If set to `false`, services that do not have a `traefik.enable=true` tag will be ignored from the resulting routing configuration. See [here](../overview.md#restrict-the-scope-of-service-discovery) for additional information | true | No |
-| `providers.nomad.allowEmptyServices` | Instructs the provider to create any [servers load balancer](../../../../routing/services/index.md#servers-load-balancer) defined for Docker containers regardless of the [healthiness](https://docs.docker.com/engine/reference/builder/#healthcheck) of the corresponding containers. | false | No |
-| `providers.nomad.prefix` | Defines the prefix for Nomad service tags defining Traefik labels. | `traefik` | yes |
-| `providers.nomad.stale` | Instructs Traefik to use stale consistency for Nomad service API reads. See [here](#stale) for more information | false | No |
-| `providers.nomad.endpoint.address` | Defines the Address of the Nomad server. | `http://127.0.0.1:4646` | No |
-| `providers.nomad.endpoint.token` | Defines a per-request ACL token if Nomad ACLs are enabled. See [here](#token) for more information | "" | No |
-| `providers.nomad.endpoint.endpointWaitTime` | Defines a duration for which a `watch` can block. If not provided, the agent default values will be used. | "" | No |
-| `providers.nomad.endpoint.tls` | Defines the TLS configuration used for the secure connection to the Nomad APi. | - | No |
-| `providers.nomad.endpoint.tls.ca` | Defines the path to the certificate authority used for the secure connection to the Nomad API, it defaults to the system bundle. | "" | No |
-| `providers.nomad.endpoint.tls.cert` | Defines the path to the public certificate used for the secure connection to the Nomad API. When using this option, setting the `key` option is required. | '" | Yes |
-| `providers.nomad.endpoint.tls.key` | Defines the path to the private key used for the secure connection to the Nomad API. When using this option, setting the `cert` option is required. | "" | Yes |
-| `providers.nomad.endpoint.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by Nomad when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.nomad.namespaces` | Defines the namespaces in which the nomad services will be discovered.| "" | No |
+| `providers.nomad.refreshInterval` | Defines the polling interval. This option is ignored when the `watch` option is enabled | 15s | No |
+| `providers.nomad.watch` | Enables the watch mode to refresh the configuration on a per-event basis. | false | No |
+| `providers.nomad.throttleDuration` | Defines how often the provider is allowed to handle service events from Nomad. This option is only compatible when the `watch` option is enabled | 0s | No |
+| `providers.nomad.defaultRule` | The Default Host rule for all services. See [here](#defaultrule) for more information | ```"Host(`{{ normalize .Name }}`)"``` | No |
+| `providers.nomad.constraints` | Defines an expression that Traefik matches against the container labels to determine whether to create any route for that container. See [here](#constraints) for more information. | "" | No |
+| `providers.nomad.exposedByDefault` | Expose Nomad services by default in Traefik. If set to `false`, services that do not have a `traefik.enable=true` tag will be ignored from the resulting routing configuration. See [here](../overview.md#exposedbydefault-and-traefikenable) for additional information | true | No |
+| `providers.nomad.allowEmptyServices` | Instructs the provider to create any [servers load balancer](../../../../routing/services/index.md#servers-load-balancer) defined for Docker containers regardless of the [healthiness](https://docs.docker.com/engine/reference/builder/#healthcheck) of the corresponding containers. | false | No |
+| `providers.nomad.prefix` | Defines the prefix for Nomad service tags defining Traefik labels. | `traefik` | yes |
+| `providers.nomad.stale` | Instructs Traefik to use stale consistency for Nomad service API reads. See [here](#stale) for more information | false | No |
+| `providers.nomad.endpoint.address` | Defines the Address of the Nomad server. | `http://127.0.0.1:4646` | No |
+| `providers.nomad.endpoint.token` | Defines a per-request ACL token if Nomad ACLs are enabled. See [here](#token) for more information | "" | No |
+| `providers.nomad.endpoint.endpointWaitTime` | Defines a duration for which a `watch` can block. If not provided, the agent default values will be used. | "" | No |
+| `providers.nomad.endpoint.tls` | Defines the TLS configuration used for the secure connection to the Nomad APi. | - | No |
+| `providers.nomad.endpoint.tls.ca` | Defines the path to the certificate authority used for the secure connection to the Nomad API, it defaults to the system bundle. | "" | No |
+| `providers.nomad.endpoint.tls.cert` | Defines the path to the public certificate used for the secure connection to the Nomad API. When using this option, setting the `key` option is required. | '" | Yes |
+| `providers.nomad.endpoint.tls.key` | Defines the path to the private key used for the secure connection to the Nomad API. When using this option, setting the `cert` option is required. | "" | Yes |
+| `providers.nomad.endpoint.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by Nomad when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
### `namespaces`
@@ -191,6 +191,10 @@ created. If the expression is empty, all detected services are included.
The expression syntax is based on the ```Tag(`tag`)```, and ```TagRegex(`tag`)``` functions,
as well as the usual boolean logic, as shown in examples below.
+!!! tip "Constraints key limitations"
+
+ Note that `traefik.*` is a reserved label namespace for configuration and can not be used as a key for custom constraints.
+
??? example "Constraints Expression Examples"
```toml
@@ -241,7 +245,7 @@ providers:
# ...
```
-For additional information, refer to [Restrict the Scope of Service Discovery](../overview.md#restrict-the-scope-of-service-discovery).
+For additional information, refer to [Restrict the Scope of Service Discovery](../overview.md#exposedbydefault-and-traefikenable).
## Routing Configuration
diff --git a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-crd.md b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-crd.md
index 6e787d206..50ea7ff2d 100644
--- a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-crd.md
+++ b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-crd.md
@@ -20,10 +20,10 @@ When you install Traefik without using the Helm Chart, or when you are upgrading
```bash
# Install Traefik Resource Definitions:
-kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.4/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
# Install RBAC for Traefik:
-kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.4/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml
```
## Configuration Example
@@ -54,19 +54,19 @@ providers:
| Field | Description | Default | Required |
|:------|:----------------------------------------------------------|:--------|:---------|
-| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
-| `providers.kubernetesCRD.endpoint` | Server endpoint URL.
More information [here](#endpoint). | "" | No |
-| `providers.kubernetesCRD.token` | Bearer token used for the Kubernetes client configuration. | "" | No |
-| `providers.kubernetesCRD.certAuthFilePath` | Path to the certificate authority file.
Used for the Kubernetes client configuration. | "" | No |
-| `providers.kubernetesCRD.namespaces` | Array of namespaces to watch.
If left empty, watch all namespaces. | [] | No |
-| `providers.kubernetesCRD.labelselector` | Allow filtering on specific resource objects only using label selectors.
Only to Traefik [Custom Resources](#list-of-resources) (they all must match the filter).
No effect on Kubernetes `Secrets`, `EndpointSlices` and `Services`.
See [label-selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) for details. | "" | No |
-| `providers.kubernetesCRD.ingressClass` | Value of `kubernetes.io/ingress.class` annotation that identifies resource objects to be processed.
If empty, resources missing the annotation, having an empty value, or the value `traefik` are processed. | "" | No |
-| `providers.kubernetesCRD.throttleDuration` | Minimum amount of time to wait between two Kubernetes events before producing a new configuration.
This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration.
If empty, every event is caught. | 0s | No |
-| `providers.kubernetesCRD.allowEmptyServices` | Allows creating a route to reach a service that has no endpoint available.
It allows Traefik to handle the requests and responses targeting this service (applying middleware or observability operations) before returning a `503` HTTP Status. | false | No |
-| `providers.kubernetesCRD.allowCrossNamespace` | Allows the `IngressRoutes` to reference resources in namespaces other than theirs. | false | No |
-| `providers.kubernetesCRD.allowExternalNameServices` | Allows the `IngressRoutes` to reference ExternalName services. | false | No |
-| `providers.kubernetesCRD.nativeLBByDefault` | Allow using the Kubernetes Service load balancing between the pods instead of the one provided by Traefik for every `IngressRoute` by default.
It can br overridden in the [`ServerTransport`](../../../../routing/services/index.md#serverstransport). | false | No |
-| `providers.kubernetesCRD.disableClusterScopeResources` | Prevent from discovering cluster scope resources (`IngressClass` and `Nodes`).
By doing so, it alleviates the requirement of giving Traefik the rights to look up for cluster resources.
Furthermore, Traefik will not handle IngressRoutes with IngressClass references, therefore such Ingresses will be ignored (please note that annotations are not affected by this option).
This will also prevent from using the `NodePortLB` options on services. | false | No |
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.kubernetesCRD.endpoint` | Server endpoint URL.
More information [here](#endpoint). | "" | No |
+| `providers.kubernetesCRD.token` | Bearer token used for the Kubernetes client configuration. | "" | No |
+| `providers.kubernetesCRD.certAuthFilePath` | Path to the certificate authority file.
Used for the Kubernetes client configuration. | "" | No |
+| `providers.kubernetesCRD.namespaces` | Array of namespaces to watch.
If left empty, watch all namespaces. | [] | No |
+| `providers.kubernetesCRD.labelselector` | Allow filtering on specific resource objects only using label selectors.
Only to Traefik [Custom Resources](#list-of-resources) (they all must match the filter).
No effect on Kubernetes `Secrets`, `EndpointSlices` and `Services`.
See [label-selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) for details. | "" | No |
+| `providers.kubernetesCRD.ingressClass` | Value of `kubernetes.io/ingress.class` annotation that identifies resource objects to be processed.
If empty, resources missing the annotation, having an empty value, or the value `traefik` are processed. | "" | No |
+| `providers.kubernetesCRD.throttleDuration` | Minimum amount of time to wait between two Kubernetes events before producing a new configuration.
This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration.
If empty, every event is caught. | 0s | No |
+| `providers.kubernetesCRD.allowEmptyServices` | Allows creating a route to reach a service that has no endpoint available.
It allows Traefik to handle the requests and responses targeting this service (applying middleware or observability operations) before returning a `503` HTTP Status. | false | No |
+| `providers.kubernetesCRD.allowCrossNamespace` | Allows the `IngressRoutes` to reference resources in namespaces other than theirs. | false | No |
+| `providers.kubernetesCRD.allowExternalNameServices` | Allows the `IngressRoutes` to reference ExternalName services. | false | No |
+| `providers.kubernetesCRD.nativeLBByDefault` | Allow using the Kubernetes Service load balancing between the pods instead of the one provided by Traefik for every `IngressRoute` by default.
It can br overridden in the [`ServerTransport`](../../../../routing/services/index.md#serverstransport). | false | No |
+| `providers.kubernetesCRD.disableClusterScopeResources` | Prevent from discovering cluster scope resources (`IngressClass` and `Nodes`).
By doing so, it alleviates the requirement of giving Traefik the rights to look up for cluster resources.
Furthermore, Traefik will not handle IngressRoutes with IngressClass references, therefore such Ingresses will be ignored (please note that annotations are not affected by this option).
This will also prevent from using the `NodePortLB` options on services. | false | No |
### endpoint
@@ -108,18 +108,18 @@ See the dedicated section in [routing](../../../../routing/providers/kubernetes-
-| Resource | Purpose |
-|--------------------------------------------------|--------------------------------------------------------------------|
-| [IngressRoute](../../../../routing/providers/kubernetes-crd.md#kind-ingressroute) | HTTP Routing |
-| [Middleware](../../../../middlewares/http/overview.md) | Tweaks the HTTP requests before they are sent to your service |
-| [TraefikService](../../../../routing/providers/kubernetes-crd.md#kind-traefikservice) | Abstraction for HTTP loadbalancing/mirroring |
-| [TLSOptions](../../../../routing/providers/kubernetes-crd.md#kind-tlsoption) | Allows configuring some parameters of the TLS connection |
-| [TLSStores](../../../../routing/providers/kubernetes-crd.md#kind-tlsstore) | Allows configuring the default TLS store |
-| [ServersTransport](../../../../routing/providers/kubernetes-crd.md#kind-serverstransport) | Allows configuring the transport between Traefik and the backends |
-| [IngressRouteTCP](../../../../routing/providers/kubernetes-crd.md#kind-ingressroutetcp) | TCP Routing |
-| [MiddlewareTCP](../../../../routing/providers/kubernetes-crd.md#kind-middlewaretcp) | Tweaks the TCP requests before they are sent to your service |
-| [ServersTransportTCP](../../../../routing/providers/kubernetes-crd.md#kind-serverstransporttc) | Allows configuring the transport between Traefik and the backends |
-| [IngressRouteUDP](../../../../routing/providers/kubernetes-crd.md#kind-ingressrouteudp) | UDP Routing |
+| Resource | Purpose |
+|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------|
+| [IngressRoute](../../../routing-configuration/kubernetes/crd/http/ingressroute.md) | HTTP Routing |
+| [Middleware](../../../routing-configuration/kubernetes/crd/http/middleware.md) | Tweaks the HTTP requests before they are sent to your service |
+| [TraefikService](../../../routing-configuration/kubernetes/crd/http/traefikservice.md) | Abstraction for HTTP loadbalancing/mirroring |
+| [TLSOptions](../../../routing-configuration/kubernetes/crd/tls/tlsoption.md) | Allows configuring some parameters of the TLS connection |
+| [TLSStores](../../../routing-configuration/kubernetes/crd/tls/tlsstore.md) | Allows configuring the default TLS store |
+| [ServersTransport](../../../routing-configuration/kubernetes/crd/http/serverstransport.md) | Allows configuring the transport between Traefik and the backends |
+| [IngressRouteTCP](../../../routing-configuration/kubernetes/crd/tcp/ingressroutetcp.md) | TCP Routing |
+| [MiddlewareTCP](../../../routing-configuration/kubernetes/crd/tcp/middlewaretcp.md) | Tweaks the TCP requests before they are sent to your service |
+| [ServersTransportTCP](../../../routing-configuration/kubernetes/crd/tcp/serverstransporttcp.md) | Allows configuring the transport between Traefik and the backends |
+| [IngressRouteUDP](../../../routing-configuration/kubernetes/crd/udp/ingressrouteudp.md) | UDP Routing |
## Particularities
diff --git a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-gateway.md b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-gateway.md
index 98b3f2add..bdbf04428 100644
--- a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-gateway.md
+++ b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-gateway.md
@@ -8,11 +8,11 @@ description: "Learn how to use the Kubernetes Gateway API as a provider for conf
The Kubernetes Gateway provider is a Traefik implementation of the [Gateway API](https://gateway-api.sigs.k8s.io/)
specification from the Kubernetes Special Interest Groups (SIGs).
-This provider supports Standard version [v1.2.1](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.2.1) of the Gateway API specification.
+This provider supports Standard version [v1.3.0](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.3.0) of the Gateway API specification.
It fully supports all HTTP core and some extended features, as well as the `TCPRoute` and `TLSRoute` resources from the [Experimental channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels).
-For more details, check out the conformance [report](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports/v1.2.1/traefik-traefik).
+For more details, check out the conformance [report](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports/v1.3.0/traefik-traefik).
!!! info "Using The Helm Chart"
@@ -27,14 +27,14 @@ For more details, check out the conformance [report](https://github.com/kubernet
```bash
# Install Gateway API CRDs from the Standard channel.
- kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/standard-install.yaml
+ kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
```
2. Install/update the Traefik [RBAC](../../../dynamic-configuration/kubernetes-gateway-rbac.yml).
```bash
# Install Traefik RBACs.
- kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.4/docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml
+ kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.5/docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml
```
## Configuration Example
@@ -69,19 +69,19 @@ providers:
| Field | Description | Default | Required |
|:----------------------------------------------------------------------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
-| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
-| `providers.kubernetesGateway.endpoint` | Server endpoint URL.
More information [here](#endpoint). | "" | No |
-| `providers.kubernetesGateway.experimentalChannel` | Toggles support for the Experimental Channel resources ([Gateway API release channels documentation](https://gateway-api.sigs.k8s.io/concepts/versioning/#release-channels)).
(ex: `TCPRoute` and `TLSRoute`) | false | No |
-| `providers.kubernetesGateway.token` | Bearer token used for the Kubernetes client configuration. | "" | No |
-| `providers.kubernetesGateway.certAuthFilePath` | Path to the certificate authority file.
Used for the Kubernetes client configuration. | "" | No |
-| `providers.kubernetesGateway.namespaces` | Array of namespaces to watch.
If left empty, watch all namespaces. | [] | No |
-| `providers.kubernetesGateway.labelselector` | Allow filtering on specific resource objects only using label selectors.
Only to Traefik [Custom Resources](./kubernetes-crd.md#list-of-resources) (they all must match the filter).
No effect on Kubernetes `Secrets`, `EndpointSlices` and `Services`.
See [label-selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) for details. | "" | No |
-| `providers.kubernetesGateway.throttleDuration` | Minimum amount of time to wait between two Kubernetes events before producing a new configuration.
This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration.
If empty, every event is caught. | 0s | No |
-| `providers.kubernetesGateway.nativeLBByDefault` | Defines whether to use Native Kubernetes load-balancing mode by default. For more information, please check out the `traefik.io/service.nativelb` service annotation documentation. | false | No |
-| `providers.kubernetesGateway.`
`statusAddress.hostname` | Hostname copied to the Gateway `status.addresses`. | "" | No |
-| `providers.kubernetesGateway.`
`statusAddress.ip` | IP address copied to the Gateway `status.addresses`, and currently only supports one IP value (IPv4 or IPv6). | "" | No |
-| `providers.kubernetesGateway.`
`statusAddress.service.namespace` | The namespace of the Kubernetes service to copy status addresses from.
When using third parties tools like External-DNS, this option can be used to copy the service `loadbalancer.status` (containing the service's endpoints IPs) to the Gateway `status.addresses`. | "" | No |
-| `providers.kubernetesGateway.`
`statusAddress.service.name` | The name of the Kubernetes service to copy status addresses from.
When using third parties tools like External-DNS, this option can be used to copy the service `loadbalancer.status` (containing the service's endpoints IPs) to the Gateway `status.addresses`. | "" | No |
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.kubernetesGateway.endpoint` | Server endpoint URL.
More information [here](#endpoint). | "" | No |
+| `providers.kubernetesGateway.experimentalChannel` | Toggles support for the Experimental Channel resources ([Gateway API release channels documentation](https://gateway-api.sigs.k8s.io/concepts/versioning/#release-channels)).
(ex: `TCPRoute` and `TLSRoute`) | false | No |
+| `providers.kubernetesGateway.token` | Bearer token used for the Kubernetes client configuration. | "" | No |
+| `providers.kubernetesGateway.certAuthFilePath` | Path to the certificate authority file.
Used for the Kubernetes client configuration. | "" | No |
+| `providers.kubernetesGateway.namespaces` | Array of namespaces to watch.
If left empty, watch all namespaces. | [] | No |
+| `providers.kubernetesGateway.labelselector` | Allow filtering on specific resource objects only using label selectors.
Only to Traefik [Custom Resources](./kubernetes-crd.md#list-of-resources) (they all must match the filter).
No effect on Kubernetes `Secrets`, `EndpointSlices` and `Services`.
See [label-selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) for details. | "" | No |
+| `providers.kubernetesGateway.throttleDuration` | Minimum amount of time to wait between two Kubernetes events before producing a new configuration.
This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration.
If empty, every event is caught. | 0s | No |
+| `providers.kubernetesGateway.nativeLBByDefault` | Defines whether to use Native Kubernetes load-balancing mode by default. For more information, please check out the `traefik.io/service.nativelb` service annotation documentation. | false | No |
+| `providers.kubernetesGateway.`
`statusAddress.hostname` | Hostname copied to the Gateway `status.addresses`. | "" | No |
+| `providers.kubernetesGateway.`
`statusAddress.ip` | IP address copied to the Gateway `status.addresses`, and currently only supports one IP value (IPv4 or IPv6). | "" | No |
+| `providers.kubernetesGateway.`
`statusAddress.service.namespace` | The namespace of the Kubernetes service to copy status addresses from.
When using third parties tools like External-DNS, this option can be used to copy the service `loadbalancer.status` (containing the service's endpoints IPs) to the Gateway `status.addresses`. | "" | No |
+| `providers.kubernetesGateway.`
`statusAddress.service.name` | The name of the Kubernetes service to copy status addresses from.
When using third parties tools like External-DNS, this option can be used to copy the service `loadbalancer.status` (containing the service's endpoints IPs) to the Gateway `status.addresses`. | "" | No |
diff --git a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md
new file mode 100644
index 000000000..2d9e93c1e
--- /dev/null
+++ b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md
@@ -0,0 +1,112 @@
+---
+title: "Traefik Kubernetes Ingress NGINX Documentation"
+description: "Understand the requirements, routing configuration, and how to set up the Kubernetes Ingress NGINX provider. Read the technical documentation."
+---
+
+# Traefik & Ingresses with NGINX Annotations
+
+The experimental Traefik Kubernetes Ingress NGINX provider is a Kubernetes Ingress controller; i.e,
+it manages access to cluster services by supporting the [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) specification.
+It also supports some of the [ingress-nginx](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/) annotations on ingresses to customize their behavior.
+
+!!! warning "Ingress Discovery"
+
+ The Kubernetes Ingress NGINX provider is discovering by default all Ingresses in the cluster,
+ which may lead to duplicated routers if you are also using the Kubernetes Ingress provider.
+ We recommend to use IngressClass for the Ingresses you want to be handled by this provider,
+ or to use the `watchNamespace` or `watchNamespaceSelector` options to limit the discovery of Ingresses to a specific namespace or set of namespaces.
+
+## Configuration Example
+
+As this provider is an experimental feature, it needs to be enabled in the experimental and in the provider sections of the configuration.
+You can enable the Kubernetes Ingress NGINX provider as detailed below:
+
+```yaml tab="File (YAML)"
+experimental:
+ kubernetesIngressNGINX: true
+
+providers:
+ kubernetesIngressNGINX: {}
+```
+
+```toml tab="File (TOML)"
+[experimental.kubernetesIngressNGINX]
+
+[providers.kubernetesIngressNGINX]
+```
+
+```bash tab="CLI"
+--experimental.kubernetesingressnginx=true
+--providers.kubernetesingressnginx=true
+```
+
+The provider then watches for incoming ingresses events, such as the example below,
+and derives the corresponding dynamic configuration from it,
+which in turn creates the resulting routers, services, handlers, etc.
+
+## Configuration Options
+
+
+| Field | Description | Default | Required |
+|:------------------------------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.kubernetesIngressNGINX.endpoint` | Server endpoint URL.
More information [here](#endpoint). | "" | No |
+| `providers.kubernetesIngressNGINX.token` | Bearer token used for the Kubernetes client configuration. | "" | No |
+| `providers.kubernetesIngressNGINX.certAuthFilePath` | Path to the certificate authority file.
Used for the Kubernetes client configuration. | "" | No |
+| `providers.kubernetesIngressNGINX.throttleDuration` | Minimum amount of time to wait between two Kubernetes events before producing a new configuration.
This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration.
If empty, every event is caught. | 0s | No |
+| `providers.kubernetesIngressNGINX.watchNamespace` | Namespace the controller watches for updates to Kubernetes objects. All namespaces are watched if this parameter is left empty. | "" | No |
+| `providers.kubernetesIngressNGINX.watchNamespaceSelector` | Selector selects namespaces the controller watches for updates to Kubernetes objects. | "" | No |
+| `providers.kubernetesIngressNGINX.ingressClass` | Name of the ingress class this controller satisfies. | "" | No |
+| `providers.kubernetesIngressNGINX.controllerClass` | Ingress Class Controller value this controller satisfies. | "" | No |
+| `providers.kubernetesIngressNGINX.watchIngressWithoutClass` | Define if Ingress Controller should also watch for Ingresses without an IngressClass or the annotation specified. | false | No |
+| `providers.kubernetesIngressNGINX.ingressClassByName` | Define if Ingress Controller should watch for Ingress Class by Name together with Controller Class. | false | No |
+| `providers.kubernetesIngressNGINX.publishService` | Service fronting the Ingress controller. Takes the form namespace/name. | "" | No |
+| `providers.kubernetesIngressNGINX.publishStatusAddress` | Customized address (or addresses, separated by comma) to set as the load-balancer status of Ingress objects this controller satisfies. | "" | No |
+| `providers.kubernetesIngressNGINX.defaultBackendService` | Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form 'namespace/name'. | "" | No |
+| `providers.kubernetesIngressNGINX.disableSvcExternalName` | Disable support for Services of type ExternalName. | false | No |
+
+
+
+### `endpoint`
+
+The Kubernetes server endpoint URL.
+
+When deployed into Kubernetes, Traefik reads the environment variables `KUBERNETES_SERVICE_HOST`
+and `KUBERNETES_SERVICE_PORT` or `KUBECONFIG` to construct the endpoint.
+
+The access token is looked up in `/var/run/secrets/kubernetes.io/serviceaccount/token`
+and the SSL CA certificate in `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`.
+Both are mounted automatically when deployed inside Kubernetes.
+
+The endpoint may be specified to override the environment variable values inside
+a cluster.
+
+When the environment variables are not found, Traefik tries to connect to the
+Kubernetes API server with an external-cluster client.
+
+In this case, the endpoint is required.
+Specifically, it may be set to the URL used by `kubectl proxy` to connect to a Kubernetes
+cluster using the granted authentication and authorization of the associated kubeconfig.
+
+```yaml tab="File (YAML)"
+providers:
+ kubernetesIngressNGINX:
+ endpoint: "http://localhost:8080"
+ # ...
+```
+
+```toml tab="File (TOML)"
+[providers.kubernetesIngressNGINX]
+ endpoint = "http://localhost:8080"
+ # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetesingressnginx.endpoint=http://localhost:8080
+```
+
+## Routing Configuration
+
+See the dedicated section in [routing](../../../routing-configuration/kubernetes/ingress-nginx.md).
+
+{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress.md b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress.md
index adf102e64..5ac53b269 100644
--- a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress.md
+++ b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress.md
@@ -3,11 +3,16 @@ title: "Traefik Kubernetes Ingress Documentation"
description: "Understand the requirements, routing configuration, and how to set up Traefik Proxy as your Kubernetes Ingress Controller. Read the technical documentation."
---
-# Traefik & Kubernetes
+# Traefik & Kubernetes
The Traefik Kubernetes Ingress provider is a Kubernetes Ingress controller; i.e,
it manages access to cluster services by supporting the [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) specification.
+??? warning "Ingress Backend Resource not supported"
+
+ Referencing backend service endpoints using [`spec.rules.http.paths.backend.resource`](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressBackend) is not supported.
+ Use `spec.rules.http.paths.backend.service` instead.
+
## Configuration Example
You can enable the `kubernetesIngress` provider as detailed below:
@@ -37,27 +42,29 @@ and derives the corresponding dynamic configuration from it,
which in turn creates the resulting routers, services, handlers, etc.
## Configuration Options
+
-| Field | Description | Default | Required |
-|:-----------------------------------------------------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
-| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
-| `providers.kubernetesIngress.endpoint` | Server endpoint URL.
More information [here](#endpoint). | "" | No |
-| `providers.kubernetesIngress.token` | Bearer token used for the Kubernetes client configuration. | "" | No |
-| `providers.kubernetesIngress.certAuthFilePath` | Path to the certificate authority file.
Used for the Kubernetes client configuration. | "" | No |
-| `providers.kubernetesCRD.namespaces` | Array of namespaces to watch.
If left empty, watch all namespaces. | | No |
-| `providers.kubernetesIngress.labelselector` | Allow filtering on Ingress objects using label selectors.
No effect on Kubernetes `Secrets`, `EndpointSlices` and `Services`.
See [label-selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) for details. | "" | No |
-| `providers.kubernetesIngress.ingressClass` | The `IngressClass` resource name or the `kubernetes.io/ingress.class` annotation value that identifies resource objects to be processed.
If empty, resources missing the annotation, having an empty value, or the value `traefik` are processed. | "" | No |
-| `providers.kubernetesIngress.disableIngressClassLookup` | Prevent to discover IngressClasses in the cluster.
It alleviates the requirement of giving Traefik the rights to look IngressClasses up.
Ignore Ingresses with IngressClass.
Annotations are not affected by this option. | false | No |
-| `providers.kubernetesIngress.`
`ingressEndpoint.hostname` | Hostname used for Kubernetes Ingress endpoints. | "" | No |
-| `providers.kubernetesIngress.`
`ingressEndpoint.ip` | This IP will get copied to the Ingress `status.loadbalancer.ip`, and currently only supports one IP value (IPv4 or IPv6). | "" | No |
-| `providers.kubernetesIngress.`
`ingressEndpoint.publishedService` | The Kubernetes service to copy status from.
More information [here](#ingressendpointpublishedservice). | "" | No |
-| `providers.kubernetesIngress.throttleDuration` | Minimum amount of time to wait between two Kubernetes events before producing a new configuration.
This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration.
If empty, every event is caught. | 0s | No |
-| `providers.kubernetesIngress.allowEmptyServices` | Allows creating a route to reach a service that has no endpoint available.
It allows Traefik to handle the requests and responses targeting this service (applying middleware or observability operations) before returning a `503` HTTP Status. | false | No |
-| `providers.kubernetesIngress.allowCrossNamespace` | Allows the `Ingress` to reference resources in namespaces other than theirs. | false | No |
-| `providers.kubernetesIngress.allowExternalNameServices` | Allows the `Ingress` to reference ExternalName services. | false | No |
-| `providers.kubernetesIngress.nativeLBByDefault` | Allow using the Kubernetes Service load balancing between the pods instead of the one provided by Traefik for every `Ingress` by default.
It can br overridden in the [`ServerTransport`](../../../../routing/services/index.md#serverstransport). | false | No |
-| `providers.kubernetesIngress.disableClusterScopeResources` | Prevent from discovering cluster scope resources (`IngressClass` and `Nodes`).
By doing so, it alleviates the requirement of giving Traefik the rights to look up for cluster resources.
Furthermore, Traefik will not handle Ingresses with IngressClass references, therefore such Ingresses will be ignored (please note that annotations are not affected by this option).
This will also prevent from using the `NodePortLB` options on services. | false | No |
+| Field | Description | Default | Required |
+| :------------------------------------------------------------------ | :------------- | :------ | :------- |
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.kubernetesIngress.endpoint` | Server endpoint URL.
More information [here](#endpoint). | "" | No |
+| `providers.kubernetesIngress.token` | Bearer token used for the Kubernetes client configuration. | "" | No |
+| `providers.kubernetesIngress.certAuthFilePath` | Path to the certificate authority file.
Used for the Kubernetes client configuration. | "" | No |
+| `providers.kubernetesIngress.namespaces` | Array of namespaces to watch.
If left empty, watch all namespaces. | | No |
+| `providers.kubernetesIngress.labelselector` | Allow filtering on Ingress objects using label selectors.
No effect on Kubernetes `Secrets`, `EndpointSlices` and `Services`.
See [label-selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) for details. | "" | No |
+| `providers.kubernetesIngress.ingressClass` | The `IngressClass` resource name or the `kubernetes.io/ingress.class` annotation value that identifies resource objects to be processed.
If empty, resources missing the annotation, having an empty value, or the value `traefik` are processed. | "" | No |
+| `providers.kubernetesIngress.disableIngressClassLookup` | Prevent to discover IngressClasses in the cluster.
It alleviates the requirement of giving Traefik the rights to look IngressClasses up.
Ignore Ingresses with IngressClass.
Annotations are not affected by this option. | false | No |
+| `providers.kubernetesIngress.`
`ingressEndpoint.hostname` | Hostname used for Kubernetes Ingress endpoints. | "" | No |
+| `providers.kubernetesIngress.`
`ingressEndpoint.ip` | This IP will get copied to the Ingress `status.loadbalancer.ip`, and currently only supports one IP value (IPv4 or IPv6). | "" | No |
+| `providers.kubernetesIngress.`
`ingressEndpoint.publishedService` | The Kubernetes service to copy status from.
More information [here](#ingressendpointpublishedservice). | "" | No |
+| `providers.kubernetesIngress.throttleDuration` | Minimum amount of time to wait between two Kubernetes events before producing a new configuration.
This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration.
If empty, every event is caught. | 0s | No |
+| `providers.kubernetesIngress.allowEmptyServices` | Allows creating a route to reach a service that has no endpoint available.
It allows Traefik to handle the requests and responses targeting this service (applying middleware or observability operations) before returning a `503` HTTP Status. | false | No |
+| `providers.kubernetesIngress.allowCrossNamespace` | Allows the `Ingress` to reference resources in namespaces other than theirs. | false | No |
+| `providers.kubernetesIngress.allowExternalNameServices` | Allows the `Ingress` to reference ExternalName services. | false | No |
+| `providers.kubernetesIngress.nativeLBByDefault` | Allow using the Kubernetes Service load balancing between the pods instead of the one provided by Traefik for every `Ingress` by default.
It can br overridden in the [`ServerTransport`](../../../../routing/services/index.md#serverstransport). | false | No |
+| `providers.kubernetesIngress.disableClusterScopeResources` | Prevent from discovering cluster scope resources (`IngressClass` and `Nodes`).
By doing so, it alleviates the requirement of giving Traefik the rights to look up for cluster resources.
Furthermore, Traefik will not handle Ingresses with IngressClass references, therefore such Ingresses will be ignored (please note that annotations are not affected by this option).
This will also prevent from using the `NodePortLB` options on services. | false | No |
+| `providers.kubernetesIngress.strictPrefixMatching` | Make prefix matching strictly comply with the Kubernetes Ingress specification (path-element-wise matching instead of character-by-character string matching). For example, a PathPrefix of `/foo` will match `/foo`, `/foo/`, and `/foo/bar` but not `/foobar`. | false | No |
@@ -75,7 +82,7 @@ Both are mounted automatically when deployed inside Kubernetes.
The endpoint may be specified to override the environment variable values inside
a cluster.
-When the environment variables are not found, Traefik tries to connect to the
+When the environment variables are not found, Traefik tries to connect to the
Kubernetes API server with an external-cluster client.
In this case, the endpoint is required.
@@ -99,7 +106,7 @@ providers:
--providers.kubernetesingress.endpoint=http://localhost:8080
```
-### `ingressEndpoint.publishedService`
+### `ingressEndpoint.publishedService`
Format: `namespace/servicename`.
@@ -130,17 +137,16 @@ providers:
--providers.kubernetesingress.ingressendpoint.publishedservice=namespace/foo-service
```
-
## Routing Configuration
See the dedicated section in [routing](../../../../routing/providers/kubernetes-ingress.md).
## Further
-To learn more about the various aspects of the Ingress specification that
+To learn more about the various aspects of the Ingress specification that
Traefik supports,
-many examples of Ingresses definitions are located in the test
-[examples](https://github.com/traefik/traefik/tree/v3.1/pkg/provider/kubernetes/ingress/fixtures)
+many examples of Ingresses definitions are located in the test
+[examples](https://github.com/traefik/traefik/tree/v3.1/pkg/provider/kubernetes/ingress/fixtures)
of the Traefik repository.
{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/install-configuration/providers/kv/etcd.md b/docs/content/reference/install-configuration/providers/kv/etcd.md
index b5e80e6b6..9cc848604 100644
--- a/docs/content/reference/install-configuration/providers/kv/etcd.md
+++ b/docs/content/reference/install-configuration/providers/kv/etcd.md
@@ -26,16 +26,16 @@ providers:
| Field | Description | Default | Required |
|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
-| `providers.etcd.endpoints` | Defines the endpoint to access etcd. | "127.0.0.1:2379" | Yes |
-| `providers.etcd.rootKey` | Defines the root key for the configuration. | "traefik" | Yes |
-| `providers.etcd.username` | Defines a username with which to connect to etcd. | "" | No |
-| `providers.etcd.password` | Defines a password for connecting to etcd. | "" | No |
-| `providers.etcd.tls` | Defines the TLS configuration used for the secure connection to etcd. | - | No |
-| `providers.etcd.tls.ca` | Defines the path to the certificate authority used for the secure connection to etcd, it defaults to the system bundle. | "" | No |
-| `providers.etcd.tls.cert` | Defines the path to the public certificate used for the secure connection to etcd. When using this option, setting the `key` option is required. | "" | Yes |
-| `providers.etcd.tls.key` | Defines the path to the private key used for the secure connection to etcd. When using this option, setting the `cert` option is required. | "" | Yes |
-| `providers.etcd.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by etcd when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.etcd.endpoints` | Defines the endpoint to access etcd. | "127.0.0.1:2379" | Yes |
+| `providers.etcd.rootKey` | Defines the root key for the configuration. | "traefik" | Yes |
+| `providers.etcd.username` | Defines a username with which to connect to etcd. | "" | No |
+| `providers.etcd.password` | Defines a password for connecting to etcd. | "" | No |
+| `providers.etcd.tls` | Defines the TLS configuration used for the secure connection to etcd. | - | No |
+| `providers.etcd.tls.ca` | Defines the path to the certificate authority used for the secure connection to etcd, it defaults to the system bundle. | "" | No |
+| `providers.etcd.tls.cert` | Defines the path to the public certificate used for the secure connection to etcd. When using this option, setting the `key` option is required. | "" | Yes |
+| `providers.etcd.tls.key` | Defines the path to the private key used for the secure connection to etcd. When using this option, setting the `cert` option is required. | "" | Yes |
+| `providers.etcd.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by etcd when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
## Routing Configuration
diff --git a/docs/content/reference/install-configuration/providers/kv/redis.md b/docs/content/reference/install-configuration/providers/kv/redis.md
index 40c91bfbc..ae5f25b18 100644
--- a/docs/content/reference/install-configuration/providers/kv/redis.md
+++ b/docs/content/reference/install-configuration/providers/kv/redis.md
@@ -26,25 +26,25 @@ providers:
| Field | Description | Default | Required |
|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
-| `providers.redis.endpoints` | Defines the endpoint to access Redis. | "127.0.0.1:6379" | Yes |
-| `providers.redis.rootKey` | Defines the root key for the configuration. | "traefik" | Yes |
-| `providers.redis.username` | Defines a username for connecting to Redis. | "" | No |
-| `providers.redis.password` | Defines a password for connecting to Redis. | "" | No |
-| `providers.redis.db` | Defines the database to be selected after connecting to the Redis. | 0 | No |
-| `providers.redis.tls` | Defines the TLS configuration used for the secure connection to Redis. | - | No |
-| `providers.redis.tls.ca` | Defines the path to the certificate authority used for the secure connection to Redis, it defaults to the system bundle. | "" | No |
-| `providers.redis.tls.cert` | Defines the path to the public certificate used for the secure connection to Redis. When using this option, setting the `key` option is required. | "" | Yes |
-| `providers.redis.tls.key` | Defines the path to the private key used for the secure connection to Redis. When using this option, setting the `cert` option is required. | "" | Yes |
-| `providers.redis.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by Redis when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
-| `providers.redis.sentinel` | Defines the Sentinel configuration used to interact with Redis Sentinel. | - | No |
-| `providers.redis.sentinel.masterName` | Defines the name of the Sentinel master. | "" | Yes |
-| `providers.redis.sentinel.username` | Defines the username for Sentinel authentication. | "" | No |
-| `providers.redis.sentinel.password` | Defines the password for Sentinel authentication. | "" | No |
-| `providers.redis.sentinel.latencyStrategy` | Defines whether to route commands to the closest master or replica nodes (mutually exclusive with RandomStrategy and ReplicaStrategy). | false | No |
-| `providers.redis.sentinel.randomStrategy` | Defines whether to route commands randomly to master or replica nodes (mutually exclusive with LatencyStrategy and ReplicaStrategy). | false | No |
-| `providers.redis.sentinel.replicaStrategy` | Defines whether to route commands randomly to master or replica nodes (mutually exclusive with LatencyStrategy and ReplicaStrategy). | false | No |
-| `providers.redis.sentinel.useDisconnectedReplicas` | Defines whether to use replicas disconnected with master when cannot get connected replicas. | false | false |
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.redis.endpoints` | Defines the endpoint to access Redis. | "127.0.0.1:6379" | Yes |
+| `providers.redis.rootKey` | Defines the root key for the configuration. | "traefik" | Yes |
+| `providers.redis.username` | Defines a username for connecting to Redis. | "" | No |
+| `providers.redis.password` | Defines a password for connecting to Redis. | "" | No |
+| `providers.redis.db` | Defines the database to be selected after connecting to the Redis. | 0 | No |
+| `providers.redis.tls` | Defines the TLS configuration used for the secure connection to Redis. | - | No |
+| `providers.redis.tls.ca` | Defines the path to the certificate authority used for the secure connection to Redis, it defaults to the system bundle. | "" | No |
+| `providers.redis.tls.cert` | Defines the path to the public certificate used for the secure connection to Redis. When using this option, setting the `key` option is required. | "" | Yes |
+| `providers.redis.tls.key` | Defines the path to the private key used for the secure connection to Redis. When using this option, setting the `cert` option is required. | "" | Yes |
+| `providers.redis.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by Redis when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
+| `providers.redis.sentinel` | Defines the Sentinel configuration used to interact with Redis Sentinel. | - | No |
+| `providers.redis.sentinel.masterName` | Defines the name of the Sentinel master. | "" | Yes |
+| `providers.redis.sentinel.username` | Defines the username for Sentinel authentication. | "" | No |
+| `providers.redis.sentinel.password` | Defines the password for Sentinel authentication. | "" | No |
+| `providers.redis.sentinel.latencyStrategy` | Defines whether to route commands to the closest master or replica nodes (mutually exclusive with RandomStrategy and ReplicaStrategy). | false | No |
+| `providers.redis.sentinel.randomStrategy` | Defines whether to route commands randomly to master or replica nodes (mutually exclusive with LatencyStrategy and ReplicaStrategy). | false | No |
+| `providers.redis.sentinel.replicaStrategy` | Defines whether to route commands randomly to master or replica nodes (mutually exclusive with LatencyStrategy and ReplicaStrategy). | false | No |
+| `providers.redis.sentinel.useDisconnectedReplicas` | Defines whether to use replicas disconnected with master when cannot get connected replicas. | false | false |
## Routing Configuration
diff --git a/docs/content/reference/install-configuration/providers/kv/zk.md b/docs/content/reference/install-configuration/providers/kv/zk.md
index 38042a1a9..b77e5a23d 100644
--- a/docs/content/reference/install-configuration/providers/kv/zk.md
+++ b/docs/content/reference/install-configuration/providers/kv/zk.md
@@ -26,16 +26,16 @@ providers:
| Field | Description | Default | Required |
|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
-| `providers.zooKeeper.endpoints` | Defines the endpoint to access ZooKeeper. | "127.0.0.1:2181" | Yes |
-| `providers.zooKeeper.rootKey` | Defines the root key for the configuration. | "traefik" | Yes |
-| `providers.zooKeeper.username` | Defines a username with which to connect to zooKeeper. | "" | No |
-| `providers.zooKeeper.password` | Defines a password for connecting to zooKeeper. | "" | No |
-| `providers.zooKeeper.tls` | Defines the TLS configuration used for the secure connection to zooKeeper. | - | No |
-| `providers.zooKeeper.tls.ca` | Defines the path to the certificate authority used for the secure connection to zooKeeper, it defaults to the system bundle. | "" | No |
-| `providers.zooKeeper.tls.cert` | Defines the path to the public certificate used for the secure connection to zooKeeper. When using this option, setting the `key` option is required. | "" | Yes |
-| `providers.zooKeeper.tls.key` | Defines the path to the private key used for the secure connection to zooKeeper. When using this option, setting the `cert` option is required. | "" | Yes |
-| `providers.zooKeeper.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by etcd when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.zooKeeper.endpoints` | Defines the endpoint to access ZooKeeper. | "127.0.0.1:2181" | Yes |
+| `providers.zooKeeper.rootKey` | Defines the root key for the configuration. | "traefik" | Yes |
+| `providers.zooKeeper.username` | Defines a username with which to connect to zooKeeper. | "" | No |
+| `providers.zooKeeper.password` | Defines a password for connecting to zooKeeper. | "" | No |
+| `providers.zooKeeper.tls` | Defines the TLS configuration used for the secure connection to zooKeeper. | - | No |
+| `providers.zooKeeper.tls.ca` | Defines the path to the certificate authority used for the secure connection to zooKeeper, it defaults to the system bundle. | "" | No |
+| `providers.zooKeeper.tls.cert` | Defines the path to the public certificate used for the secure connection to zooKeeper. When using this option, setting the `key` option is required. | "" | Yes |
+| `providers.zooKeeper.tls.key` | Defines the path to the private key used for the secure connection to zooKeeper. When using this option, setting the `cert` option is required. | "" | Yes |
+| `providers.zooKeeper.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by etcd when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
## Routing Configuration
diff --git a/docs/content/reference/install-configuration/providers/others/ecs.md b/docs/content/reference/install-configuration/providers/others/ecs.md
index f6aeb2731..2cca65977 100644
--- a/docs/content/reference/install-configuration/providers/others/ecs.md
+++ b/docs/content/reference/install-configuration/providers/others/ecs.md
@@ -26,18 +26,18 @@ providers:
| Field | Description | Default | Required |
|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
-| `providers.ecs.autoDiscoverClusters` | Search for services in cluster list. If set to `true` service discovery is enabled for all clusters. | false | No |
-| `providers.ecs.ecsAnywhere` | Enable ECS Anywhere support. | false | No |
-| `providers.ecs.clusters` | Search for services in cluster list. This option is ignored if `autoDiscoverClusters` is set to `true`. | `["default"]` | No |
-| `providers.ecs.exposedByDefault` | Expose ECS services by default in Traefik. | true | No |
-| `providers.ecs.constraints` | Defines an expression that Traefik matches against the container labels to determine whether to create any route for that container. See [here](#constraints) for more information. | true | No |
-| `providers.ecs.healthyTasksOnly` | Defines whether Traefik discovers only healthy tasks (`HEALTHY` healthStatus). | false | No |
-| `providers.ecs.defaultRule` | The Default Host rule for all services. See [here](#defaultrule) for more information. | ```"Host(`{{ normalize .Name }}`)"``` | No |
-| `providers.ecs.refreshSeconds` | Defines the polling interval (in seconds). | 15 | No |
-| `providers.ecs.region` | Defines the region of the ECS instance. See [here](#credentials) for more information. | "" | No |
-| `providers.ecs.accessKeyID` | Defines the Access Key ID for the ECS instance. See [here](#credentials) for more information. | "" | No |
-| `providers.ecs.secretAccessKey` | Defines the Secret Access Key for the ECS instance. See [here](#credentials) for more information. | "" | No |
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.ecs.autoDiscoverClusters` | Search for services in cluster list. If set to `true` service discovery is enabled for all clusters. | false | No |
+| `providers.ecs.ecsAnywhere` | Enable ECS Anywhere support. | false | No |
+| `providers.ecs.clusters` | Search for services in cluster list. This option is ignored if `autoDiscoverClusters` is set to `true`. | `["default"]` | No |
+| `providers.ecs.exposedByDefault` | Expose ECS services by default in Traefik. | true | No |
+| `providers.ecs.constraints` | Defines an expression that Traefik matches against the container labels to determine whether to create any route for that container. See [here](#constraints) for more information. | true | No |
+| `providers.ecs.healthyTasksOnly` | Defines whether Traefik discovers only healthy tasks (`HEALTHY` healthStatus). | false | No |
+| `providers.ecs.defaultRule` | The Default Host rule for all services. See [here](#defaultrule) for more information. | ```"Host(`{{ normalize .Name }}`)"``` | No |
+| `providers.ecs.refreshSeconds` | Defines the polling interval (in seconds). | 15 | No |
+| `providers.ecs.region` | Defines the region of the ECS instance. See [here](#credentials) for more information. | "" | No |
+| `providers.ecs.accessKeyID` | Defines the Access Key ID for the ECS instance. See [here](#credentials) for more information. | "" | No |
+| `providers.ecs.secretAccessKey` | Defines the Secret Access Key for the ECS instance. See [here](#credentials) for more information. | "" | No |
### `constraints`
@@ -49,6 +49,10 @@ If the expression is empty, all detected containers are included.
The expression syntax is based on the `Label("key", "value")`, and `LabelRegex("key", "value")` functions,
as well as the usual boolean logic, as shown in examples below.
+!!! tip "Constraints key limitations"
+
+ Note that `traefik.*` is a reserved label namespace for configuration and can not be used as a key for custom constraints.
+
??? example "Constraints Expression Examples"
```toml
@@ -99,7 +103,7 @@ providers:
# ...
```
-For additional information, refer to [Restrict the Scope of Service Discovery](../overview.md#restrict-the-scope-of-service-discovery).
+For additional information, refer to [Restrict the Scope of Service Discovery](../overview.md#exposedbydefault-and-traefikenable).
### `defaultRule`
diff --git a/docs/content/reference/install-configuration/providers/others/file.md b/docs/content/reference/install-configuration/providers/others/file.md
index 6d4fad6d2..737c7a65c 100644
--- a/docs/content/reference/install-configuration/providers/others/file.md
+++ b/docs/content/reference/install-configuration/providers/others/file.md
@@ -100,10 +100,10 @@ http:
| Field | Description | Default | Required |
|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
-| `providers.file.filename` | Defines the path to the configuration file. | "" | Yes |
-| `providers.file.directory` | Defines the path to the directory that contains the configuration files. The `filename` and `directory` options are mutually exclusive. It is recommended to use `directory`. | "" | Yes |
-| `providers.file.watch` | Set the `watch` option to `true` to allow Traefik to automatically watch for file changes. It works with both the `filename` and the `directory` options. | true | No |
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.file.filename` | Defines the path to the configuration file. | "" | Yes |
+| `providers.file.directory` | Defines the path to the directory that contains the configuration files. The `filename` and `directory` options are mutually exclusive. It is recommended to use `directory`. | "" | Yes |
+| `providers.file.watch` | Set the `watch` option to `true` to allow Traefik to automatically watch for file changes. It works with both the `filename` and the `directory` options. | true | No |
!!! warning "Limitations"
diff --git a/docs/content/reference/install-configuration/providers/others/http.md b/docs/content/reference/install-configuration/providers/others/http.md
index 4ac29b6fe..9e67df2e3 100644
--- a/docs/content/reference/install-configuration/providers/others/http.md
+++ b/docs/content/reference/install-configuration/providers/others/http.md
@@ -30,15 +30,15 @@ providers:
| Field | Description | Default | Required |
|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
-| `providers.http.endpoint` | Defines the HTTP(S) endpoint to poll. | "" | Yes |
-| `providers.http.pollInterval` | Defines the polling interval. | 5s | No |
-| `providers.http.pollTimeout` | Defines the polling timeout when connecting to the endpoint. | 5s | No |
-| `providers.http.headers` | Defines custom headers to be sent to the endpoint. | "" | No |
-| `providers.http.tls.ca` | Defines the path to the certificate authority used for the secure connection to the endpoint, it defaults to the system bundle. | "" | No |
-| `providers.http.tls.cert` | Defines the path to the public certificate used for the secure connection to the endpoint. When using this option, setting the `key` option is required. | "" | Yes |
-| `providers.http.tls.key` | Defines the path to the private key used for the secure connection to the endpoint. When using this option, setting the `cert` option is required. | "" | Yes |
-| `providers.http.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by endpoint when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.http.endpoint` | Defines the HTTP(S) endpoint to poll. | "" | Yes |
+| `providers.http.pollInterval` | Defines the polling interval. | 5s | No |
+| `providers.http.pollTimeout` | Defines the polling timeout when connecting to the endpoint. | 5s | No |
+| | Defines custom headers to be sent to the endpoint. | "" | No |
+| `providers.http.tls.ca` | Defines the path to the certificate authority used for the secure connection to the endpoint, it defaults to the system bundle. | "" | No |
+| `providers.http.tls.cert` | Defines the path to the public certificate used for the secure connection to the endpoint. When using this option, setting the `key` option is required. | "" | Yes |
+| `providers.http.tls.key` | Defines the path to the private key used for the secure connection to the endpoint. When using this option, setting the `cert` option is required. | "" | Yes |
+| `providers.http.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by endpoint when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
### headers
diff --git a/docs/content/reference/install-configuration/providers/overview.md b/docs/content/reference/install-configuration/providers/overview.md
index 3edc93471..5253f57a0 100644
--- a/docs/content/reference/install-configuration/providers/overview.md
+++ b/docs/content/reference/install-configuration/providers/overview.md
@@ -51,20 +51,20 @@ Below is the list of the currently supported providers in Traefik.
| Provider | Type | Configuration Type | Provider Name |
|--------------------------------------------------------------|--------------|----------------------|---------------------|
-| [Docker](./docker.md) | Orchestrator | Label | `docker` |
-| [Docker Swarm](./swarm.md) | Orchestrator | Label | `swarm` |
-| [Kubernetes IngressRoute](./kubernetes/kubernetes-crd.md) | Orchestrator | Custom Resource | `kubernetescrd` |
-| [Kubernetes Ingress](./kubernetes/kubernetes-ingress.md) | Orchestrator | Ingress | `kubernetes` |
-| [Kubernetes Gateway API](./kubernetes/kubernetes-gateway.md) | Orchestrator | Gateway API Resource | `kubernetesgateway` |
-| [Consul Catalog](./hashicorp/consul-catalog.md) | Orchestrator | Label | `consulcatalog` |
-| [Nomad](./hashicorp/nomad.md) | Orchestrator | Label | `nomad` |
-| [ECS](./others/ecs.md) | Orchestrator | Label | `ecs` |
-| [File](./others/file.md) | Manual | YAML/TOML format | `file` |
-| [Consul](./hashicorp/consul.md) | KV | KV | `consul` |
-| [Etcd](./kv/etcd.md) | KV | KV | `etcd` |
-| [ZooKeeper](./kv/zk.md) | KV | KV | `zookeeper` |
-| [Redis](./kv/redis.md) | KV | KV | `redis` |
-| [HTTP](./others/http.md) | Manual | JSON/YAML format | `http` |
+| [Docker](./docker.md) | Orchestrator | Label | `docker` |
+| [Docker Swarm](./swarm.md) | Orchestrator | Label | `swarm` |
+| [Kubernetes IngressRoute](./kubernetes/kubernetes-crd.md) | Orchestrator | Custom Resource | `kubernetescrd` |
+| [Kubernetes Ingress](./kubernetes/kubernetes-ingress.md) | Orchestrator | Ingress | `kubernetes` |
+| [Kubernetes Gateway API](./kubernetes/kubernetes-gateway.md) | Orchestrator | Gateway API Resource | `kubernetesgateway` |
+| [Consul Catalog](./hashicorp/consul-catalog.md) | Orchestrator | Label | `consulcatalog` |
+| [Nomad](./hashicorp/nomad.md) | Orchestrator | Label | `nomad` |
+| [ECS](./others/ecs.md) | Orchestrator | Label | `ecs` |
+| [File](./others/file.md) | Manual | YAML/TOML format | `file` |
+| [Consul](./hashicorp/consul.md) | KV | KV | `consul` |
+| [Etcd](./kv/etcd.md) | KV | KV | `etcd` |
+| [ZooKeeper](./kv/zk.md) | KV | KV | `zookeeper` |
+| [Redis](./kv/redis.md) | KV | KV | `redis` |
+| [HTTP](./others/http.md) | Manual | JSON/YAML format | `http` |
!!! info "More Providers"
diff --git a/docs/content/reference/install-configuration/providers/swarm.md b/docs/content/reference/install-configuration/providers/swarm.md
index becfdd577..8f876dfd2 100644
--- a/docs/content/reference/install-configuration/providers/swarm.md
+++ b/docs/content/reference/install-configuration/providers/swarm.md
@@ -33,7 +33,6 @@ When there is only one service, and the router does not specify a service,
then that service is automatically assigned to the router.
```yaml tab="Labels"
-version: "3"
services:
my-container:
deploy:
@@ -44,25 +43,25 @@ services:
## Configuration Options
-| Field | Description | Default | Required |
-|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
-| `providers.swarm.endpoint` | Specifies the Docker API endpoint. See [here](#endpoint) for more information| `unix:///var/run/docker.sock` | Yes |
-| `providers.swarm.username` | Defines the username for Basic HTTP authentication. This should be used when the Docker daemon socket is exposed through an HTTP proxy that requires Basic HTTP authentication.| "" | No |
-| `providers.swarm.password` | Defines the password for Basic HTTP authentication. This should be used when the Docker daemon socket is exposed through an HTTP proxy that requires Basic HTTP authentication.| "" | No |
-| `providers.swarm.useBindPortIP` | Instructs Traefik to use the IP/Port attached to the container's binding instead of its inner network IP/Port. See [here](#usebindportip) for more information | false | No |
-| `providers.swarm.exposedByDefault` | Expose containers by default through Traefik. See [here](./overview.md#restrict-the-scope-of-service-discovery) for additional information | true | No |
-| `providers.swarm.network` | Defines a default docker network to use for connections to all containers. This option can be overridden on a per-container basis with the `traefik.docker.network` label.| "" | No |
-| `providers.swarm.defaultRule` | Defines what routing rule to apply to a container if no rule is defined by a label. See [here](#defaultrule) for more information | ```"Host(`{{ normalize .Name }}`)"``` | No |
-| `providers.swarm.refreshSeconds` | Defines the polling interval for Swarm Mode. | "15s" | No |
-| `providers.swarm.httpClientTimeout` | Defines the client timeout (in seconds) for HTTP connections. If its value is 0, no timeout is set. | 0 | No |
-| `providers.swarm.watch` | Instructs Traefik to watch Docker events or not. | True | No |
-| `providers.swarm.constraints` | Defines an expression that Traefik matches against the container labels to determine whether to create any route for that container. See [here](#constraints) for more information. | "" | No |
-| `providers.swarm.allowEmptyServices` | Instructs the provider to create any [servers load balancer](../../../routing/services/index.md#servers-load-balancer) defined for Docker containers regardless of the [healthiness](https://docs.docker.com/engine/reference/builder/#healthcheck) of the corresponding containers. | false | No |
-| `providers.swarm.tls.ca` | Defines the path to the certificate authority used for the secure connection to Docker, it defaults to the system bundle. | "" | No |
-| `providers.swarm.tls.cert` | Defines the path to the public certificate used for the secure connection to Docker. When using this option, setting the `key` option is required. | "" | Yes |
-| `providers.swarm.tls.key` | Defines the path to the private key used for the secure connection to Docker. When using this option, setting the `cert` option is required. | "" | Yes |
-| `providers.swarm.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by the Docker server when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
+| Field | Description | Default | Required |
+|:-----------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------------------------------------|:---------|
+| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No |
+| `providers.swarm.endpoint` | Specifies the Docker API endpoint. See [here](#endpoint) for more information | `unix:///var/run/docker.sock` | Yes |
+| `providers.swarm.username` | Defines the username for Basic HTTP authentication. This should be used when the Docker daemon socket is exposed through an HTTP proxy that requires Basic HTTP authentication. | "" | No |
+| `providers.swarm.password` | Defines the password for Basic HTTP authentication. This should be used when the Docker daemon socket is exposed through an HTTP proxy that requires Basic HTTP authentication. | "" | No |
+| `providers.swarm.useBindPortIP` | Instructs Traefik to use the IP/Port attached to the container's binding instead of its inner network IP/Port. See [here](#usebindportip) for more information | false | No |
+| `providers.swarm.exposedByDefault` | Expose containers by default through Traefik. See [here](./overview.md#exposedbydefault-and-traefikenable) for additional information | true | No |
+| `providers.swarm.network` | Defines a default docker network to use for connections to all containers. This option can be overridden on a per-container basis with the `traefik.swarm.network` label. | "" | No |
+| `providers.swarm.defaultRule` | Defines what routing rule to apply to a container if no rule is defined by a label. See [here](#defaultrule) for more information | ```"Host(`{{ normalize .Name }}`)"``` | No |
+| `providers.swarm.refreshSeconds` | Defines the polling interval for Swarm Mode. | "15s" | No |
+| `providers.swarm.httpClientTimeout` | Defines the client timeout (in seconds) for HTTP connections. If its value is 0, no timeout is set. | 0 | No |
+| `providers.swarm.watch` | Instructs Traefik to watch Docker events or not. | True | No |
+| `providers.swarm.constraints` | Defines an expression that Traefik matches against the container labels to determine whether to create any route for that container. See [here](#constraints) for more information. | "" | No |
+| `providers.swarm.allowEmptyServices` | Instructs the provider to create any [servers load balancer](../../../routing/services/index.md#servers-load-balancer) defined for Docker containers regardless of the [healthiness](https://docs.docker.com/engine/reference/builder/#healthcheck) of the corresponding containers. | false | No |
+| `providers.swarm.tls.ca` | Defines the path to the certificate authority used for the secure connection to Docker, it defaults to the system bundle. | "" | No |
+| `providers.swarm.tls.cert` | Defines the path to the public certificate used for the secure connection to Docker. When using this option, setting the `key` option is required. | "" | Yes |
+| `providers.swarm.tls.key` | Defines the path to the private key used for the secure connection to Docker. When using this option, setting the `cert` option is required. | "" | Yes |
+| `providers.swarm.tls.insecureSkipVerify` | Instructs the provider to accept any certificate presented by the Docker server when establishing a TLS connection, regardless of the hostnames the certificate covers. | false | No |
### `endpoint`
@@ -73,8 +72,6 @@ See the [Docker Swarm API Access](#docker-api-access) section for more informati
The docker-compose file shares the docker sock with the Traefik container
```yaml
- version: '3'
-
services:
traefik:
image: traefik:v3.1 # The official v3 Traefik docker image
@@ -100,7 +97,7 @@ See the [Docker Swarm API Access](#docker-api-access) section for more informati
```
```bash tab="CLI"
- --providers.docker.endpoint=unix:///var/run/docker.sock
+ --providers.swarm.endpoint=unix:///var/run/docker.sock
# ...
```
@@ -201,13 +198,13 @@ but still uses the `traefik.http.services..loadbalancer.server.port` that
| port label | Container's binding | Routes to |
|--------------------|----------------------------------------------------|----------------|
- | - | - | IntIP:IntPort |
- | - | ExtPort:IntPort | IntIP:IntPort |
- | - | ExtIp:ExtPort:IntPort | ExtIp:ExtPort |
- | LblPort | - | IntIp:LblPort |
- | LblPort | ExtIp:ExtPort:LblPort | ExtIp:ExtPort |
- | LblPort | ExtIp:ExtPort:OtherPort | IntIp:LblPort |
- | LblPort | ExtIp1:ExtPort1:IntPort1 & ExtIp2:LblPort:IntPort2 | ExtIp2:LblPort |
+ | - | - | IntIP:IntPort |
+ | - | ExtPort:IntPort | IntIP:IntPort |
+ | - | ExtIp:ExtPort:IntPort | ExtIp:ExtPort |
+ | LblPort | - | IntIp:LblPort |
+ | LblPort | ExtIp:ExtPort:LblPort | ExtIp:ExtPort |
+ | LblPort | ExtIp:ExtPort:OtherPort | IntIp:LblPort |
+ | LblPort | ExtIp1:ExtPort1:IntPort1 & ExtIp2:LblPort:IntPort2 | ExtIp2:LblPort |
!!! info ""
In the above table:
@@ -279,6 +276,10 @@ created. If the expression is empty, all detected containers are included.
The expression syntax is based on the `Label("key", "value")`, and `LabelRegex("key", "value")` functions,
as well as the usual boolean logic, as shown in examples below.
+!!! tip "Constraints key limitations"
+
+ Note that `traefik.*` is a reserved label namespace for configuration and can not be used as a key for custom constraints.
+
??? example "Constraints Expression Examples"
```toml
@@ -311,7 +312,7 @@ as well as the usual boolean logic, as shown in examples below.
constraints = "LabelRegex(`a.label.name`, `a.+`)"
```
-For additional information, refer to [Restrict the Scope of Service Discovery](./overview.md#restrict-the-scope-of-service-discovery).
+For additional information, refer to [Restrict the Scope of Service Discovery](./overview.md#exposedbydefault-and-traefikenable).
```yaml tab="File (YAML)"
providers:
@@ -405,8 +406,6 @@ docker service create \
```
```yml tab="With Docker Compose"
-version: '3'
-
services:
traefik:
# ...
diff --git a/docs/content/reference/install-configuration/tls/certificate-resolvers/acme.md b/docs/content/reference/install-configuration/tls/certificate-resolvers/acme.md
index 1b05bde5a..f923e6c72 100644
--- a/docs/content/reference/install-configuration/tls/certificate-resolvers/acme.md
+++ b/docs/content/reference/install-configuration/tls/certificate-resolvers/acme.md
@@ -73,27 +73,30 @@ certificatesResolvers:
ACME certificate resolvers have the following configuration options:
-| Field | Description | Default | Required |
-|:------------------|:--------------------|:-----------------------------------------------|:---------|
-| `acme.email` | Email address used for registration. | "" | Yes |
-| `acme.caServer` | CA server to use. | https://acme-v02.api.letsencrypt.org/directory | No |
-| `acme.preferredChain` | Preferred chain to use. If the CA offers multiple certificate chains, prefer the chain with an issuer matching this Subject Common Name. If no match, the default offered chain will be used. | "" | No |
-| `acme.keyType` | KeyType to use. | "RSA4096" | No |
-| `acme.eab` | Enable external account binding.| | No |
-| `acme.eab.kid` | Key identifier from External CA. | "" | No |
-| `acme.eab.hmacEncoded` | HMAC key from External CA, should be in Base64 URL Encoding without padding format. | "" | No |
-| `acme.certificatesDuration` | The certificates' duration in hours, exclusively used to determine renewal dates. | 2160 | No |
-| `acme.dnsChallenge` | Enable DNS-01 challenge. More information [here](#dnschallenge). | - | No |
-| `acme.dnsChallenge.provider` | DNS provider to use. | "" | No |
-| `acme.dnsChallenge.resolvers` | DNS servers to resolve the FQDN authority. | [] | No |
-| `acme.dnsChallenge.propagation.delayBeforeChecks` | By default, the provider will verify the TXT DNS challenge record before letting ACME verify. If `delayBeforeCheck` is greater than zero, this check is delayed for the configured duration in seconds. This is Useful if internal networks block external DNS queries. | 0s | No |
-| `acme.dnsChallenge.propagation.disableChecks` | Disables the challenge TXT record propagation checks, before notifying ACME that the DNS challenge is ready. Please note that disabling checks can prevent the challenge from succeeding. | false | No |
-| `acme.dnsChallenge.propagation.requireAllRNS` | Enables the challenge TXT record to be propagated to all recursive nameservers. If you have disabled authoritative nameservers checks (with `propagation.disableANSChecks`), it is recommended to check all recursive nameservers instead. | false | No |
-| `acme.dnsChallenge.propagation.disableANSChecks` | Disables the challenge TXT record propagation checks against authoritative nameservers. This option will skip the propagation check against the nameservers of the authority (SOA). It should be used only if the nameservers of the authority are not reachable. | false | No |
-| `acme.httpChallenge` | Enable HTTP-01 challenge. More information [here](#httpchallenge). | | No |
-| `acme.httpChallenge.entryPoint` | EntryPoint to use for the HTTP-01 challenges. Must be reachable by Let's Encrypt through port 80 | "" | Yes |
-| `acme.tlsChallenge` | Enable TLS-ALPN-01 challenge. Traefik must be reachable by Let's Encrypt through port 443. More information [here](#tlschallenge). | - | No |
-| `acme.storage` | File path used for certificates storage. | "acme.json" | Yes |
+| Field | Description | Default | Required |
+|:--------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------------------------------------------|:---------|
+| `acme.email` | Email address used for registration. | "" | Yes |
+| `acme.caServer` | CA server to use. | https://acme-v02.api.letsencrypt.org/directory | No |
+| `acme.preferredChain` | Preferred chain to use. If the CA offers multiple certificate chains, prefer the chain with an issuer matching this Subject Common Name. If no match, the default offered chain will be used. | "" | No |
+| `acme.keyType` | KeyType to use. | "RSA4096" | No |
+| `acme.eab` | Enable external account binding. | | No |
+| `acme.eab.kid` | Key identifier from External CA. | "" | No |
+| `acme.eab.hmacEncoded` | HMAC key from External CA, should be in Base64 URL Encoding without padding format. | "" | No |
+| `acme.certificatesDuration` | The certificates' duration in hours, exclusively used to determine renewal dates. | 2160 | No |
+| `acme.clientTimeout` | Timeout for HTTP Client used to communicate with the ACME server. | 2m | No |
+| | Timeout for response headers for HTTP Client used to communicate with the ACME server. | 30s | No |
+| `acme.dnsChallenge` | Enable DNS-01 challenge. More information [here](#dnschallenge). | - | No |
+| `acme.dnsChallenge.provider` | DNS provider to use. | "" | No |
+| `acme.dnsChallenge.resolvers` | DNS servers to resolve the FQDN authority. | [] | No |
+| `acme.dnsChallenge.propagation.delayBeforeChecks` | By default, the provider will verify the TXT DNS challenge record before letting ACME verify. If `delayBeforeCheck` is greater than zero, this check is delayed for the configured duration in seconds. This is Useful if internal networks block external DNS queries. | 0s | No |
+| `acme.dnsChallenge.propagation.disableChecks` | Disables the challenge TXT record propagation checks, before notifying ACME that the DNS challenge is ready. Please note that disabling checks can prevent the challenge from succeeding. | false | No |
+| `acme.dnsChallenge.propagation.requireAllRNS` | Enables the challenge TXT record to be propagated to all recursive nameservers. If you have disabled authoritative nameservers checks (with `propagation.disableANSChecks`), it is recommended to check all recursive nameservers instead. | false | No |
+| `acme.dnsChallenge.propagation.disableANSChecks` | Disables the challenge TXT record propagation checks against authoritative nameservers. This option will skip the propagation check against the nameservers of the authority (SOA). It should be used only if the nameservers of the authority are not reachable. | false | No |
+| `acme.httpChallenge` | Enable HTTP-01 challenge. More information [here](#httpchallenge). | | No |
+| `acme.httpChallenge.entryPoint` | EntryPoint to use for the HTTP-01 challenges. Must be reachable by Let's Encrypt through port 80 | "" | Yes |
+| `acme.httpChallenge.delay` | The delay between the creation of the challenge and the validation. A value lower than or equal to zero means no delay. | 0 | No |
+| `acme.tlsChallenge` | Enable TLS-ALPN-01 challenge. Traefik must be reachable by Let's Encrypt through port 443. More information [here](#tlschallenge). | - | No |
+| `acme.storage` | File path used for certificates storage. | "acme.json" | Yes |
## Automatic Certificate Renewal
diff --git a/docs/content/reference/install-configuration/tls/ocsp.md b/docs/content/reference/install-configuration/tls/ocsp.md
new file mode 100644
index 000000000..577f3749c
--- /dev/null
+++ b/docs/content/reference/install-configuration/tls/ocsp.md
@@ -0,0 +1,71 @@
+---
+title: "Traefik OCSP Documentation"
+description: "Learn how to configure Traefik to use OCSP. Read the technical documentation."
+---
+
+# OCSP
+
+Check certificate status and perform OCSP stapling.
+{: .subtitle }
+
+## Overview
+
+### OCSP Stapling
+
+When OCSP is enabled, Traefik checks the status of every certificate in the store that provides an OCSP responder URL,
+including the default certificate, and staples the OCSP response to the TLS handshake.
+The OCSP check is performed when the certificate is loaded,
+and once every hour until it is successful at the halfway point before the update date.
+
+### Caching
+
+Traefik caches the OCSP response as long as the associated certificate is provided by the configuration.
+When a certificate is no longer provided,
+the OCSP response has a 24 hour TTL waiting to be provided again or eventually removed.
+The OCSP response is cached in memory and is not persisted between Traefik restarts.
+
+## Configuration
+
+### General
+
+Enabling OCSP is part of the [install configuration](../boot-environment.md).
+It can be defined by using a file (YAML or TOML) or CLI arguments:
+
+```yaml tab="File (YAML)"
+## Static configuration
+ocsp: {}
+```
+
+```toml tab="File (TOML)"
+## Static configuration
+[ocsp]
+```
+
+```bash tab="CLI"
+## Static configuration
+--ocsp=true
+```
+
+### Responder Overrides
+
+The `responderOverrides` option defines the OCSP responder URLs to use instead of the one provided by the certificate.
+This is useful when you want to use a different OCSP responder.
+
+```yaml tab="File (YAML)"
+## Static configuration
+ocsp:
+ responderOverrides:
+ foo: bar
+```
+
+```toml tab="File (TOML)"
+## Static configuration
+[ocsp]
+ [ocsp.responderOverrides]
+ foo = "bar"
+```
+
+```bash tab="CLI"
+## Static configuration
+--ocsp.responderoverrides.foo=bar
+```
diff --git a/docs/content/reference/install-configuration/tls/spiffe.md b/docs/content/reference/install-configuration/tls/spiffe.md
index d7067c8f0..ca4c10ddc 100644
--- a/docs/content/reference/install-configuration/tls/spiffe.md
+++ b/docs/content/reference/install-configuration/tls/spiffe.md
@@ -44,7 +44,7 @@ spiffe:
## ServersTransport
Enabling SPIFFE does not imply that backend connections are going to use it automatically.
-Each [ServersTransport](../../../routing/services/index.md#serverstransport_1) or [TCPServersTransport](../../../routing/services/index.md#serverstransport_2), that is meant to be secured with SPIFFE, must explicitly enable it (see [SPIFFE with ServersTransport](../../../routing/services/index.md#spiffe) or [SPIFFE with TCPServersTransport](../../../routing/services/index.md#spiffe_1)).
+Each [ServersTransport](../../routing-configuration/http/load-balancing/serverstransport.md) or [TCPServersTransport](../../routing-configuration/tcp/serverstransport.md), that is meant to be secured with SPIFFE, must explicitly enable it (see [SPIFFE with ServersTransport](../../routing-configuration/http/load-balancing/serverstransport.md#opt-spiffe) or [SPIFFE with TCPServersTransport](../../routing-configuration/tcp/serverstransport.md#opt-serverstransport-spiffe)).
### Configuration Example
diff --git a/docs/content/reference/routing-configuration/dynamic-configuration-methods.md b/docs/content/reference/routing-configuration/dynamic-configuration-methods.md
index cb158d0b2..20b30222e 100644
--- a/docs/content/reference/routing-configuration/dynamic-configuration-methods.md
+++ b/docs/content/reference/routing-configuration/dynamic-configuration-methods.md
@@ -72,8 +72,6 @@ When using Docker or Amazon ECS, you can define routing configuration using cont
When deploying a Docker container, you can specify labels to define routing rules and services:
```yaml
- version: '3'
-
services:
my-service:
image: my-image
diff --git a/docs/content/reference/routing-configuration/http/load-balancing/serverstransport.md b/docs/content/reference/routing-configuration/http/load-balancing/serverstransport.md
index 89d7b31c4..5774e60df 100644
--- a/docs/content/reference/routing-configuration/http/load-balancing/serverstransport.md
+++ b/docs/content/reference/routing-configuration/http/load-balancing/serverstransport.md
@@ -94,19 +94,20 @@ labels:
## Configuration Options
-| Field | Description | Default | Required |
-|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `serverName` | Configures the server name that will be used as the SNI. | "" | No |
-| `certificates` | Defines the list of certificates (as file paths, or data bytes) that will be set as client certificates for mTLS. | [] | No |
-| `insecureSkipVerify` | Controls whether the server's certificate chain and host name is verified. | false | No |
-| `rootcas` | Set of root certificate authorities to use when verifying server certificates. (for mTLS connections). | [] | No |
-| `maxIdleConnsPerHost` | Maximum idle (keep-alive) connections to keep per-host. | 200 | No |
-| `disableHTTP2` | Disables HTTP/2 for connections with servers. | false | No |
-| `peerCertURI` | Defines the URI used to match against SAN URIs during the server's certificate verification. | "" | No |
-| `forwardingTimeouts.dialTimeout` | Amount of time to wait until a connection to a server can be established.
0 = no timeout | 30s | No |
-| `forwardingTimeouts.responseHeaderTimeout` | Amount of time to wait for a server's response headers after fully writing the request (including its body, if any).
0 = no timeout | 0s | No |
-| `forwardingTimeouts.idleConnTimeout` | Maximum amount of time an idle (keep-alive) connection will remain idle before closing itself.
0 = no timeout | 90s | No |
-| `forwardingTimeouts.readIdleTimeout` | Defines the timeout after which a health check using ping frame will be carried out if no frame is received on the HTTP/2 connection. | 0s | No |
-| `forwardingTimeouts.pingTimeout` | Defines the timeout after which the HTTP/2 connection will be closed if a response to ping is not received. | 15s | No |
-| `spiffe.ids` | Defines the allowed SPIFFE IDs.
This takes precedence over the SPIFFE TrustDomain. | [] | No |
-| `spiffe.trustDomain` | Defines the SPIFFE trust domain. | "" | No |
+| Field | Description | Default | Required |
+|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
+| `serverName` | Configures the server name that will be used as the SNI. | "" | No |
+| `certificates` | Defines the list of certificates (as file paths, or data bytes) that will be set as client certificates for mTLS. | [] | No |
+| `insecureSkipVerify` | Controls whether the server's certificate chain and host name is verified. | false | No |
+| `rootcas` | Set of root certificate authorities to use when verifying server certificates. (for mTLS connections). | [] | No |
+| `maxIdleConnsPerHost` | Maximum idle (keep-alive) connections to keep per-host. | 200 | No |
+| `disableHTTP2` | Disables HTTP/2 for connections with servers. | false | No |
+| `peerCertURI` | Defines the URI used to match against SAN URIs during the server's certificate verification. | "" | No |
+| `forwardingTimeouts.dialTimeout` | Amount of time to wait until a connection to a server can be established.
0 = no timeout | 30s | No |
+| | Amount of time to wait for a server's response headers after fully writing the request (including its body, if any).
0 = no timeout | 0s | No |
+| `forwardingTimeouts.idleConnTimeout` | Maximum amount of time an idle (keep-alive) connection will remain idle before closing itself.
0 = no timeout | 90s | No |
+| `forwardingTimeouts.readIdleTimeout` | Defines the timeout after which a health check using ping frame will be carried out if no frame is received on the HTTP/2 connection. | 0s | No |
+| `forwardingTimeouts.pingTimeout` | Defines the timeout after which the HTTP/2 connection will be closed if a response to ping is not received. | 15s | No |
+| `spiffe` | Defines the SPIFFE configuration. An empty `spiffe` section enables SPIFFE (that allows any SPIFFE ID). | | No |
+| `spiffe.ids` | Defines the allowed SPIFFE IDs.
This takes precedence over the SPIFFE TrustDomain. | [] | No |
+| `spiffe.trustDomain` | Defines the SPIFFE trust domain. | "" | No |
diff --git a/docs/content/reference/routing-configuration/http/load-balancing/service.md b/docs/content/reference/routing-configuration/http/load-balancing/service.md
index eaa665417..38f26d077 100644
--- a/docs/content/reference/routing-configuration/http/load-balancing/service.md
+++ b/docs/content/reference/routing-configuration/http/load-balancing/service.md
@@ -1,7 +1,10 @@
---
title: "Traefik HTTP Services Documentation"
description: "A service is in charge of connecting incoming requests to the Servers that can handle them. Read the technical documentation."
----
+---
+
+Traefik services define how to distribute incoming traffic across your backend servers.
+Each service implements one of the load balancing strategies detailed on this page to ensure optimal traffic distribution and high availability.
## Service Load Balancer
@@ -9,7 +12,7 @@ The load balancers are able to load balance the requests between multiple instan
Each service has a load-balancer, even if there is only one server to forward traffic to.
-## Configuration Example
+### Configuration Example
```yaml tab="Structured (YAML)"
http:
@@ -70,7 +73,6 @@ labels:
```json tab="Tags"
{
- // ...
"Tags": [
"traefik.http.services.my-service.loadBalancer.servers[0].url=http://private-ip-server-1/",
"traefik.http.services.my-service.loadBalancer.servers[0].weight=2",
@@ -88,15 +90,15 @@ labels:
### Configuration Options
-| Field | Description | Required |
-|----------|------------------------------------------|----------|
-|`servers`| Represents individual backend instances for your service | Yes |
-|`sticky`| Defines a `Set-Cookie` header is set on the initial response to let the client know which server handles the first response. | No |
-|`healthcheck`| Configures health check to remove unhealthy servers from the load balancing rotation. | No |
-|`passHostHeader`| Allows forwarding of the client Host header to server. By default, `passHostHeader` is true. | No |
-|`serversTransport`| Allows to reference an [HTTP ServersTransport](./serverstransport.md) configuration for the communication between Traefik and your servers. If no `serversTransport` is specified, the `default@internal` will be used. | No |
-| `responseForwarding` | Configures how Traefik forwards the response from the backend server to the client.| No |
-| `responseForwarding.FlushInterval` | Specifies the interval in between flushes to the client while copying the response body. It is a duration in milliseconds, defaulting to 100ms. A negative value means to flush immediately after each write to the client. The `FlushInterval` is ignored when ReverseProxy recognizes a response as a streaming response; for such responses, writes are flushed to the client immediately. | No |
+| Field | Description | Required |
+|------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|
+| `servers` | Represents individual backend instances for your service | Yes |
+| `sticky` | Defines a `Set-Cookie` header is set on the initial response to let the client know which server handles the first response. | No |
+| `healthcheck` | Configures health check to remove unhealthy servers from the load balancing rotation. | No |
+| | Allows forwarding of the client Host header to server. By default, `passHostHeader` is true. | No |
+| `serversTransport` | Allows to reference an [HTTP ServersTransport](./serverstransport.md) configuration for the communication between Traefik and your servers. If no `serversTransport` is specified, the `default@internal` will be used. | No |
+| `responseForwarding` | Configures how Traefik forwards the response from the backend server to the client. | No |
+| `responseForwarding.FlushInterval` | Specifies the interval in between flushes to the client while copying the response body. It is a duration in milliseconds, defaulting to 100ms. A negative value means to flush immediately after each write to the client. The `FlushInterval` is ignored when ReverseProxy recognizes a response as a streaming response; for such responses, writes are flushed to the client immediately. | No |
#### Servers
@@ -104,11 +106,11 @@ Servers represent individual backend instances for your service. The [service lo
##### Configuration Options
-| Field | Description | Required |
-|----------|------------------------------------------|----------|
-|`url`| Points to a specific instance. | Yes for File provider, No for [Docker provider](../../other-providers/docker.md) |
-|`weight`| Allows for weighted load balancing on the servers. | No |
-|`preservePath`| Allows to preserve the URL path. | No |
+| Field | Description | Required |
+|----------------|----------------------------------------------------|----------------------------------------------------------------------------------|
+| `url` | Points to a specific instance. | Yes for File provider, No for [Docker provider](../../other-providers/docker.md) |
+| `weight` | Allows for weighted load balancing on the servers. | No |
+| `preservePath` | Allows to preserve the URL path. | No |
#### Health Check
@@ -118,20 +120,179 @@ To propagate status changes (e.g. all servers of this service are down) upwards,
Below are the available options for the health check mechanism:
-| Field | Description | Default | Required |
-|----------|------------------------------------------|----------|--------|
-|`path`| Defines the server URL path for the health check endpoint. | "" | Yes |
-|`scheme`| Replaces the server URL scheme for the health check endpoint. | | No |
-|`mode`| If defined to `grpc`, will use the gRPC health check protocol to probe the server. | http | No |
-|`hostname`| Defines the value of hostname in the Host header of the health check request. | "" | No |
-|`port`| Replaces the server URL port for the health check endpoint. | | No |
-|`interval`| Defines the frequency of the health check calls. | 30s | No |
-|`timeout`| Defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy. | 5s | No |
-|`headers`| Defines custom headers to be sent to the health check endpoint. | | No |
-|`followRedirects`| Defines whether redirects should be followed during the health check calls. | true | No |
-|`hostname`| Defines the value of hostname in the Host header of the health check request. | "" | No |
-|`method`| Defines the HTTP method that will be used while connecting to the endpoint. | GET | No |
-|`status`| Defines the expected HTTP status code of the response to the health check request. | | No |
+| Field | Description | Default | Required |
+|---------------------|-------------------------------------------------------------------------------------------------------------------------------|---------|----------|
+| `path` | Defines the server URL path for the health check endpoint. | "" | Yes |
+| `scheme` | Replaces the server URL scheme for the health check endpoint. | | No |
+| `mode` | If defined to `grpc`, will use the gRPC health check protocol to probe the server. | http | No |
+| `hostname` | Defines the value of hostname in the Host header of the health check request. | "" | No |
+| `port` | Replaces the server URL port for the health check endpoint. | | No |
+| `interval` | Defines the frequency of the health check calls for healthy targets. | 30s | No |
+| `unhealthyInterval` | Defines the frequency of the health check calls for unhealthy targets. When not defined, it defaults to the `interval` value. | 30s | No |
+| `timeout` | Defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy. | 5s | No |
+| | Defines custom headers to be sent to the health check endpoint. | | No |
+| `followRedirects` | Defines whether redirects should be followed during the health check calls. | true | No |
+| `hostname` | Defines the value of hostname in the Host header of the health check request. | "" | No |
+| `method` | Defines the HTTP method that will be used while connecting to the endpoint. | GET | No |
+| `status` | Defines the expected HTTP status code of the response to the health check request. | | No |
+
+#### Sticky sessions
+
+When sticky sessions are enabled, a `Set-Cookie` header is set on the initial response to let the client know which server handles the first response.
+On subsequent requests, to keep the session alive with the same server, the client should send the cookie with the value set.
+
+##### Stickiness on multiple levels
+
+ When chaining or mixing load-balancers (e.g. a load-balancer of servers is one of the "children" of a load-balancer of services), for stickiness to work all the way, the option needs to be specified at all required levels. Which means the client needs to send a cookie with as many key/value pairs as there are sticky levels.
+
+##### Stickiness & Unhealthy Servers
+
+ If the server specified in the cookie becomes unhealthy, the request will be forwarded to a new server (and the cookie will keep track of the new server).
+
+##### Cookie Name
+
+ The default cookie name is an abbreviation of a sha1 (ex: `_1d52e`).
+
+##### MaxAge
+
+ By default, the affinity cookie will never expire as the `MaxAge` option is set to zero.
+
+ This option indicates the number of seconds until the cookie expires.
+ When set to a negative number, the cookie expires immediately.
+
+##### Secure & HTTPOnly & SameSite flags
+
+ By default, the affinity cookie is created without those flags.
+ One however can change that through configuration.
+
+ `SameSite` can be `none`, `lax`, `strict` or empty.
+
+##### Domain
+
+ The Domain attribute of a cookie specifies the domain for which the cookie is valid.
+
+ By setting the Domain attribute, the cookie can be shared across subdomains (for example, a cookie set for example.com would be accessible to www.example.com, api.example.com, etc.). This is particularly useful in cases where sticky sessions span multiple subdomains, ensuring that the session is maintained even when the client interacts with different parts of the infrastructure.
+
+??? example "Adding Stickiness -- Using the [File Provider](../../../install-configuration/providers/others/file.md)"
+
+ ```yaml tab="YAML"
+ ## Dynamic configuration
+ http:
+ services:
+ my-service:
+ loadBalancer:
+ sticky:
+ cookie: {}
+ ```
+
+ ```toml tab="TOML"
+ ## Dynamic configuration
+ [http.services]
+ [http.services.my-service]
+ [http.services.my-service.loadBalancer.sticky.cookie]
+ ```
+
+??? example "Adding Stickiness with custom Options -- Using the [File Provider](../../../install-configuration/providers/others/file.md)"
+
+ ```yaml tab="YAML"
+ ## Dynamic configuration
+ http:
+ services:
+ my-service:
+ loadBalancer:
+ sticky:
+ cookie:
+ name: my_sticky_cookie_name
+ secure: true
+ domain: mysite.site
+ httpOnly: true
+ ```
+
+ ```toml tab="TOML"
+ ## Dynamic configuration
+ [http.services]
+ [http.services.my-service]
+ [http.services.my-service.loadBalancer.sticky.cookie]
+ name = "my_sticky_cookie_name"
+ secure = true
+ httpOnly = true
+ domain = "mysite.site"
+ sameSite = "none"
+ ```
+
+??? example "Setting Stickiness on all the required levels -- Using the [File Provider](../../../install-configuration/providers/others/file.md)"
+
+ ```yaml tab="YAML"
+ ## Dynamic configuration
+ http:
+ services:
+ wrr1:
+ weighted:
+ sticky:
+ cookie:
+ name: lvl1
+ services:
+ - name: whoami1
+ weight: 1
+ - name: whoami2
+ weight: 1
+
+ whoami1:
+ loadBalancer:
+ sticky:
+ cookie:
+ name: lvl2
+ servers:
+ - url: http://127.0.0.1:8081
+ - url: http://127.0.0.1:8082
+
+ whoami2:
+ loadBalancer:
+ sticky:
+ cookie:
+ name: lvl2
+ servers:
+ - url: http://127.0.0.1:8083
+ - url: http://127.0.0.1:8084
+ ```
+
+ ```toml tab="TOML"
+ ## Dynamic configuration
+ [http.services]
+ [http.services.wrr1]
+ [http.services.wrr1.weighted.sticky.cookie]
+ name = "lvl1"
+ [[http.services.wrr1.weighted.services]]
+ name = "whoami1"
+ weight = 1
+ [[http.services.wrr1.weighted.services]]
+ name = "whoami2"
+ weight = 1
+
+ [http.services.whoami1]
+ [http.services.whoami1.loadBalancer]
+ [http.services.whoami1.loadBalancer.sticky.cookie]
+ name = "lvl2"
+ [[http.services.whoami1.loadBalancer.servers]]
+ url = "http://127.0.0.1:8081"
+ [[http.services.whoami1.loadBalancer.servers]]
+ url = "http://127.0.0.1:8082"
+
+ [http.services.whoami2]
+ [http.services.whoami2.loadBalancer]
+ [http.services.whoami2.loadBalancer.sticky.cookie]
+ name = "lvl2"
+ [[http.services.whoami2.loadBalancer.servers]]
+ url = "http://127.0.0.1:8083"
+ [[http.services.whoami2.loadBalancer.servers]]
+ url = "http://127.0.0.1:8084"
+ ```
+
+ To keep a session open with the same server, the client would then need to specify the two levels within the cookie for each request, e.g. with curl:
+
+ ```
+ curl -b "lvl1=whoami1; lvl2=http://127.0.0.1:8081" http://localhost:8000
+ ```
## Weighted Round Robin (WRR)
@@ -141,7 +302,7 @@ This strategy is only available to load balance between services and not between
!!! info "Supported Providers"
- This strategy can be defined currently with the [File](../../../install-configuration/providers/others/file.md) or [IngressRoute](../../../install-configuration/providers/kubernetes/kubernetes-ingress.md) providers. To load balance between servers based on weights, the Load Balancer service should be used instead.
+ This strategy can be defined currently with the [File](../../../install-configuration/providers/others/file.md) or [IngressRoute](../../../install-configuration/providers/kubernetes/kubernetes-crd.md) providers. To load balance between servers based on weights, the Load Balancer service should be used instead.
```yaml tab="Structured (YAML)"
## Dynamic configuration
@@ -260,14 +421,49 @@ http:
[[http.services.appv2.loadBalancer.servers]]
url = "http://private-ip-server-2/"
```
+## P2C
+
+Power of two choices algorithm is a load balancing strategy that selects two servers at random and chooses the one with the least number of active requests.
+
+??? example "P2C Load Balancing -- Using the [File Provider](../../../install-configuration/providers/others/file.md)"
+
+ ```yaml tab="YAML"
+ ## Dynamic configuration
+ http:
+ services:
+ my-service:
+ loadBalancer:
+ strategy: "p2c"
+ servers:
+ - url: "http://private-ip-server-1/"
+ - url: "http://private-ip-server-2/"
+ - url: "http://private-ip-server-3/"
+ ```
+
+ ```toml tab="TOML"
+ ## Dynamic configuration
+ [http.services]
+ [http.services.my-service.loadBalancer]
+ strategy = "p2c"
+ [[http.services.my-service.loadBalancer.servers]]
+ url = "http://private-ip-server-1/"
+ [[http.services.my-service.loadBalancer.servers]]
+ url = "http://private-ip-server-2/"
+ [[http.services.my-service.loadBalancer.servers]]
+ url = "http://private-ip-server-3/"
+ ```
## Mirroring
The mirroring is able to mirror requests sent to a service to other services. Please note that by default the whole request is buffered in memory while it is being mirrored. See the `maxBodySize` option in the example below for how to modify this behaviour. You can also omit the request body by setting the `mirrorBody` option to false.
+!!! warning "Default behavior of `percent`"
+
+ When configuring a `mirror` service, if the `percent` field is not set, it defaults to `0`, meaning **no traffic will be sent to the mirror**.
+
!!! info "Supported Providers"
- This strategy can be defined currently with the [File](../../../install-configuration/providers/others/file.md) or [IngressRoute](../../../install-configuration/providers/kubernetes/kubernetes-ingress.md) providers.
+ This strategy can be defined currently with the [File](../../../install-configuration/providers/others/file.md) or [IngressRoute](../../../install-configuration/providers/kubernetes/kubernetes-crd.md) providers.
```yaml tab="Structured (YAML)"
## Dynamic configuration
@@ -285,6 +481,8 @@ http:
maxBodySize: 1024
mirrors:
- name: appv2
+ # Percent defines the percentage of requests that should be mirrored.
+ # Default value is 0, which means no traffic will be sent to the mirror.
percent: 10
appv1:
diff --git a/docs/content/reference/routing-configuration/http/middlewares/addprefix.md b/docs/content/reference/routing-configuration/http/middlewares/addprefix.md
index 84c34e8ca..0bb182d8b 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/addprefix.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/addprefix.md
@@ -3,8 +3,6 @@ title: "Traefik AddPrefix Documentation"
description: "Learn how to implement the HTTP AddPrefix middleware in Traefik Proxy to updates request paths before being forwarded. Read the technical documentation."
---
-
-
The `addPrefix` middleware updates the path of a request before forwarding it.
## Configuration Examples
@@ -56,4 +54,4 @@ spec:
| Field | Description | Default | Required |
|:-----------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
-| `prefix` | String to add **before** the current path in the requested URL. It should include a leading slash (`/`). | "" | Yes |
+| `prefix` | String to add **before** the current path in the requested URL. It should include a leading slash (`/`). | "" | Yes |
diff --git a/docs/content/reference/routing-configuration/http/middlewares/apikey.md b/docs/content/reference/routing-configuration/http/middlewares/apikey.md
new file mode 100644
index 000000000..454c141a1
--- /dev/null
+++ b/docs/content/reference/routing-configuration/http/middlewares/apikey.md
@@ -0,0 +1,56 @@
+---
+title: 'API Key Authentication'
+description: 'Traefik Hub API Gateway - The API Key authentication middleware allows you to secure an API by requiring a secret key, base64 encoded or not, to be given, via an HTTP header, a cookie or a query parameter.'
+---
+
+!!! info "Traefik Hub Feature"
+ This middleware is available exclusively in [Traefik Hub](https://traefik.io/traefik-hub/). Learn more about [Traefik Hub's advanced features](https://doc.traefik.io/traefik-hub/api-gateway/intro).
+
+The API Key authentication middleware allows you to secure an API by requiring a secret key, base64 encoded or not, to be given, via an HTTP header, a cookie or a query parameter.
+
+---
+
+## Configuration Example
+
+```yaml tab="Middleware API Key"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-apikey
+ namespace: apps
+spec:
+ plugin:
+ apiKey:
+ keySource:
+ headerAuthScheme: Bearer
+ header: Authorization
+ secretNonBase64Encoded: true
+ secretValues:
+ - "urn:k8s:secret:apikey:secret"
+ - "urn:k8s:secret:apikey:othersecret"
+```
+
+```yaml tab="Values Secret"
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+ name: apikey
+ namespace: whoami
+stringData:
+ secret: $2y$05$D4SPFxzfWKcx1OXfVhRbvOTH/QB0Lm6AXTk8.NOmU4rPLX2t6UUuW # htpasswd -nbB "" foo | cut -c 2-
+ othersecret: $2y$05$HbLL.g5dUqJippH0RuAGL.RaM9wNS2cT7hp6.vbv5okdCmVBSDzzK # htpasswd -nbB "" bar | cut -c 2-
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|:-----------------------------|:------------------------------------------------|:--------|:---------|
+| | Defines the header name containing the secret sent by the client.
Either `keySource.header` or `keySource.query` or `keySource.cookie` must be set. | "" | No |
+| | Defines the scheme when using `Authorization` as header name.
Check out the `Authorization` header [documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization#syntax). | "" | No |
+| `keySource.query` | Defines the query parameter name containing the secret sent by the client.
Either `keySource.header` or `keySource.query` or `keySource.cookie` must be set. | "" | No |
+| `keySource.cookie` | Defines the cookie name containing the secret sent by the client.
Either `keySource.header` or `keySource.query` or `keySource.cookie` must be set. | "" | No |
+| `secretNonBase64Encoded` | Defines whether the secret sent by the client is base64 encoded. | false | No |
+| `secretValues` | Contain the hash of the API keys.
Supported hashing algorithms are Bcrypt, SHA1 and MD5.
The hash should be generated using `htpasswd`.
Can reference a Kubernetes Secret using the URN format: `urn:k8s:secret:[name]:[valueKey]` | [] | Yes |
+
+{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/basicauth.md b/docs/content/reference/routing-configuration/http/middlewares/basicauth.md
index 29587f6a3..be372250b 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/basicauth.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/basicauth.md
@@ -3,8 +3,6 @@ title: "Traefik BasicAuth Documentation"
description: "The HTTP basic authentication (BasicAuth) middleware in Traefik Proxy restricts access to your Services to known users. Read the technical documentation."
---
-
-
The `basicAuth` middleware grants access to services to authorized users only.
## Configuration Examples
@@ -66,11 +64,11 @@ spec:
| Field | Description | Default | Required |
|:-----------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
-| `users` | Array of authorized users. Each user must be declared using the `name:hashed-password` format. (More information [here](#users))| "" | No |
-| `usersFile` | Path to an external file that contains the authorized users for the middleware.
The file content is a list of `name:hashed-password`. (More information [here](#usersfile)) | "" | No |
-| `realm` | Allow customizing the realm for the authentication.| "traefik" | No |
-| `headerField` | Allow defining a header field to store the authenticated user.| "" | No |
-| `removeHeader` | Allow removing the authorization header before forwarding the request to your service. | false | No |
+| `users` | Array of authorized users. Each user must be declared using the `name:hashed-password` format. (More information [here](#users-usersfile))| "" | No |
+| `usersFile` | Path to an external file that contains the authorized users for the middleware.
The file content is a list of `name:hashed-password`. (More information [here](#users-usersfile)) | "" | No |
+| `realm` | Allow customizing the realm for the authentication.| "traefik" | No |
+| | Allow defining a header field to store the authenticated user.| "" | No |
+| | Allow removing the authorization header before forwarding the request to your service. | false | No |
### Passwords format
diff --git a/docs/content/reference/routing-configuration/http/middlewares/buffering.md b/docs/content/reference/routing-configuration/http/middlewares/buffering.md
index 4fe818ded..af334a221 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/buffering.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/buffering.md
@@ -3,8 +3,6 @@ title: "Traefik Buffering Documentation"
description: "The HTTP buffering middleware in Traefik Proxy limits the size of requests that can be forwarded to Services. Read the technical documentation."
---
-
-
The `buffering` middleware limits the size of requests that can be forwarded to services.
With buffering, Traefik reads the entire request into memory (possibly buffering large requests into disk), and rejects requests that are over a specified size limit.
@@ -60,11 +58,11 @@ spec:
| Field | Description | Default | Required |
|:------|:------------|:--------|:---------|
-| `maxRequestBodyBytes` | Maximum allowed body size for the request (in bytes).
If the request exceeds the allowed size, it is not forwarded to the Service, and the client gets a `413` (Request Entity Too Large) response. | 0 | No |
-| `memRequestBodyBytes` | Threshold (in bytes) from which the request will be buffered on disk instead of in memory with the `memRequestBodyBytes` option.| 1048576 | No |
-| `maxResponseBodyBytes` | Maximum allowed response size from the Service (in bytes).
If the response exceeds the allowed size, it is not forwarded to the client. The client gets a `500` (Internal Server Error) response instead. | 0 | No |
-| `memResponseBodyBytes` | Threshold (in bytes) from which the response will be buffered on disk instead of in memory with the `memResponseBodyBytes` option.| 1048576 | No |
-| `retryExpression` | Replay the request using `retryExpression`.
More information [here](#retryexpression). | "" | No |
+| `maxRequestBodyBytes` | Maximum allowed body size for the request (in bytes).
If the request exceeds the allowed size, it is not forwarded to the Service, and the client gets a `413` (Request Entity Too Large) response. | 0 | No |
+| `memRequestBodyBytes` | Threshold (in bytes) from which the request will be buffered on disk instead of in memory with the `memRequestBodyBytes` option.| 1048576 | No |
+| `maxResponseBodyBytes` | Maximum allowed response size from the Service (in bytes).
If the response exceeds the allowed size, it is not forwarded to the client. The client gets a `500` (Internal Server Error) response instead. | 0 | No |
+| `memResponseBodyBytes` | Threshold (in bytes) from which the response will be buffered on disk instead of in memory with the `memResponseBodyBytes` option.| 1048576 | No |
+| `retryExpression` | Replay the request using `retryExpression`.
More information [here](#retryexpression). | "" | No |
### retryExpression
diff --git a/docs/content/reference/routing-configuration/http/middlewares/chain.md b/docs/content/reference/routing-configuration/http/middlewares/chain.md
index 3eb1e6ad4..2cb81665d 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/chain.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/chain.md
@@ -168,4 +168,4 @@ spec:
| Field | Description | Default | Required |
|:------|:------------|:--------|:---------|
-| `middlewares` | List of middlewares to chain.
The middlewares have to be in the same namespace as the `chain` middleware. | [] | Yes |
+| `middlewares` | List of middlewares to chain.
The middlewares have to be in the same namespace as the `chain` middleware. | [] | Yes |
diff --git a/docs/content/reference/routing-configuration/http/middlewares/circuitbreaker.md b/docs/content/reference/routing-configuration/http/middlewares/circuitbreaker.md
index dfd2be843..999041adc 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/circuitbreaker.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/circuitbreaker.md
@@ -3,8 +3,6 @@ title: "Traefik CircuitBreaker Documentation"
description: "The HTTP circuit breaker in Traefik Proxy prevents stacking requests to unhealthy Services, resulting in cascading failures. Read the technical documentation."
---
-
-
The HTTP circuit breaker prevents stacking requests to unhealthy Services, resulting in cascading failures.
When your system is healthy, the circuit is closed (normal operations).
@@ -67,11 +65,11 @@ spec:
| Field | Description | Default | Required |
|:------|:------------|:--------|:---------|
-| `expression` | Condition to open the circuit breaker and applies the fallback mechanism instead of calling your services.
More information [here](#expression) | 100ms | No |
-| `checkPeriod` | The interval between successive checks of the circuit breaker condition (when in standby state). | 100ms | No |
-| `fallbackDuration` | The duration for which the circuit breaker will wait before trying to recover (from a tripped state). | 10s | No |
-| `recoveryDuration` | The duration for which the circuit breaker will try to recover (as soon as it is in recovering state). | 10s | No |
-| `responseCode` | The status code that the circuit breaker will return while it is in the open state. | 503 | No |
+| `expression` | Condition to open the circuit breaker and applies the fallback mechanism instead of calling your services.
More information [here](#expression) | 100ms | No |
+| `checkPeriod` | The interval between successive checks of the circuit breaker condition (when in standby state). | 100ms | No |
+| `fallbackDuration` | The duration for which the circuit breaker will wait before trying to recover (from a tripped state). | 10s | No |
+| `recoveryDuration` | The duration for which the circuit breaker will try to recover (as soon as it is in recovering state). | 10s | No |
+| `responseCode` | The status code that the circuit breaker will return while it is in the open state. | 503 | No |
### expression
@@ -79,9 +77,9 @@ The `expression` option can check three different metrics:
| Metrics | Description | Example |
|:------|:------------|:--------|
-| `NetworkErrorRatio` | The network error ratio to open the circuit breaker. | `NetworkErrorRatio() > 0.30` opens the circuit breaker at a 30% ratio of network errors |
-| `ResponseCodeRatio` | The status code ratio to open the circuit breaker.
More information [below](#responsecoderatio) | `ResponseCodeRatio(500, 600, 0, 600) > 0.25` opens the circuit breaker if 25% of the requests returned a 5XX status (amongst the request that returned a status code from 0 to 5XX) |
-| `LatencyAtQuantileMS` | The latency at a quantile in milliseconds to open the circuit breaker when a given proportion of your requests become too slow.
Only floating point number (with the trailing .0) for the quantile value. | `LatencyAtQuantileMS(50.0) > 100` opens the circuit breaker when the median latency (quantile 50) reaches 100ms. |
+| `NetworkErrorRatio` | The network error ratio to open the circuit breaker. | `NetworkErrorRatio() > 0.30` opens the circuit breaker at a 30% ratio of network errors |
+| `ResponseCodeRatio` | The status code ratio to open the circuit breaker.
More information [below](#responsecoderatio) | `ResponseCodeRatio(500, 600, 0, 600) > 0.25` opens the circuit breaker if 25% of the requests returned a 5XX status (amongst the request that returned a status code from 0 to 5XX) |
+| `LatencyAtQuantileMS` | The latency at a quantile in milliseconds to open the circuit breaker when a given proportion of your requests become too slow.
Only floating point number (with the trailing .0) for the quantile value. | `LatencyAtQuantileMS(50.0) > 100` opens the circuit breaker when the median latency (quantile 50) reaches 100ms. |
#### ResponseCodeRatio
@@ -113,8 +111,8 @@ Here is the list of supported operators:
### Fallback mechanism
-The fallback mechanism returns a `HTTP 503 Service Unavailable` to the client instead of calling the target service.
-This behavior cannot be configured.
+By default the fallback mechanism returns a `HTTP 503 Service Unavailable` to the client instead of calling the target service.
+The response code can be configured.
## State
diff --git a/docs/content/reference/routing-configuration/http/middlewares/compress.md b/docs/content/reference/routing-configuration/http/middlewares/compress.md
index e1b8ad8d4..f67c62c9a 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/compress.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/compress.md
@@ -51,11 +51,11 @@ spec:
| Field | Description | Default | Required |
|:-----------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
-|`excludedContentTypes` | List of content types to compare the `Content-Type` header of the incoming requests and responses before compressing.
The responses with content types defined in `excludedContentTypes` are not compressed.
Content types are compared in a case-insensitive, whitespace-ignored manner.
**The `excludedContentTypes` and `includedContentTypes` options are mutually exclusive.** | "" | No |
-|`defaultEncoding` | specifies the default encoding if the `Accept-Encoding` header is not in the request or contains a wildcard (`*`). | "" | No |
-|`encodings` | Specifies the list of supported compression encodings. At least one encoding value must be specified, and valid entries are `zstd` (Zstandard), `br` (Brotli), and `gzip` (Gzip). The order of the list also sets the priority, the top entry has the highest priority. | zstd, br, gzip | No |
-| `includedContentTypes` | List of content types to compare the `Content-Type` header of the responses before compressing.
The responses with content types defined in `includedContentTypes` are compressed.
Content types are compared in a case-insensitive, whitespace-ignored manner.
**The `excludedContentTypes` and `includedContentTypes` options are mutually exclusive.** | "" | No |
-| `minResponseBodyBytes` | `Minimum amount of bytes a response body must have to be compressed.
Responses smaller than the specified values will **not** be compressed. | 1024 | No |
+| `excludedContentTypes` | List of content types to compare the `Content-Type` header of the incoming requests and responses before compressing.
The responses with content types defined in `excludedContentTypes` are not compressed.
Content types are compared in a case-insensitive, whitespace-ignored manner.
**The `excludedContentTypes` and `includedContentTypes` options are mutually exclusive.** | "" | No |
+| `defaultEncoding` | specifies the default encoding if the `Accept-Encoding` header is not in the request or contains a wildcard (`*`). | "" | No |
+| `encodings` | Specifies the list of supported compression encodings. At least one encoding value must be specified, and valid entries are `zstd` (Zstandard), `br` (Brotli), and `gzip` (Gzip). The order of the list also sets the priority, the top entry has the highest priority. | zstd, br, gzip | No |
+| `includedContentTypes` | List of content types to compare the `Content-Type` header of the responses before compressing.
The responses with content types defined in `includedContentTypes` are compressed.
Content types are compared in a case-insensitive, whitespace-ignored manner.
**The `excludedContentTypes` and `includedContentTypes` options are mutually exclusive.** | "" | No |
+| `minResponseBodyBytes` | `Minimum amount of bytes a response body must have to be compressed.
Responses smaller than the specified values will **not** be compressed. | 1024 | No |
## Compression activation
diff --git a/docs/content/reference/routing-configuration/http/middlewares/digestauth.md b/docs/content/reference/routing-configuration/http/middlewares/digestauth.md
index 22dd5b4bf..974ef48ce 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/digestauth.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/digestauth.md
@@ -3,8 +3,6 @@ title: "Traefik DigestAuth Documentation"
description: "Traefik Proxy's HTTP DigestAuth middleware restricts access to your services to known users. Read the technical documentation."
---
-
-
The `DigestAuth` middleware grants access to services to authorized users only.
## Configuration Examples
@@ -61,11 +59,11 @@ spec:
| Field | Description | Default | Required |
|:-----------|:---------------------------------------------------------------------------------|:--------|:---------|
-| `users` | Array of authorized users. Each user must be declared using the `name:realm:encoded-password` format.
The option `users` supports Kubernetes secrets.
(More information [here](#users--usersfile))| [] | No |
-| `usersFile` | Path to an external file that contains the authorized users for the middleware.
The file content is a list of `name:realm:encoded-password`. (More information [here](#users--usersfile)) | "" | No |
-| `realm` | Allow customizing the realm for the authentication.| "traefik" | No |
-| `headerField` | Allow defining a header field to store the authenticated user.| "" | No |
-| `removeHeader` | Allow removing the authorization header before forwarding the request to your service. | false | No |
+| `users` | Array of authorized users. Each user must be declared using the `name:realm:encoded-password` format.
The option `users` supports Kubernetes secrets.
(More information [here](#users--usersfile))| [] | No |
+| `usersFile` | Path to an external file that contains the authorized users for the middleware.
The file content is a list of `name:realm:encoded-password`. (More information [here](#users--usersfile)) | "" | No |
+| `realm` | Allow customizing the realm for the authentication.| "traefik" | No |
+| | Allow defining a header field to store the authenticated user.| "" | No |
+| | Allow removing the authorization header before forwarding the request to your service. | false | No |
### Passwords format
diff --git a/docs/content/reference/routing-configuration/http/middlewares/distributed-ratelimit.md b/docs/content/reference/routing-configuration/http/middlewares/distributed-ratelimit.md
new file mode 100644
index 000000000..a5f7eb94e
--- /dev/null
+++ b/docs/content/reference/routing-configuration/http/middlewares/distributed-ratelimit.md
@@ -0,0 +1,181 @@
+---
+title: "Distributed RateLimit"
+description: "Traefik Hub API Gateway - The Distributed RateLimit middleware ensures Services receive fair amounts of requests throughout your cluster and not only on an individual proxy."
+---
+
+!!! info "Traefik Hub Feature"
+ This middleware is available exclusively in [Traefik Hub](https://traefik.io/traefik-hub/). Learn more about [Traefik Hub's advanced features](https://doc.traefik.io/traefik-hub/api-gateway/intro).
+
+The Distributed RateLimit middleware ensures that requests are limited over time throughout your cluster and not only on an individual proxy.
+
+It is based on a [token bucket](https://en.wikipedia.org/wiki/Token_bucket) implementation.
+
+---
+
+## Configuration Example
+
+Below is an advanced configuration that enables the Distributed RateLimit middleware with Redis backend for cluster-wide rate limiting.
+
+```yaml tab="Middleware Distributed Rate Limit"
+# Here, a limit of 100 requests per second is allowed.
+# In addition, a burst of 200 requests is allowed.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-distributedratelimit
+ namespace: traefik
+spec:
+ plugin:
+ distributedRateLimit:
+ burst: 200
+ denyOnError: false
+ limit: 100
+ period: 1s
+ responseHeaders: true
+ sourceCriterion:
+ ipStrategy:
+ excludedIPs:
+ - 172.20.176.201
+ store:
+ redis:
+ endpoints:
+ - my-release-redis-master.default.svc.cluster.local:6379
+ # Use the field password of the Secret redis in the same namespace
+ password: urn:k8s:secret:redis:password
+ timeout: 500ms
+```
+
+```yaml tab="Kubernetes Secret"
+apiVersion: v1
+kind: Secret
+metadata:
+ name: redis
+ namespace: traefik
+stringData:
+ password: mysecret12345678
+```
+
+## Rate and Burst
+
+The rate is defined by dividing `limit` by `period`.
+For a rate below 1 req/s, define a `period` larger than a second
+
+The middleware is based on a [token bucket](https://en.wikipedia.org/wiki/Token_bucket) implementation.
+In this analogy, the `limit` and `period` parameters define the **rate** at which the bucket refills, and the `burst` is the size (volume) of the bucket.
+
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-ratelimit
+spec:
+ plugin:
+ distributedRateLimit:
+ burst: 100
+ period: 1m
+ limit: 6
+```
+
+In the example above, the middleware allows up to 100 connections in parallel (`burst`).
+Each connection consume a token, once the 100 tokens are consumed, the other ones are blocked until at least one token is available in the bucket.
+
+When the bucket is not full, on token is generated every 10 seconds (6 every 1 minutes (`period` / `limit`)).
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|:-----------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
+| `limit` | Number of requests used to define the rate using the `period`.
0 means **no rate limiting**.
More information [here](#rate-and-burst).| 0 | No |
+| `period` | Period of time used to define the rate.
More information [here](#rate-and-burst).| 1s | No |
+| `burst` | Maximum number of requests allowed to go through at the very same moment.
More information [here](#rate-and-burst). | 1 | No |
+| `denyOnError` | Forces to return a 429 error if the number of remaining requests accepted cannot be get.
Set to `false`, this option allows the request to reach the backend. | true | No |
+| | Injects the following rate limiting headers in the response:
- `X-Rate-Limit-Remaining`
- `X-Rate-Limit-Limit`
- `X-Rate-Limit-Period`
- `X-Rate-Limit-Reset`
The added headers indicate how many tokens are left in the bucket (in the token bucket analogy) after the reservation for the request was made. | false | No |
+| `store.redis.endpoints` | Endpoints of the Redis instances to connect to (example: `redis.traefik-hub.svc.cluster.local:6379`) | "" | Yes |
+| `store.redis.username` | The username Traefik Hub will use to connect to Redis | "" | No |
+| `store.redis.password` | The password Traefik Hub will use to connect to Redis | "" | No |
+| `store.redis.database` | The database Traefik Hub will use to sore information (default: `0`) | "" | No |
+| `store.redis.cluster` | Enable Redis Cluster | "" | No |
+| `store.redis.tls.caBundle` | Custom CA bundle | "" | No |
+| `store.redis.tls.cert` | TLS certificate | "" | No |
+| `store.redis.tls.key` | TLS key | "" | No |
+| `store.redis.tls.insecureSkipVerify` | Allow skipping the TLS verification | "" | No |
+| `store.redis.sentinel.masterSet` | Name of the set of main nodes to use for main selection. Required when using Sentinel. | "" | No |
+| `store.redis.sentinel.username` | Username to use for sentinel authentication (can be different from `username`) | "" | No |
+| `store.redis.sentinel.password` | Password to use for sentinel authentication (can be different from `password`) | "" | No |
+| `sourceCriterion.requestHost` | Whether to consider the request host as the source.
More information about `sourceCriterion`[here](#sourcecriterion). | false | No |
+| | Name of the header used to group incoming requests.
More information about `sourceCriterion`[here](#sourcecriterion). | "" | No |
+| `sourceCriterion.ipStrategy.depth` | Depth position of the IP to select in the `X-Forwarded-For` header (starting from the right).
0 means no depth.
If greater than the total number of IPs in `X-Forwarded-For`, then the client IP is empty
If higher than 0, the `excludedIPs` options is not evaluated.
More information about [`sourceCriterion`](#sourcecriterion), [`ipStrategy`](#ipstrategy), and [`depth`](#sourcecriterionipstrategydepth) below. | 0 | No |
+| `sourceCriterion.ipStrategy.excludedIPs` | Allows Traefik to scan the `X-Forwarded-For` header and select the first IP not in the list.
If `depth` is specified, `excludedIPs` is ignored.
More information about [`sourceCriterion`](#sourcecriterion), [`ipStrategy`](#ipstrategy), and [`excludedIPs`](#sourcecriterionipstrategyexcludedips) below. | | No |
+
+### sourceCriterion
+
+The `sourceCriterion` option defines what criterion is used to group requests as originating from a common source.
+If several strategies are defined at the same time, an error will be raised.
+If none are set, the default is to use the request's remote address field (as an `ipStrategy`).
+
+### ipStrategy
+
+The `ipStrategy` option defines two parameters that configures how Traefik determines the client IP: `depth`, and `excludedIPs`.
+
+As a middleware, rate-limiting happens before the actual proxying to the backend takes place.
+In addition, the previous network hop only gets appended to `X-Forwarded-For` during the last stages of proxying, that is after it has already passed through rate-limiting.
+Therefore, during rate-limiting, as the previous network hop is not yet present in `X-Forwarded-For`, it cannot be found and/or relied upon.
+
+### sourceCriterion.ipStrategy.depth
+
+If `depth` is set to 2, and the request `X-Forwarded-For` header is `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` then the "real" client IP is `"10.0.0.1"` (at depth 4) but the IP used as the criterion is `"12.0.0.1"` (`depth=2`).
+
+| `X-Forwarded-For` | `depth` | clientIP |
+|-----------------------------------------|---------|--------------|
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `1` | `"13.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `3` | `"11.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `5` | `""` |
+
+### sourceCriterion.ipStrategy.excludedIPs
+
+Contrary to what the name might suggest, this option is *not* about excluding an IP from the rate limiter, and therefore cannot be used to deactivate rate limiting for some IPs.
+
+`excludedIPs` is meant to address two classes of somewhat distinct use-cases:
+
+1. Distinguish IPs which are behind the same (set of) reverse-proxies so that each of them contributes, independently to the others, to its own rate-limit "bucket" (cf the [token bucket](https://en.wikipedia.org/wiki/Token_bucket)).
+In this case, `excludedIPs` should be set to match the list of `X-Forwarded-For IPs` that are to be excluded, in order to find the actual clientIP.
+
+Example to use each IP as a distinct source:
+
+| `X-Forwarded-For` | excludedIPs | clientIP |
+|--------------------------------|-----------------------|--------------|
+| `"10.0.0.1,11.0.0.1,12.0.0.1"` | `"11.0.0.1,12.0.0.1"` | `"10.0.0.1"` |
+| `"10.0.0.2,11.0.0.1,12.0.0.1"` | `"11.0.0.1,12.0.0.1"` | `"10.0.0.2"` |
+
+2. Group together a set of IPs (also behind a common set of reverse-proxies) so that they are considered the same source, and all contribute to the same rate-limit bucket.
+
+Example to group IPs together as same source:
+
+| `X-Forwarded-For` | excludedIPs | clientIP |
+|--------------------------------|--------------|--------------|
+| `"10.0.0.1,11.0.0.1,12.0.0.1"` | `"12.0.0.1"` | `"11.0.0.1"` |
+| `"10.0.0.2,11.0.0.1,12.0.0.1"` | `"12.0.0.1"` | `"11.0.0.1"` |
+| `"10.0.0.3,11.0.0.1,12.0.0.1"` | `"12.0.0.1"` | `"11.0.0.1"` |
+
+### store
+
+A Distributed Rate Limit middleware uses a persistent KV storage to store data.
+
+Refer to the [redis options](#configuration-options) to configure the Redis connection.
+
+Connection parameters to your [Redis](https://redis.io/ "Link to website of Redis") server are attached to your Middleware deployment.
+
+The following Redis modes are supported:
+
+- Single instance mode
+- [Redis Cluster](https://redis.io/docs/management/scaling "Link to official Redis documentation about Redis Cluster mode")
+- [Redis Sentinel](https://redis.io/docs/management/sentinel "Link to official Redis documentation about Redis Sentinel mode")
+
+For more information about Redis, we recommend the [official Redis documentation](https://redis.io/docs/ "Link to official Redis documentation").
+
+!!! info
+
+ If you use Redis in single instance mode or Redis Sentinel, you can configure the `database` field.
+ This value won't be taken into account if you use Redis Cluster (only database `0` is available).
+
+ In this case, a warning is displayed, and the value is ignored.
diff --git a/docs/content/reference/routing-configuration/http/middlewares/errorpages.md b/docs/content/reference/routing-configuration/http/middlewares/errorpages.md
index 456badfbd..2855a5cbb 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/errorpages.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/errorpages.md
@@ -3,8 +3,6 @@ title: "Traefik Errors Documentation"
description: "In Traefik Proxy, the Errors middleware returns custom pages according to configured ranges of HTTP Status codes. Read the technical documentation."
---
-
-
The `errors` middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.
## Configuration Examples
@@ -20,6 +18,9 @@ http:
- "501"
- "503"
- "505-599"
+ statusRewrites:
+ "418": "404"
+ "502-504": "500"
service: error-handler-service
query: "/{status}.html"
@@ -35,6 +36,10 @@ http:
service = "error-handler-service"
query = "/{status}.html"
+ [http.middlewares.test-errors.errors.statusRewrites]
+ "418" = "404"
+ "502-504" = "500"
+
[http.services]
# ... definition of the error-handler-service
```
@@ -43,6 +48,8 @@ http:
# Dynamic Custom Error Page for 5XX Status Code
labels:
- "traefik.http.middlewares.test-errors.errors.status=500,501,503,505-599"
+ - "traefik.http.middlewares.test-errors.errors.statusRewrites.418=404"
+ - "traefik.http.middlewares.test-errors.errors.statusRewrites.502-504=500"
- "traefik.http.middlewares.test-errors.errors.service=error-handler-service"
- "traefik.http.middlewares.test-errors.errors.query=/{status}.html"
```
@@ -53,6 +60,8 @@ labels:
// ...
"Tags": [
"traefik.http.middlewares.test-errors.errors.status=500,501,503,505-599",
+ "traefik.http.middlewares.test-errors.errors.statusRewrites.418=404",
+ "traefik.http.middlewares.test-errors.errors.statusRewrites.502-504=500",
"traefik.http.middlewares.test-errors.errors.service=error-handler-service",
"traefik.http.middlewares.test-errors.errors.query=/{status}.html"
]
@@ -73,6 +82,9 @@ spec:
- "501"
- "503"
- "505-599"
+ statusRewrites:
+ "418": "404"
+ "502-504": "500"
query: /{status}.html
service:
name: error-handler-service
@@ -83,9 +95,10 @@ spec:
| Field | Description | Default | Required |
|:-----------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
-| `status` | Defines which status or range of statuses should result in an error page.
The status code ranges are inclusive (`505-599` will trigger with every code between `505` and `599`, `505` and `599` included).
You can define either a status code as a number (`500`), as multiple comma-separated numbers (`500,502`), as ranges by separating two codes with a dash (`505-599`), or a combination of the two (`404,418,505-599`). | [] | No |
-| `service` | The service that will serve the new requested error page.
More information [here](#service-and-hostheader). | "" | No |
-| `query` | The URL for the error page (hosted by `service`).
More information [here](#query) | "" | No |
+| `status` | Defines which status or range of statuses should result in an error page.
The status code ranges are inclusive (`505-599` will trigger with every code between `505` and `599`, `505` and `599` included).
You can define either a status code as a number (`500`), as multiple comma-separated numbers (`500,502`), as ranges by separating two codes with a dash (`505-599`), or a combination of the two (`404,418,505-599`). | [] | No |
+| `statusRewrites` | An optional mapping of status codes to be rewritten. More information [here](#statusrewrites). | [] | No |
+| `service` | The service that will serve the new requested error page.
More information [here](#service-and-hostheader). | "" | No |
+| `query` | The URL for the error page (hosted by `service`).
More information [here](#query) | "" | No |
### service and HostHeader
@@ -96,6 +109,15 @@ the [`passHostHeader`](../../../../routing/services/index.md#pass-host-header) o
!!!info "Kubernetes"
When specifying a service in Kubernetes (e.g., in an IngressRoute), you need to reference the `name`, `namespace`, and `port` of your Kubernetes Service resource. For example, `my-service.my-namespace@kubernetescrd` (or `my-service.my-namespace@kubernetescrd:80`) ensures that requests go to the correct service and port.
+### statusRewrites
+
+`statusRewrites` is an optional mapping of status codes to be rewritten.
+
+For example, if a service returns a 418, you might want to rewrite it to a 404.
+You can map individual status codes or even ranges to a different status code.
+
+The syntax for ranges follows the same rules as the `status` option.
+
### query
There are multiple variables that can be placed in the `query` option to insert values in the URL.
@@ -104,5 +126,6 @@ The table below lists all the available variables and their associated values.
| Variable | Value |
|------------|------------------------------------------------------------------|
-| `{status}` | The response status code. |
-| `{url}` | The [escaped](https://pkg.go.dev/net/url#QueryEscape) request URL.|
+| `{status}` | The response status code. |
+| `{originalStatus}` | The original response status code, if it has been modified by the `statusRewrites` option. |
+| `{url}` | The [escaped](https://pkg.go.dev/net/url#QueryEscape) request URL.|
diff --git a/docs/content/reference/routing-configuration/http/middlewares/forwardauth.md b/docs/content/reference/routing-configuration/http/middlewares/forwardauth.md
index 62a61bc7e..5df864c26 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/forwardauth.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/forwardauth.md
@@ -3,8 +3,6 @@ title: "Traefik ForwardAuth Documentation"
description: "In Traefik Proxy, the HTTP ForwardAuth middleware delegates authentication to an external Service. Read the technical documentation."
---
-
-
The `forwardAuth` middleware delegates authentication to an external service.
If the service answers with a 2XX code, access is granted, and the original request is performed.
Otherwise, the response from the authentication server is returned.
@@ -57,23 +55,23 @@ spec:
| Field | Description | Default | Required |
|:-----------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
-| `address` | Authentication server address. | "" | Yes |
-| `trustForwardHeader` | Trust all `X-Forwarded-*` headers. | false | No |
-| `authResponseHeaders` | List of headers to copy from the authentication server response and set on forwarded request, replacing any existing conflicting headers. | [] | No |
-| `authResponseHeadersRegex` | Regex to match by the headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.
More information [here](#authresponseheadersregex). | "" | No |
-| `authRequestHeaders` | List of the headers to copy from the request to the authentication server.
It allows filtering headers that should not be passed to the authentication server.
If not set or empty, then all request headers are passed. | [] | No |
-| `addAuthCookiesToResponse` | List of cookies to copy from the authentication server to the response, replacing any existing conflicting cookie from the forwarded response.
Please note that all backend cookies matching the configured list will not be added to the response. | [] | No |
-| `forwardBody` | Sets the `forwardBody` option to `true` to send the Body. As body is read inside Traefik before forwarding, this breaks streaming. | false | No |
-| `maxBodySize` | Set the `maxBodySize` to limit the body size in bytes. If body is bigger than this, it returns a 401 (unauthorized). | -1 | No |
-| `headerField` | Defines a header field to store the authenticated user. | "" | No |
-| `preserveLocationHeader` | Defines whether to forward the Location header to the client as is or prefix it with the domain name of the authentication server. | false | No |
-| `PreserveRequestMethod` | Defines whether to preserve the original request method while forwarding the request to the authentication server. | false | No |
-| `tls.ca` | Sets the path to the certificate authority used for the secured connection to the authentication server, it defaults to the system bundle. | "" | No |
-| `tls.cert` | Sets the path to the public certificate used for the secure connection to the authentication server. When using this option, setting the key option is required. | "" | No |
-| `tls.key` | Sets the path to the private key used for the secure connection to the authentication server. When using this option, setting the `cert` option is required. | "" | No |
-| `tls.caSecret` | Defines the secret that contains the certificate authority used for the secured connection to the authentication server, it defaults to the system bundle. **This option is only available for the Kubernetes CRD**. | | No |
-| `tls.certSecret` | Defines the secret that contains both the private and public certificates used for the secure connection to the authentication server. **This option is only available for the Kubernetes CRD**. | | No |
-| `tls.insecureSkipVerify` | During TLS connections, if this option is set to `true`, the authentication server will accept any certificate presented by the server regardless of the host names it covers. | false | No |
+| `address` | Authentication server address. | "" | Yes |
+| | Trust all `X-Forwarded-*` headers. | false | No |
+| | List of headers to copy from the authentication server response and set on forwarded request, replacing any existing conflicting headers. | [] | No |
+| | Regex to match by the headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.
More information [here](#authresponseheadersregex). | "" | No |
+| | List of the headers to copy from the request to the authentication server.
It allows filtering headers that should not be passed to the authentication server.
If not set or empty, then all request headers are passed. | [] | No |
+| `addAuthCookiesToResponse` | List of cookies to copy from the authentication server to the response, replacing any existing conflicting cookie from the forwarded response.
Please note that all backend cookies matching the configured list will not be added to the response. | [] | No |
+| `forwardBody` | Sets the `forwardBody` option to `true` to send the Body. As body is read inside Traefik before forwarding, this breaks streaming. | false | No |
+| `maxBodySize` | Set the `maxBodySize` to limit the body size in bytes. If body is bigger than this, it returns a 401 (unauthorized). | -1 | No |
+| | Defines a header field to store the authenticated user. | "" | No |
+| | Defines whether to forward the Location header to the client as is or prefix it with the domain name of the authentication server. | false | No |
+| `preserveRequestMethod` | Defines whether to preserve the original request method while forwarding the request to the authentication server. | false | No |
+| `tls.ca` | Sets the path to the certificate authority used for the secured connection to the authentication server, it defaults to the system bundle. | "" | No |
+| `tls.cert` | Sets the path to the public certificate used for the secure connection to the authentication server. When using this option, setting the key option is required. | "" | No |
+| `tls.key` | Sets the path to the private key used for the secure connection to the authentication server. When using this option, setting the `cert` option is required. | "" | No |
+| `tls.caSecret` | Defines the secret that contains the certificate authority used for the secured connection to the authentication server, it defaults to the system bundle. **This option is only available for the Kubernetes CRD**. | | No |
+| `tls.certSecret` | Defines the secret that contains both the private and public certificates used for the secure connection to the authentication server. **This option is only available for the Kubernetes CRD**. | | No |
+| `tls.insecureSkipVerify` | During TLS connections, if this option is set to `true`, the authentication server will accept any certificate presented by the server regardless of the host names it covers. | false | No |
### authResponseHeadersRegex
@@ -89,10 +87,10 @@ The following request properties are provided to the forward-auth target endpoin
| Property | Forward-Request Header |
|-------------------|------------------------|
-| HTTP Method | X-Forwarded-Method |
-| Protocol | X-Forwarded-Proto |
-| Host | X-Forwarded-Host |
-| Request URI | X-Forwarded-Uri |
-| Source IP-Address | X-Forwarded-For |
+| HTTP Method | `X-Forwarded-Method` |
+| Protocol | `X-Forwarded-Proto` |
+| Host | `X-Forwarded-Host` |
+| Request URI | `X-Forwarded-Uri` |
+| Source IP-Address | `X-Forwarded-For` |
{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/grpcweb.md b/docs/content/reference/routing-configuration/http/middlewares/grpcweb.md
index 782266fdd..d478c0b60 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/grpcweb.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/grpcweb.md
@@ -56,7 +56,7 @@ spec:
| Field | Description | Default | Required |
|:-----------------------------|:------------------------------------------|:--------|:---------|
-| `allowOrigins` | List of allowed origins.
A wildcard origin `*` can also be configured to match all requests.
More information [here](#alloworigins). | [] | No |
+| `allowOrigins` | List of allowed origins.
A wildcard origin `*` can also be configured to match all requests.
More information [here](#alloworigins). | [] | No |
### allowOrigins
diff --git a/docs/content/reference/routing-configuration/http/middlewares/headers.md b/docs/content/reference/routing-configuration/http/middlewares/headers.md
index 2d419fc9f..5d468363e 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/headers.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/headers.md
@@ -3,19 +3,17 @@ title: "Traefik Headers Documentation"
description: "In Traefik Proxy, the HTTP headers middleware manages the headers of requests and responses. Read the technical documentation."
---
-
-
The Headers middleware manages the headers of requests and responses.
By default, the following headers are automatically added when proxying requests:
| Property | HTTP Header |
|---------------------------|----------------------------|
-| Client's IP | X-Forwarded-For, X-Real-Ip |
-| Host | X-Forwarded-Host |
-| Port | X-Forwarded-Port |
-| Protocol | X-Forwarded-Proto |
-| Proxy Server's Hostname | X-Forwarded-Server |
+| Client's IP | `X-Forwarded-For`, `X-Real-Ip` |
+| Host | `X-Forwarded-Host` |
+| Port | `X-Forwarded-Port` |
+| Protocol | `X-Forwarded-Proto` |
+| Proxy Server's Hostname | `X-Forwarded-Server` |
## Configuration Examples
@@ -268,34 +266,34 @@ spec:
| Field | Description | Default | Required |
| ----------------------------- | ------------------------------------------------- | --------- | -------- |
-| `customRequestHeaders` | Lists the header names and values for requests. | [] | No |
-| `customResponseHeaders` | Lists the header names and values for responses. | [] | No |
-| `accessControlAllowCredentials` | Indicates if the request can include user credentials.| false | No |
-| `accessControlAllowHeaders` | Specifies allowed request header names. | [] | No |
-| `accessControlAllowMethods` | Specifies allowed request methods. | [] | No |
-| `accessControlAllowOriginList` | Specifies allowed origins. More information [here](#accesscontrolalloworiginlist) | [] | No |
-| `accessControlAllowOriginListRegex` | Allows origins matching regex. More information [here](#accesscontrolalloworiginlistregex) | [] | No |
-| `accessControlExposeHeaders` | Specifies which headers are safe to expose to the API of a CORS API specification. | [] | No |
-| `accessControlMaxAge` | Time (in seconds) to cache preflight requests. | 0 | No |
-| `addVaryHeader` | Used in conjunction with `accessControlAllowOriginList` to determine whether the `Vary` header should be added or modified to demonstrate that server responses can differ based on the value of the origin header. | false | No |
-| `allowedHosts` | Lists allowed domain names. | [] | No |
-| `hostsProxyHeaders` | Specifies header keys for proxied hostname. | [] | No |
-| `sslProxyHeaders` | Defines a set of header keys with associated values that would indicate a valid HTTPS request. It can be useful when using other proxies (example: `"X-Forwarded-Proto": "https"`). | {} | No |
-| `stsSeconds` | Max age for `Strict-Transport-Security` header. | 0 | No |
-| `stsIncludeSubdomains` | If set to `true`, the `includeSubDomains` directive is appended to the `Strict-Transport-Security` header. | false | No |
-| `stsPreload` | Adds preload flag to STS header. | false | No |
-| `forceSTSHeader` | Adds STS header for HTTP connections. | false | No |
-| `frameDeny` | Set `frameDeny` to `true` to add the `X-Frame-Options` header with the value of `DENY`. | false | No |
-| `customFrameOptionsValue` | allows the `X-Frame-Options` header value to be set with a custom value. This overrides the `FrameDeny` option. | "" | No |
-| `contentTypeNosniff` | Set `contentTypeNosniff` to true to add the `X-Content-Type-Options` header with the value `nosniff`. | false | No |
-| `browserXssFilter` | Set `browserXssFilter` to true to add the `X-XSS-Protection` header with the value `1; mode=block`. | false | No |
-| `customBrowserXSSValue` | allows the `X-XSS-Protection` header value to be set with a custom value. This overrides the `BrowserXssFilter` option. | false | No |
-| `contentSecurityPolicy` | allows the `Content-Security-Policy` header value to be set with a custom value. | false | No |
-| `contentSecurityPolicyReportOnly` | allows the `Content-Security-Policy-Report-Only` header value to be set with a custom value. | "" | No |
-| `publicKey` | Implements HPKP for certificate pinning. | "" | No |
-| `referrerPolicy` | Controls forwarding of `Referer` header. | "" | No |
-| `permissionsPolicy` | allows sites to control browser features. | "" | No |
-| `isDevelopment` | Set `true` when developing to mitigate the unwanted effects of the `AllowedHosts`, SSL, and STS options. Usually testing takes place using HTTP, not HTTPS, and on `localhost`, not your production domain. | false | No |
+| | Lists the header names and values for requests. | [] | No |
+| | Lists the header names and values for responses. | [] | No |
+| `accessControlAllowCredentials` | Indicates if the request can include user credentials.| false | No |
+| | Specifies allowed request header names. | [] | No |
+| `accessControlAllowMethods` | Specifies allowed request methods. | [] | No |
+| `accessControlAllowOriginList` | Specifies allowed origins. More information [here](#accesscontrolalloworiginlist) | [] | No |
+| `accessControlAllowOriginListRegex` | Allows origins matching regex. More information [here](#accesscontrolalloworiginlistregex) | [] | No |
+| | Specifies which headers are safe to expose to the API of a CORS API specification. | [] | No |
+| `accessControlMaxAge` | Time (in seconds) to cache preflight requests. | 0 | No |
+| | Used in conjunction with `accessControlAllowOriginList` to determine whether the `Vary` header should be added or modified to demonstrate that server responses can differ based on the value of the origin header. | false | No |
+| `allowedHosts` | Lists allowed domain names. | [] | No |
+| | Specifies header keys for proxied hostname. | [] | No |
+| | Defines a set of header keys with associated values that would indicate a valid HTTPS request. It can be useful when using other proxies (example: `"X-Forwarded-Proto": "https"`). | {} | No |
+| `stsSeconds` | Max age for `Strict-Transport-Security` header. | 0 | No |
+| `stsIncludeSubdomains` | If set to `true`, the `includeSubDomains` directive is appended to the `Strict-Transport-Security` header. | false | No |
+| `stsPreload` | Adds preload flag to STS header. | false | No |
+| | Adds STS header for HTTP connections. | false | No |
+| `frameDeny` | Set `frameDeny` to `true` to add the `X-Frame-Options` header with the value of `DENY`. | false | No |
+| `customFrameOptionsValue` | allows the `X-Frame-Options` header value to be set with a custom value. This overrides the `FrameDeny` option. | "" | No |
+| `contentTypeNosniff` | Set `contentTypeNosniff` to true to add the `X-Content-Type-Options` header with the value `nosniff`. | false | No |
+| `browserXssFilter` | Set `browserXssFilter` to true to add the `X-XSS-Protection` header with the value `1; mode=block`. | false | No |
+| `customBrowserXSSValue` | allows the `X-XSS-Protection` header value to be set with a custom value. This overrides the `BrowserXssFilter` option. | false | No |
+| `contentSecurityPolicy` | allows the `Content-Security-Policy` header value to be set with a custom value. | false | No |
+| `contentSecurityPolicyReportOnly` | allows the `Content-Security-Policy-Report-Only` header value to be set with a custom value. | "" | No |
+| `publicKey` | Implements HPKP for certificate pinning. | "" | No |
+| `referrerPolicy` | Controls forwarding of `Referer` header. | "" | No |
+| `permissionsPolicy` | allows sites to control browser features. | "" | No |
+| `isDevelopment` | Set `true` when developing to mitigate the unwanted effects of the `AllowedHosts`, SSL, and STS options. Usually testing takes place using HTTP, not HTTPS, and on `localhost`, not your production domain. | false | No |
### `accessControlAllowOriginList`
diff --git a/docs/content/reference/routing-configuration/http/middlewares/hmac.md b/docs/content/reference/routing-configuration/http/middlewares/hmac.md
new file mode 100644
index 000000000..2eabab306
--- /dev/null
+++ b/docs/content/reference/routing-configuration/http/middlewares/hmac.md
@@ -0,0 +1,207 @@
+---
+title: "HMAC"
+description: "Traefik Hub API Gateway - The HMAC Middleware allows you secure your APIs using the HMAC mechanism."
+---
+
+!!! info "Traefik Hub Feature"
+ This middleware is available exclusively in [Traefik Hub](https://traefik.io/traefik-hub/). Learn more about [Traefik Hub's advanced features](https://doc.traefik.io/traefik-hub/api-gateway/intro).
+
+This middleware validates a digital signature computed using the content of an HTTP request and a shared secret that is
+sent to the proxy using the `Authorization` or `Proxy-Authorization` header.
+
+It ensures:
+
+- **The identity of the sender (Authentication)**: If the signature is validated by the proxy, it means that the sender
+actually owns the shared secret. As a consequence, the sender's identity is considered to be proven.
+- **The integrity of the request**: As the signature is based on a subset of the HTTP request, it means that if the
+signature is validated by the proxy, the request used to generate the signature has not been modified between the sender
+and the proxy. This middleware also allows validating the content integrity using the
+[Digest header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Digest).
+
+This middleware is based on the [HTTP Signature Draft](https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12).
+
+---
+
+## Configuration Example
+
+Below is an advanced configuration that enables the HMAC middleware, sets one secret, ensures that the digest sum of the
+request body is validated and ensures that the given headers must be included in the computation of the signature of the
+request.
+
+```yaml tab="Middleware HMAC"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: hmac-auth
+spec:
+ plugin:
+ hmac:
+ keys:
+ - id: secret-key
+ key: secret
+ validateDigest: true
+ enforcedHeaders:
+ - (request-target)
+ - (created)
+ - (expires)
+ - host
+
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|:------------------|:---------------------------------------------|:--------|:---------|
+| `keys` | A static set of secret keys to be used by HMAC middleware. | | Yes |
+| `validateDigest` | Determines whether the middleware should validate the digest sum of the request body. | true | No |
+| | A set of headers that must be included in the computation of the signature of the request. | | No |
+
+## Authentication Mechanism
+
+The sender and proxy share a common secret identified by a `keyId`. How the sender gets the secret and keeps it safe is out of scope of this documentation.
+
+### Crafting the Authorization Header
+
+To authenticate a request, the sender must provide an `Authorization` or `ProxyAuthorization` header fulfilling the HMAC authentication scheme.
+
+This header carries a set of parameters:
+
+```bash
+Authorization: Hmac keyId="secret-id-1",algorithm="hmac-sha256",headers="(request-target) (created) (expires) host x-example",signature="c29tZXNpZ25hdHVyZQ==",created="1584453022",expires="1584453032"
+```
+
+| Parameter | Description | Example |
+|-------------|--------------------------------|------------------------------------|
+| `keyId` | Identifier of the key being used by the sender to build the signature | `keyId="secret-key-1"` |
+| `algorithm` | Algorithm used to generate the signature.
Supported values are `hmac-sha1`, `hmac-sha256`, `hmac-sha384` and `hmac-sha512`. | `algorithm="hmac-sha512"` |
+| | List of headers to use in order to build the signature string.
Each item **must** be lowercase. | `headers="host content-type"` |
+| `signature` | Digital Signature of the request. See [computing the signature](#computing-the-signature). | `signature="c29tZXNpZ25hdHVyZQ=="` |
+| `created` | Unix timestamp of the signature creation. | `created="1574453022"` |
+| `expires` | Unix timestamp of the signature expiration. | `expires="1574453022"` |
+
+!!! danger "Time sensitivity"
+ If the `created` timestamp is in the future or the `expires` timestamp is in the past, the middleware will refuse the request.
+ This behaviour makes using this middleware sensitive to clock skew between the client and the server.
+
+ Make sure that your client and your server have their clocks synchronized.
+
+### Computing the Signature
+
+The signature is the base64-encoded value of the result of an HMAC signature algorithm computed with a `signature string` and the sender's `secret key`.
+
+For example:
+
+```bash
+signature=base64(HMAC(signatureString, secret))
+```
+
+### Crafting the Signature String
+
+A signed HTTP request needs to be tolerant of some trivial alterations during transmission as it goes through gateways, proxies and other entities.
+As a consequence, signing the whole request is not an option as a single header modification could result in a not valid signature.
+
+To avoid this problem, this middleware builds the `signature string` from a subset of header values defined by the sender with the `headers` parameter of the authorization header.
+
+To build the signature string, the client **must** take the values of each header specified by the `headers` parameter **in the order they appear**, then apply the following logic to each of them:
+
+1. If the header is a special header, then evaluate its value according to [the special headers values section](#special-header-values)
+2. If the header is not a special header, then append the lowercase header name followed with an ASCII colon `:`, an ASCII space \` \` and the header value.
+If the header has multiple values then append those values separated by an ASCII comma `,` and an ASCII space \` \`
+3. If value is not the last value then append an ASCII newline `\n`. The signature string MUST NOT include a trailing ASCII newline
+
+!!! warning
+ All headers values are trimmed from their spaces."
+
+#### Special Header Values
+
+By design, all the information of an HTTP request is not available through headers. However, it makes sense to secure the request using them.
+
+To allow this, the `headers` parameter accepts special header names that can be used.
+
+| Value | Description | Signature String Example |
+| --------------------- | ------------------------------------------------------------- |------------------------- |
+| `(request-target)` | Obtained by concatenating the lowercase `:method`, an ASCII space, and the `:path` pseudo-headers ([as specified in HTTP/2](https://tools.ietf.org/html/rfc7540#section-8.1.2.3)). | `(request-target): get /api/V1/resource?query=foo` |
+| `(created)` | Value of the authorization header `created` parameter. | `(created): 1584453022` |
+| `(expires)` | Value of the authorization header `expires` parameter. | `(expires): 1584453082` |
+
+Their evaluated value is obtained by appending the special header name with an ASCII colon `:` an ASCII space \` \` then the designated value.
+
+```bash tab="Example"
+(created): 1929494939
+(request-target): get /foo/bar
+```
+
+#### Signature String Example
+
+Here is an example with the authorization header parameters set:
+
+- `headers="(request-target) (created) (expires) host x-example x-emptyheader cache-control"`
+- `created="1584466921"`
+- `expires="1584466931"`
+
+```bash tab="Request"
+GET /foo HTTP/1.1
+Host: example.org
+X-Example: Example header
+ with some whitespace.
+X-EmptyHeader:
+X-NotIncluded: always
+Cache-Control: max-age=60
+Cache-Control: must-revalidate
+```
+
+```bash tab="Expected Signature String"
+(request-target): get /foo
+(created): 1584466921
+(expires): 1584466931
+host: example.org
+x-example: Example header with some whitespace.
+x-emptyheader:
+cache-control: max-age=60, must-revalidate
+```
+
+#### Enforced Headers
+
+It is possible to configure the middleware to enforce a minimum set of headers to create the signature string.
+This means that any request that does not have the enforced headers in its signature is systematically refused.
+
+This option also configures the headers list returned when [initiating the authentication](#initiating-the-authentication).
+
+It defaults to `(request-target) (created) (expires)`.
+
+!!! danger "Always enforce (created) and (expires)"
+ The `created` and `expires` header parameters protect against replay attacks.
+ To make sure that their value is not modified during transport, it is **highly recommended** to always include those parameters values in the signature using the `(created)` and `(expired)` special headers value.
+
+ To do so, it is recommended to **always** configure the middleware to enforce `(created)` and `(expires)`.
+
+### Initiating the Authentication
+
+The authentication can be initiated by the proxy. A `401 Unauthorized` response is returned with a `WWW-Authenticate` header indicating to use the `Hmac` authentication scheme.
+
+```bash
+WWW-Authenticate: Hmac headers="(request-target) (created) (expires) host x-example"
+```
+
+This header indicates that the sender needs to provide an Authorization header that fulfills the `Hmac` authentication schemes.
+It also indicates a list of headers that have to be included in the signature using the `headers` parameter.
+
+!!! note "Enforced headers"
+ The list of headers carried in the `WWW-Authenticate` header is the list of [enforced headers](#enforced-headers) indicated in the middleware configuration.
+
+## Validating Request Body Integrity
+
+It is possible to make sure that the body of the incoming request has not been altered during transmission by including the [digest header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Digest) in the signature string.
+
+This middleware, by default, validates the digest sum of the body, if there is one.
+
+Only SHA-256 and SHA-512 checksums are supported for checksum computation.
+
+!!! warning "Potential CPU and memory usage"
+
+ Validating the digest makes the middleware read the request body and computes a checksum for it.
+ As a consequence it can cause high memory and CPU usage on proxies.
+
+ To disable this feature and only perform authentication, set the `validateDigest` option to `false` in the middleware configuration.
+
+{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/inflightreq.md b/docs/content/reference/routing-configuration/http/middlewares/inflightreq.md
index e8fc6a001..32d157162 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/inflightreq.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/inflightreq.md
@@ -54,12 +54,12 @@ spec:
| Field | Description | Default | Required |
|:-----------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
-| `amount` | The `amount` option defines the maximum amount of allowed simultaneous in-flight request.
The middleware responds with `HTTP 429 Too Many Requests` if there are already `amount` requests in progress (based on the same `sourceCriterion` strategy). | 0 | No |
-| `sourceCriterion.requestHost` | Whether to consider the request host as the source.
More information about `sourceCriterion`[here](#sourcecriterion). | false | No |
-| `sourceCriterion.requestHeaderName` | Name of the header used to group incoming requests.
More information about `sourceCriterion`[here](#sourcecriterion). | "" | No |
-| `sourceCriterion.ipStrategy.depth` | Depth position of the IP to select in the `X-Forwarded-For` header (starting from the right).
0 means no depth.
If greater than the total number of IPs in `X-Forwarded-For`, then the client IP is empty
If higher than 0, the `excludedIPs` options is not evaluated.
More information about [`sourceCriterion`](#sourcecriterion), [`ipStrategy](#ipstrategy), and [`depth`](#example-of-depth--x-forwarded-for) below. | 0 | No |
-| `sourceCriterion.ipStrategy.excludedIPs` | Allows Traefik to scan the `X-Forwarded-For` header and select the first IP not in the list.
If `depth` is specified, `excludedIPs` is ignored.
More information about [`sourceCriterion`](#sourcecriterion), [`ipStrategy](#ipstrategy), and [`excludedIPs`](#example-of-excludedips--x-forwarded-for) below. | | No |
-| `sourceCriterion.ipStrategy.ipv6Subnet` | If `ipv6Subnet` is provided and the selected IP is IPv6, the IP is transformed into the first IP of the subnet it belongs to.
More information about [`sourceCriterion`](#sourcecriterion), [`ipStrategy.ipv6Subnet`](#ipstrategyipv6subnet), and [`excludedIPs`](#example-of-excludedips--x-forwarded-for) below. | | No |
+| `amount` | The `amount` option defines the maximum amount of allowed simultaneous in-flight request.
The middleware responds with `HTTP 429 Too Many Requests` if there are already `amount` requests in progress (based on the same `sourceCriterion` strategy). | 0 | No |
+| `sourceCriterion.requestHost` | Whether to consider the request host as the source.
More information about `sourceCriterion`[here](#sourcecriterion). | false | No |
+| | Name of the header used to group incoming requests.
More information about `sourceCriterion`[here](#sourcecriterion). | "" | No |
+| `sourceCriterion.ipStrategy.depth` | Depth position of the IP to select in the `X-Forwarded-For` header (starting from the right).
0 means no depth.
If greater than the total number of IPs in `X-Forwarded-For`, then the client IP is empty
If higher than 0, the `excludedIPs` options is not evaluated.
More information about [`sourceCriterion`](#sourcecriterion), [`ipStrategy](#ipstrategy), and [`depth`](#example-of-depth--x-forwarded-for) below. | 0 | No |
+| `sourceCriterion.ipStrategy.excludedIPs` | Allows Traefik to scan the `X-Forwarded-For` header and select the first IP not in the list.
If `depth` is specified, `excludedIPs` is ignored.
More information about [`sourceCriterion`](#sourcecriterion), [`ipStrategy](#ipstrategy), and [`excludedIPs`](#example-of-excludedips--x-forwarded-for) below. | | No |
+| `sourceCriterion.ipStrategy.ipv6Subnet` | If `ipv6Subnet` is provided and the selected IP is IPv6, the IP is transformed into the first IP of the subnet it belongs to.
More information about [`sourceCriterion`](#sourcecriterion), [`ipStrategy.ipv6Subnet`](#ipstrategyipv6subnet), and [`excludedIPs`](#example-of-excludedips--x-forwarded-for) below. | | No |
### sourceCriterion
@@ -90,26 +90,26 @@ If `ipv6Subnet` is provided, the IP is transformed in the following way.
| IP | ipv6Subnet | clientIP |
|---------------------------|--------------|-----------------------|
-| `"::abcd:1111:2222:3333"` | `64` | `"::0:0:0:0"` |
-| `"::abcd:1111:2222:3333"` | `80` | `"::abcd:0:0:0:0"` |
-| `"::abcd:1111:2222:3333"` | `96` | `"::abcd:1111:0:0:0"` |
+| `"::abcd:1111:2222:3333"` | `64` | `"::0:0:0:0"` |
+| `"::abcd:1111:2222:3333"` | `80` | `"::abcd:0:0:0:0"` |
+| `"::abcd:1111:2222:3333"` | `96` | `"::abcd:1111:0:0:0"` |
-### Example of Depth & X-Forwarded-For
+### Example of Depth & `X-Forwarded-For`
If `depth` is set to 2, and the request `X-Forwarded-For` header is `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` then the "real" client IP is `"10.0.0.1"` (at depth 4) but the IP used as the criterion is `"12.0.0.1"` (`depth=2`).
-| X-Forwarded-For | depth | clientIP |
-|-----------------------------------------|---------|--------------|
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `1` | `"13.0.0.1"` |
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `3` | `"11.0.0.1"` |
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `5` | `""` |
+| `X-Forwarded-For` | depth | clientIP |
+|-----------------------------------------|-------|--------------|
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `1` | `"13.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `3` | `"11.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `5` | `""` |
### Example of ExcludedIPs & X-Forwarded-For
-| X-Forwarded-For | excludedIPs | clientIP |
+| `X-Forwarded-For` | excludedIPs | clientIP |
|-----------------------------------------|-----------------------|--------------|
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"12.0.0.1,13.0.0.1"` | `"11.0.0.1"` |
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"15.0.0.1,13.0.0.1"` | `"12.0.0.1"` |
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"10.0.0.1,13.0.0.1"` | `"12.0.0.1"` |
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"15.0.0.1,16.0.0.1"` | `"13.0.0.1"` |
-| `"10.0.0.1,11.0.0.1"` | `"10.0.0.1,11.0.0.1"` | `""` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"12.0.0.1,13.0.0.1"` | `"11.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"15.0.0.1,13.0.0.1"` | `"12.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"10.0.0.1,13.0.0.1"` | `"12.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"15.0.0.1,16.0.0.1"` | `"13.0.0.1"` |
+| `"10.0.0.1,11.0.0.1"` | `"10.0.0.1,11.0.0.1"` | `""` |
diff --git a/docs/content/reference/routing-configuration/http/middlewares/ipallowlist.md b/docs/content/reference/routing-configuration/http/middlewares/ipallowlist.md
index 8703b2a3a..a370f85c8 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/ipallowlist.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/ipallowlist.md
@@ -56,10 +56,10 @@ spec:
| Field | Description | Default | Required |
|:-----------|:------------------------------|:--------|:---------|
-| `sourceRange` | List of allowed IPs (or ranges of allowed IPs by using CIDR notation). | | Yes |
-| `ipStrategy.depth` | Depth position of the IP to select in the `X-Forwarded-For` header (starting from the right).
0 means no depth.
If greater than the total number of IPs in `X-Forwarded-For`, then the client IP is empty
If higher than 0, the `excludedIPs` options is not evaluated.
More information about [`ipStrategy](#ipstrategy), and [`depth`](#example-of-depth--x-forwarded-for) below. | 0 | No |
-| `ipStrategy.excludedIPs` | Allows Traefik to scan the `X-Forwarded-For` header and select the first IP not in the list.
If `depth` is specified, `excludedIPs` is ignored.
More information about [`ipStrategy](#ipstrategy), and [`excludedIPs`](#example-of-excludedips--x-forwarded-for) below. | | No |
-| `ipStrategy.ipv6Subnet` | If `ipv6Subnet` is provided and the selected IP is IPv6, the IP is transformed into the first IP of the subnet it belongs to.
More information about [`ipStrategy.ipv6Subnet`](#ipstrategyipv6subnet), and [`excludedIPs`](#example-of-excludedips--x-forwarded-for) below. | | No |
+| `sourceRange` | List of allowed IPs (or ranges of allowed IPs by using CIDR notation). | | Yes |
+| `ipStrategy.depth` | Depth position of the IP to select in the `X-Forwarded-For` header (starting from the right).
0 means no depth.
If greater than the total number of IPs in `X-Forwarded-For`, then the client IP is empty
If higher than 0, the `excludedIPs` options is not evaluated.
More information about [`ipStrategy](#ipstrategy), and [`depth`](#example-of-depth--x-forwarded-for) below. | 0 | No |
+| `ipStrategy.excludedIPs` | Allows Traefik to scan the `X-Forwarded-For` header and select the first IP not in the list.
If `depth` is specified, `excludedIPs` is ignored.
More information about [`ipStrategy](#ipstrategy), and [`excludedIPs`](#example-of-excludedips--x-forwarded-for) below. | | No |
+| `ipStrategy.ipv6Subnet` | If `ipv6Subnet` is provided and the selected IP is IPv6, the IP is transformed into the first IP of the subnet it belongs to.
More information about [`ipStrategy.ipv6Subnet`](#ipstrategyipv6subnet), and [`excludedIPs`](#example-of-excludedips--x-forwarded-for) below. | | No |
### ipStrategy
@@ -95,26 +95,26 @@ If `ipv6Subnet` is provided, the IP is transformed in the following way.
| IP | ipv6Subnet | clientIP |
|---------------------------|--------------|-----------------------|
-| `"::abcd:1111:2222:3333"` | `64` | `"::0:0:0:0"` |
-| `"::abcd:1111:2222:3333"` | `80` | `"::abcd:0:0:0:0"` |
-| `"::abcd:1111:2222:3333"` | `96` | `"::abcd:1111:0:0:0"` |
+| `"::abcd:1111:2222:3333"` | `64` | `"::0:0:0:0"` |
+| `"::abcd:1111:2222:3333"` | `80` | `"::abcd:0:0:0:0"` |
+| `"::abcd:1111:2222:3333"` | `96` | `"::abcd:1111:0:0:0"` |
-### Example of Depth & X-Forwarded-For
+### Example of Depth & `X-Forwarded-For`
If `depth` is set to 2, and the request `X-Forwarded-For` header is `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` then the "real" client IP is `"10.0.0.1"` (at depth 4) but the IP used as the criterion is `"12.0.0.1"` (`depth=2`).
-| X-Forwarded-For | depth | clientIP |
+| `X-Forwarded-For` | depth | clientIP |
|-----------------------------------------|---------|--------------|
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `1` | `"13.0.0.1"` |
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `3` | `"11.0.0.1"` |
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `5` | `""` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `1` | `"13.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `3` | `"11.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `5` | `""` |
-### Example of ExcludedIPs & X-Forwarded-For
+### Example of ExcludedIPs & `X-Forwarded-For`
-| X-Forwarded-For | excludedIPs | clientIP |
+| `X-Forwarded-For` | excludedIPs | clientIP |
|-----------------------------------------|-----------------------|--------------|
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"12.0.0.1,13.0.0.1"` | `"11.0.0.1"` |
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"15.0.0.1,13.0.0.1"` | `"12.0.0.1"` |
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"10.0.0.1,13.0.0.1"` | `"12.0.0.1"` |
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"15.0.0.1,16.0.0.1"` | `"13.0.0.1"` |
-| `"10.0.0.1,11.0.0.1"` | `"10.0.0.1,11.0.0.1"` | `""` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"12.0.0.1,13.0.0.1"` | `"11.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"15.0.0.1,13.0.0.1"` | `"12.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"10.0.0.1,13.0.0.1"` | `"12.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `"15.0.0.1,16.0.0.1"` | `"13.0.0.1"` |
+| `"10.0.0.1,11.0.0.1"` | `"10.0.0.1,11.0.0.1"` | `""` |
diff --git a/docs/content/reference/routing-configuration/http/middlewares/jwt.md b/docs/content/reference/routing-configuration/http/middlewares/jwt.md
new file mode 100644
index 000000000..2aebcdf86
--- /dev/null
+++ b/docs/content/reference/routing-configuration/http/middlewares/jwt.md
@@ -0,0 +1,233 @@
+---
+title: 'JWT Authentication'
+description: 'Traefik Hub API Gateway - The JWT Authentication middleware verifies that a valid JWT token is provided in the Authorization header.'
+---
+
+!!! info "Traefik Hub Feature"
+ This middleware is available exclusively in [Traefik Hub](https://traefik.io/traefik-hub/). Learn more about [Traefik Hub's advanced features](https://doc.traefik.io/traefik-hub/api-gateway/intro).
+
+The JWT middleware verifies that a valid JWT token is provided in the `Authorization` header (`Authorization: Bearer `).
+If the token can't be passed as an `Authorization` header, it can be given as form data or as a query parameter.
+See the `tokenKey` option for more information.
+
+With no specific configuration, a JWT middleware only validates the signature of a JWT and checks the `nbf`, `exp` and `iat` standard claims (if they are present).
+Custom claim validation can be configured with [Custom Claims Validation](#claims).
+
+---
+
+## Configuration Example
+
+```yaml tab="Middleware JWT"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-jwt
+spec:
+ plugin:
+ jwt:
+ signingSecret: my-secret
+ forwardHeaders:
+ Group: grp
+ Expires-At: exp
+ claims: Equals(`grp`, `admin`)
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|:----------------|:------------------------------------------------|:--------|:---------|
+| `signingSecret` | Defines the secret used for signing the JWT certificates.
It is then used by the middleware to verify incoming requests.
At least one of `signingSecret`, `publicKey`, `jwksFile` or `jwksUrl` options must be set. (More information [here](#signingsecret)) | "" | No |
+| `signingSecretBase64Encoded` | Defines whether the `signingSecret` is base64-encoded.
If set to `true`, the `signingSecret` is base64-decoded before being used. | false | No |
+| `publicKey` | Defines the public key used to verify secret signature in incoming requests.
In that case, users should sign their token using a private key corresponding to the configured public key.
At least one of `signingSecret`, `publicKey`, `jwksFile` or `jwksUrl` options must be set. | "" | No |
+| `jwksFile` | Defines a set of [JWK](https://tools.ietf.org/html/rfc7517) to be used to verify the signature of JWTs.
The option can either be a path to a file mounted on the API Gateway or directly the content of a JWK set file.
At least one of `signingSecret`, `publicKey`, `jwksFile` or `jwksUrl` options must be set. (More information [here](#jwksfile)) | "" | No |
+| `jwksUrl` | Defines the URL of the host serving a [JWK](https://tools.ietf.org/html/rfc7517) set.
The keys are cached if the HTTP Cache Control allows for caching.
At least one of `signingSecret`, `publicKey`, `jwksFile` or `jwksUrl` options must be set.
(More information [here](#jwksurl)) | "" | No |
+| `forwardAuthorization` | Defines whether the authorization header will be forwarded or stripped from a request after it has been approved by the middleware. | false | No |
+| `tokenKey` | Defines the name of the query and form data parameter used for passing the JWT, for applications that can't pass it in the `Authorization` header.
The middleware always looks in the `Authorization` header first, even with this option enabled.
This option should only be enabled if the JWT cannot be passed as an Authorization header, as it is not recommended by the [RFC](https://www.rfc-editor.org/rfc/rfc6750#section-2). | "" | No |
+| `claims` | Defines the claims to validate in order to authorize the request.
The `claims` option can only be used with JWT-formatted token. (More information [here](#claims)) | "" | No |
+| `usernameClaim` | Defines the claim that will be evaluated to populate the `clientusername` in the access logs.
The `usernameClaim` option can only be used with JWT-formatted token.| "" | No |
+| | Defines the HTTP headers to add to requests and populates them with values extracted from the access token claims returned by the authorization server.
Claims to be forwarded that are not found in the JWT result in empty headers.
The `forwardHeaders` option can only be used with JWT-formatted token. | [] | No |
+| `clientConfig.tls.ca` | PEM-encoded certificate bundle or a URN referencing a secret containing the certificate bundle used to establish a TLS connection with the authorization server (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.tls.cert` | PEM-encoded certificate or a URN referencing a secret containing the certificate used to establish a TLS connection with the Vault server (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.tls.key` | PEM-encoded key or a URN referencing a secret containing the key used to establish a TLS connection with the Vault server. (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.tls.insecureSkipVerify` | Disables TLS certificate verification when communicating with the authorization server.
Useful for testing purposes but strongly discouraged for production. (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.timeoutSeconds` | Defines the time before giving up requests to the authorization server. | 5 | No |
+| `clientConfig.maxRetries` | Defines the number of retries for requests to authorization server that fail. | 3 | No |
+
+### claims
+
+#### Syntax
+
+The following functions are supported in `claims`:
+
+| Function | Description | Example |
+|-------------------|--------------------|-----------------|
+| Equals | Validates the equality of the value in `key` with `value`. | Equals(\`grp\`, \`admin\`) |
+| Prefix | Validates the value in `key` has the prefix of `value`. | Prefix(\`referrer\`, \`http://example.com\`) |
+| Contains (string) | Validates the value in `key` contains `value`. | Contains(\`referrer\`, \`/foo/\`) |
+| Contains (array) | Validates the `key` array contains the `value`. | Contains(\`areas\`, \`home\`) |
+| SplitContains | Validates the value in `key` contains the `value` once split by the separator. | SplitContains(\`scope\`, \` \`, \`writer\`) |
+| OneOf | Validates the `key` array contains one of the `values`. | OneOf(\`areas\`, \`office\`, \`lab\`) |
+
+All functions can be joined by boolean operands. The supported operands are:
+
+| Operand | Description | Example |
+|---------|--------------------|-----------------|
+| && | Compares two functions and returns true only if both evaluate to true. | Equals(\`grp\`, \`admin\`) && Equals(\`active\`, \`true\`) |
+| \|\| | Compares two functions and returns true if either evaluate to true. | Equals(\`grp\`, \`admin\`) \|\| Equals(\`active\`, \`true\`) |
+| ! | Returns false if the function is true, otherwise returns true. | !Equals(\`grp\`, \`testers\`) |
+
+All examples will return true for the following data structure:
+
+```json tab="JSON"
+{
+ "active": true,
+ "grp": "admin",
+ "scope": "reader writer deploy",
+ "referrer": "http://example.com/foo/bar",
+ "areas": [
+ "office",
+ "home"
+ ]
+}
+```
+
+#### Nested Claims
+
+Nested claims are supported by using a `.` between keys. For example:
+
+```bash tab="Key"
+user.name
+```
+
+```json tab="Claims"
+{
+ "active": true,
+ "grp": "admin",
+ "scope": "reader writer deploy",
+ "referrer": "http://example.com/foo/bar",
+ "areas": [
+ "office",
+ "home"
+ ],
+ "user" {
+ "name": "John Snow",
+ "status": "undead"
+ }
+}
+```
+
+```bash tab="Result"
+John Snow
+```
+
+!!! note "Handling keys that contain a '.'"
+
+If the `key` contains a dot, the dot can be escaped using `\.`
+
+!!! note "Handling a key that contains a '\'"
+
+If the `key` contains a `\`, it needs to be doubled `\\`.
+
+### clientConfig
+
+Defines the configuration used to connect the API Gateway to a Third Party Software such as an Identity Provider.
+
+#### `clientConfig.tls`
+
+##### Storing secret values in Kubernetes secrets
+
+When configuring the `tls.ca`, `tls.cert`, `tls.key`, it is possible to reference Kubernetes secrets defined in the same namespace as the Middleware.
+The reference to a Kubernetes secret takes the form of a URN:
+
+```text
+urn:k8s:secret:[name]:[valueKey]
+```
+
+```yaml tab="Middleware JWT"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-jwt
+spec:
+ plugin:
+ jwt:
+ clientConfig:
+ tls:
+ ca: "urn:k8s:secret:tls:ca"
+ cert: "urn:k8s:secret:tls:cert"
+ key: "urn:k8s:secret:tls:key"
+ insecureSkipVerify: true
+```
+
+```yaml tab="Kubernetes TLS Secret"
+apiVersion: v1
+kind: Secret
+metadata:
+ name: tls
+stringData:
+ ca: |-
+ -----BEGIN CERTIFICATE-----
+ MIIB9TCCAWACAQAwgbgxGTAXBgNVBAoMEFF1b1ZhZGlzIExpbWl0ZWQxHDAaBgNV
+ BAsME0RvY3VtZW50IERlcGFydG1lbnQxOTA3BgNVBAMMMFdoeSBhcmUgeW91IGRl
+ Y29kaW5nIG1lPyAgVGhpcyBpcyBvbmx5IGEgdGVzdCEhITERMA8GA1UEBwwISGFt
+ aWx0b24xETAPBgNVBAgMCFBlbWJyb2tlMQswCQYDVQQGEwJCTTEPMA0GCSqGSIb3
+ DQEJARYAMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJ9WRanG/fUvcfKiGl
+ EL4aRLjGt537mZ28UU9/3eiJeJznNSOuNLnF+hmabAu7H0LT4K7EdqfF+XUZW/2j
+ RKRYcvOUDGF9A7OjW7UfKk1In3+6QDCi7X34RE161jqoaJjrm/T18TOKcgkkhRzE
+ apQnIDm0Ea/HVzX/PiSOGuertwIDAQABMAsGCSqGSIb3DQEBBQOBgQBzMJdAV4QP
+ Awel8LzGx5uMOshezF/KfP67wJ93UW+N7zXY6AwPgoLj4Kjw+WtU684JL8Dtr9FX
+ ozakE+8p06BpxegR4BR3FMHf6p+0jQxUEAkAyb/mVgm66TyghDGC6/YkiKoZptXQ
+ 98TwDIK/39WEB/V607As+KoYazQG8drorw==
+ -----END CERTIFICATE-----
+ cert: |-
+ -----BEGIN CERTIFICATE-----
+ MIIB9TCCAWACAQAwgbgxGTAXBgNVBAoMEFF1b1ZhZGlzIExpbWl0ZWQxHDAaBgNV
+ BAsME0RvY3VtZW50IERlcGFydG1lbnQxOTA3BgNVBAMMMFdoeSBhcmUgeW91IGRl
+ Y29kaW5nIG1lPyAgVGhpcyBpcyBvbmx5IGEgdGVzdCEhITERMA8GA1UEBwwISGFt
+ aWx0b24xETAPBgNVBAgMCFBlbWJyb2tlMQswCQYDVQQGEwJCTTEPMA0GCSqGSIb3
+ DQEJARYAMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJ9WRanG/fUvcfKiGl
+ EL4aRLjGt537mZ28UU9/3eiJeJznNSOuNLnF+hmabAu7H0LT4K7EdqfF+XUZW/2j
+ RKRYcvOUDGF9A7OjW7UfKk1In3+6QDCi7X34RE161jqoaJjrm/T18TOKcgkkhRzE
+ apQnIDm0Ea/HVzX/PiSOGuertwIDAQABMAsGCSqGSIb3DQEBBQOBgQBzMJdAV4QP
+ Awel8LzGx5uMOshezF/KfP67wJ93UW+N7zXY6AwPgoLj4Kjw+WtU684JL8Dtr9FX
+ ozakE+8p06BpxegR4BR3FMHf6p+0jQxUEAkAyb/mVgm66TyghDGC6/YkiKoZptXQ
+ 98TwDIK/39WEB/V607As+KoYazQG8drorw==
+ -----END CERTIFICATE-----
+ key: |-
+ -----BEGIN EC PRIVATE KEY-----
+ MHcCAQEEIC8CsJ/B115S+JtR1/l3ZQwKA3XdXt9zLqusF1VXc/KloAoGCCqGSM49
+ AwEHoUQDQgAEpwUmRIZHFt8CdDHYm1ikScCScd2q6QVYXxJu+G3fQZ78ScGtN7fu
+ KXMnQqVjXVRAr8qUY8yipVKuMCepnPXScQ==
+ -----END EC PRIVATE KEY-----
+```
+
+### jwksFile
+
+#### JWT Header Key ID
+
+If the JWT header contains a `kid` header, the middleware expects to find a JWK.
+If a JWK cannot be found, it returns a `401 Unauthorized` error.
+
+### jwksUrl
+
+#### JWT Header Key ID
+
+If the JWT header contains a `kid` header, the middleware expects to find a JWK.
+If a JWK cannot be found, it returns a `401 Unauthorized` error.
+
+#### JWT Issuer Claim
+
+If `jwksUrl` is set to a path and the `iss` property is missing in the JWT it's trying to verify, the middleware returns a `401 Unauthorized` error.
+
+### signingSecret
+
+#### Storing secret values in Kubernetes secrets
+
+When configuring the `signingSecret`, it is possible to reference a Kubernetes secret defined in the same namespace as the Middleware.
+The reference to a Kubernetes secret takes the form of a URN:
+
+```text
+urn:k8s:secret:[name]:[valueKey]
+```
+
+{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/ldap.md b/docs/content/reference/routing-configuration/http/middlewares/ldap.md
new file mode 100644
index 000000000..9a0efc6f2
--- /dev/null
+++ b/docs/content/reference/routing-configuration/http/middlewares/ldap.md
@@ -0,0 +1,105 @@
+---
+title: 'LDAP Authentication'
+description: 'Traefik Hub API Gateway - The LDAP Authentication middleware secures your applications by delegating the authentication to an external LDAP server.'
+---
+
+!!! info "Traefik Hub Feature"
+ This middleware is available exclusively in [Traefik Hub](https://traefik.io/traefik-hub/). Learn more about [Traefik Hub's advanced features](https://doc.traefik.io/traefik-hub/api-gateway/intro).
+
+The LDAP Authentication middleware secures your applications by delegating the authentication to an external LDAP server.
+
+The LDAP middleware will look for user credentials in the `Authorization` header of each request. Credentials must be encoded with the following format: `base64(username:password)`.
+
+---
+
+## Configuration Examples
+
+```yaml tab="Basic usage"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-ldap-auth
+ namespace: apps
+spec:
+ plugin:
+ ldap:
+ url: ldap://ldap.example.org:636
+ baseDN: dc=example,dc=org
+```
+
+```yaml tab="Basic usage with bind need"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-ldap-auth
+ namespace: apps
+spec:
+ plugin:
+ ldap:
+ url: ldap://ldap.example.org:636
+ baseDN: dc=example,dc=org
+ bindDN: cn=binding_user,dc=example,dc=org
+ bindPassword: "urn:k8s:secret:my-secret:bindpassword"
+```
+
+```yaml tab="Enabling search, bind & WWW-Authenticate header"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-ldap-auth
+ namespace: apps
+spec:
+ plugin:
+ ldap:
+ url: ldap://ldap.example.org:636
+ baseDN: dc=example,dc=org
+ searchFilter: (&(objectClass=inetOrgPerson)(gidNumber=500)(uid=%s))
+ forwardUsername: true
+ forwardUsernameHeader: Custom-Username-Header-Name
+ wwwAuthenticateHeader: true
+ wwwAuthenticateHeaderRealm: traefikee
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|:------|:------------|:--------|:---------|
+| `url` | LDAP server URL. Either the `ldaps` or `ldap` protocol and end with a port (ex: `ldaps://ldap.example.org:636`). | "" | Yes |
+| `startTLS` | Enable [`StartTLS`](https://tools.ietf.org/html/rfc4511#section-4.14) request when initializing the connection with the LDAP server. | false | No |
+| `certificateAuthority` | PEM-encoded certificate to use to establish a connection with the LDAP server if the connection uses TLS but that the certificate was signed by a custom Certificate Authority. | "" | No |
+| `insecureSkipVerify` | Allow proceeding and operating even for server TLS connections otherwise considered insecure. | false | No |
+| `bindDN` | Domain name to bind to in order to authenticate to the LDAP server when running on search mode.
Leaving this empty with search mode means binds are anonymous, which is rarely expected behavior.
Not used when running in [bind mode](#bind-mode-vs-search-mode). | "" | No |
+| `bindPassword` | Password for the `bindDN` used in search mode to authenticate with the LDAP server. More information [here](#bindpassword) | "" | No |
+| `connPool` | Pool of connections to the LDAP server (to minimize the impact on the performance). | None | No |
+| `connPool.size` | Number of connections managed by the pool can be customized with the `size` property. | 10 | No |
+| `connPool.burst` | Ephemeral connections that are opened when the pool is already full. Once the number of connection exceeds `size` + `burst`, a `Too Many Connections` error is returned. | 5 | No |
+| `connPool.ttl` | Pooled connections are still meant to be short-lived, so they are closed after roughly one minute by default. This behavior can be modified with the `ttl` property. | 60s | No |
+| `baseDN` | Base domain name that should be used for bind and search queries. | "" | Yes |
+| `attribute` | The attribute used to bind a user. Bind queries use this pattern: `=,`, where the username is extracted from the request header. | cn | Yes |
+| `forwardUsername` | Forward the username in a specific header, defined using the `forwardUsernameHeader` option. | "" | No |
+| | Name of the header to put the username in when forwarding it. This is not used if the `forwardUsername` option is set to `false`. | Username | Yes |
+| `forwardAuthorization` | Enable to forward the authorization header from the request after it has been approved by the middleware. | false | Yes |
+| `searchFilter` | If not empty, the middleware will run in [search mode](#bind-mode-vs-search-mode), filtering search results with the given query.
Filter queries can use the `%s` placeholder that is replaced by the username provided in the `Authorization` header of the request (for example: `(&(objectClass=inetOrgPerson)(gidNumber=500)(uid=%s))`). | "" | No |
+| | Allow setting a `WWW-Authenticate` header in the `401 Unauthorized` response. See [the WWW-Authenticate header documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/WWW-Authenticate) for more information.
The `realm` directive of the `WWW-Authenticate` header can be customized with the `wwwAuthenticateHeaderRealm` option. | false | No |
+| | Realm name to set in the `WWW-Authenticate` header. This option is ineffective unless the `wwwAuthenticateHeader` option is set to `true`. | "" | No |
+
+### bindPassword
+
+When setting the `bindPassword`, you can reference a Kubernetes secret from the same namespace as the Middleware using the following URN format:
+
+```text
+urn:k8s:secret:[secretName]:[key]
+```
+
+## Bind Mode vs Search Mode
+
+If no filter is specified in its configuration, the middleware runs in the default bind mode,
+meaning it tries to make a bind request to the LDAP server with the credentials provided in the request headers.
+If the bind succeeds, the middleware forwards the request, otherwise it returns a `401 Unauthorized` status code.
+
+If a filter query is specified in the middleware configuration, and the Authentication Source referenced has a `bindDN`
+and a `bindPassword`, then the middleware runs in search mode. In this mode, a search query with the given filter is
+issued to the LDAP server before trying to bind. If result of this search returns only 1 record,
+it tries to issue a bind request with this record, otherwise it aborts a `401 Unauthorized` status code.
+
+{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/oauth2-client-credentials.md b/docs/content/reference/routing-configuration/http/middlewares/oauth2-client-credentials.md
new file mode 100644
index 000000000..80eecea88
--- /dev/null
+++ b/docs/content/reference/routing-configuration/http/middlewares/oauth2-client-credentials.md
@@ -0,0 +1,255 @@
+---
+title: 'OAuth 2.0 Client Credentials Authentication'
+description: 'Traefik Hub API Gateway - The OAuth 2.0 Client Credentials Authentication middleware secures your applications using the client credentials flow'
+---
+
+!!! info "Traefik Hub Feature"
+ This middleware is available exclusively in [Traefik Hub](https://traefik.io/traefik-hub/). Learn more about [Traefik Hub's advanced features](https://doc.traefik.io/traefik-hub/api-gateway/intro).
+
+The OAuth 2.0 Client Credentials Authentication middleware allows Traefik Hub to secure routes using the OAuth 2.0 Client Credentials flow as described in the [RFC 6749](https://www.rfc-editor.org/rfc/rfc6749.html#section-4.4).
+Access tokens can be cached using an external KV store.
+
+The OAuth Client Credentials Authentication middleware allows using Redis (or Sentinel) as persistent KV store to authorization access tokens
+while they are valid. This reduces latency and the number of calls made to the authorization server.
+
+---
+
+## Configuration Example
+
+```yaml tab="Middleware OAuth Client Credentials"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-client-creds
+spec:
+ plugin:
+ oAuthClientCredentials:
+ url: https://tenant.auth0.com/oauth/token
+ clientID: urn:k8s:my-secret:my-secret:clientID
+ clientSecret: urn:k8s:my-secret:my-secret:clientSecret
+ audience: https://api.example.com
+ forwardHeaders:
+ Group: grp
+ Expires-At: exp
+ claims: Equals(`grp`, `admin`)
+```
+
+```yaml tab="Kubernetes Secret"
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+ name: my-secret
+stringData:
+ clientID: my-oauth-client-name
+ clientSecret: mypasswd
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|:------|:--------------------------------------------------------------------------------------------|:--------|:---------|
+| `audience` | Defines the audience configured in your authorization server.
The audience value is the base address of the resource being accessed, for example: https://api.example.com. | "" | Yes |
+| `claims` | Defines the claims to validate in order to authorize the request.
The `claims` option can only be used with JWT-formatted token. (More information [here](#claims)) | "" | No |
+| `clientConfig.tls.ca` | PEM-encoded certificate bundle or a URN referencing a secret containing the certificate bundle used to establish a TLS connection with the authorization server (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.tls.cert` | PEM-encoded certificate or a URN referencing a secret containing the certificate used to establish a TLS connection with the Vault server (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.tls.key` | PEM-encoded key or a URN referencing a secret containing the key used to establish a TLS connection with the Vault server. (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.tls.insecureSkipVerify` | Disables TLS certificate verification when communicating with the authorization server.
Useful for testing purposes but strongly discouraged for production. (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.timeoutSeconds` | Defines the time before giving up requests to the authorization server. | 5 | No |
+| `clientConfig.maxRetries` | Defines the number of retries for requests to authorization server that fail. | 3 | No |
+| `clientID` | Defines the unique client identifier for an account on the OpenID Connect provider, must be set when the `clientSecret` option is set.
More information [here](#storing-secret-values-in-kubernetes-secrets). | "" | Yes |
+| `clientSecret` | Defines the unique client secret for an account on the OpenID Connect provider, must be set when the `clientID` option is set.
More information [here](#storing-secret-values-in-kubernetes-secrets). | "" | Yes |
+| | Defines the HTTP headers to add to requests and populates them with values extracted from the access token claims returned by the authorization server.
Claims to be forwarded that are not found in the JWT result in empty headers.
The `forwardHeaders` option can only be used with JWT-formatted token. | [] | No |
+| `store.keyPrefix` | Defines the prefix of the key for the entries that store the sessions. | "" | No |
+| `store.redis.endpoints` | Endpoints of the Redis instances to connect to (example: `redis.traefik-hub.svc.cluster.local:6379`) | "" | Yes |
+| `store.redis.username` | The username Traefik Hub will use to connect to Redis | "" | No |
+| `store.redis.password` | The password Traefik Hub will use to connect to Redis | "" | No |
+| `store.redis.database` | The database Traefik Hub will use to sore information (default: `0`) | "" | No |
+| `store.redis.cluster` | Enable Redis Cluster | "" | No |
+| `store.redis.tls.caBundle` | Custom CA bundle | "" | No |
+| `store.redis.tls.cert` | TLS certificate | "" | No |
+| `store.redis.tls.key` | TLS | "" | No |
+| `store.redis.tls.insecureSkipVerify` | Allow skipping the TLS verification | "" | No |
+| `store.redis.sentinel.masterSet` | Name of the set of main nodes to use for main selection. Required when using Sentinel. | "" | No |
+| `store.redis.sentinel.username` | Username to use for sentinel authentication (can be different from `username`) | "" | No |
+| `store.redis.sentinel.password` | Password to use for sentinel authentication (can be different from `password`) | "" | No |
+| `url` | Defines the authorization server URL (for example: `https://tenant.auth0.com/oauth/token`). | "" | Yes |
+| `usernameClaim` | Defines the claim that will be evaluated to populate the `clientusername` in the access logs.
The `usernameClaim` option can only be used with JWT-formatted token.| "" | No |
+
+### Storing secret values in Kubernetes secrets
+
+It is possible to reference Kubernetes secrets defined in the same namespace as the Middleware.
+The reference to a Kubernetes secret takes the form of a URN:
+
+```text
+urn:k8s:secret:[name]:[valueKey]
+```
+
+### claims
+
+#### Syntax
+
+The following functions are supported in `claims`:
+
+| Function | Description | Example |
+|-------------------|--------------------|-----------------|
+| Equals | Validates the equality of the value in `key` with `value`. | Equals(\`grp\`, \`admin\`) |
+| Prefix | Validates the value in `key` has the prefix of `value`. | Prefix(\`referrer\`, \`http://example.com\`) |
+| Contains (string) | Validates the value in `key` contains `value`. | Contains(\`referrer\`, \`/foo/\`) |
+| Contains (array) | Validates the `key` array contains the `value`. | Contains(\`areas\`, \`home\`) |
+| SplitContains | Validates the value in `key` contains the `value` once split by the separator. | SplitContains(\`scope\`, \` \`, \`writer\`) |
+| OneOf | Validates the `key` array contains one of the `values`. | OneOf(\`areas\`, \`office\`, \`lab\`) |
+
+All functions can be joined by boolean operands. The supported operands are:
+
+| Operand | Description | Example |
+|---------|--------------------|-----------------|
+| && | Compares two functions and returns true only if both evaluate to true. | Equals(\`grp\`, \`admin\`) && Equals(\`active\`, \`true\`) |
+| \|\| | Compares two functions and returns true if either evaluate to true. | Equals(\`grp\`, \`admin\`) \|\| Equals(\`active\`, \`true\`) |
+| ! | Returns false if the function is true, otherwise returns true. | !Equals(\`grp\`, \`testers\`) |
+
+All examples will return true for the following data structure:
+
+```json tab="JSON"
+{
+ "active": true,
+ "grp": "admin",
+ "scope": "reader writer deploy",
+ "referrer": "http://example.com/foo/bar",
+ "areas": [
+ "office",
+ "home"
+ ]
+}
+```
+
+#### Nested Claims
+
+Nested claims are supported by using a `.` between keys. For example:
+
+```bash tab="Key"
+user.name
+```
+
+```json tab="Claims"
+{
+ "active": true,
+ "grp": "admin",
+ "scope": "reader writer deploy",
+ "referrer": "http://example.com/foo/bar",
+ "areas": [
+ "office",
+ "home"
+ ],
+ "user" {
+ "name": "John Snow",
+ "status": "undead"
+ }
+}
+```
+
+```bash tab="Result"
+John Snow
+```
+
+!!! note "Handling keys that contain a '.'"
+
+If the `key` contains a dot, the dot can be escaped using `\.`
+
+!!! note "Handling a key that contains a '\'"
+
+If the `key` contains a `\`, it needs to be doubled `\\`.
+
+### clientConfig
+
+Defines the configuration used to connect the API Gateway to a Third Party Software such as an Identity Provider.
+
+#### `clientConfig.tls`
+
+##### Storing secret values in Kubernetes secrets
+
+When configuring the `tls.ca`, `tls.cert`, `tls.key`, it is possible to reference Kubernetes secrets defined in the same namespace as the Middleware.
+The reference to a Kubernetes secret takes the form of a URN:
+
+```text
+urn:k8s:secret:[name]:[valueKey]
+```
+
+```yaml tab="Middleware JWT"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-client-creds
+spec:
+ plugin:
+ oAuthClientCredentials:
+ clientConfig:
+ tls:
+ ca: "urn:k8s:secret:tls:ca"
+ cert: "urn:k8s:secret:tls:cert"
+ key: "urn:k8s:secret:tls:key"
+ insecureSkipVerify: true
+```
+
+```yaml tab="Kubernetes TLS Secret"
+apiVersion: v1
+kind: Secret
+metadata:
+ name: tls
+stringData:
+ ca: |-
+ -----BEGIN CERTIFICATE-----
+ MIIB9TCCAWACAQAwgbgxGTAXBgNVBAoMEFF1b1ZhZGlzIExpbWl0ZWQxHDAaBgNV
+ BAsME0RvY3VtZW50IERlcGFydG1lbnQxOTA3BgNVBAMMMFdoeSBhcmUgeW91IGRl
+ Y29kaW5nIG1lPyAgVGhpcyBpcyBvbmx5IGEgdGVzdCEhITERMA8GA1UEBwwISGFt
+ aWx0b24xETAPBgNVBAgMCFBlbWJyb2tlMQswCQYDVQQGEwJCTTEPMA0GCSqGSIb3
+ DQEJARYAMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJ9WRanG/fUvcfKiGl
+ EL4aRLjGt537mZ28UU9/3eiJeJznNSOuNLnF+hmabAu7H0LT4K7EdqfF+XUZW/2j
+ RKRYcvOUDGF9A7OjW7UfKk1In3+6QDCi7X34RE161jqoaJjrm/T18TOKcgkkhRzE
+ apQnIDm0Ea/HVzX/PiSOGuertwIDAQABMAsGCSqGSIb3DQEBBQOBgQBzMJdAV4QP
+ Awel8LzGx5uMOshezF/KfP67wJ93UW+N7zXY6AwPgoLj4Kjw+WtU684JL8Dtr9FX
+ ozakE+8p06BpxegR4BR3FMHf6p+0jQxUEAkAyb/mVgm66TyghDGC6/YkiKoZptXQ
+ 98TwDIK/39WEB/V607As+KoYazQG8drorw==
+ -----END CERTIFICATE-----
+ cert: |-
+ -----BEGIN CERTIFICATE-----
+ MIIB9TCCAWACAQAwgbgxGTAXBgNVBAoMEFF1b1ZhZGlzIExpbWl0ZWQxHDAaBgNV
+ BAsME0RvY3VtZW50IERlcGFydG1lbnQxOTA3BgNVBAMMMFdoeSBhcmUgeW91IGRl
+ Y29kaW5nIG1lPyAgVGhpcyBpcyBvbmx5IGEgdGVzdCEhITERMA8GA1UEBwwISGFt
+ aWx0b24xETAPBgNVBAgMCFBlbWJyb2tlMQswCQYDVQQGEwJCTTEPMA0GCSqGSIb3
+ DQEJARYAMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJ9WRanG/fUvcfKiGl
+ EL4aRLjGt537mZ28UU9/3eiJeJznNSOuNLnF+hmabAu7H0LT4K7EdqfF+XUZW/2j
+ RKRYcvOUDGF9A7OjW7UfKk1In3+6QDCi7X34RE161jqoaJjrm/T18TOKcgkkhRzE
+ apQnIDm0Ea/HVzX/PiSOGuertwIDAQABMAsGCSqGSIb3DQEBBQOBgQBzMJdAV4QP
+ Awel8LzGx5uMOshezF/KfP67wJ93UW+N7zXY6AwPgoLj4Kjw+WtU684JL8Dtr9FX
+ ozakE+8p06BpxegR4BR3FMHf6p+0jQxUEAkAyb/mVgm66TyghDGC6/YkiKoZptXQ
+ 98TwDIK/39WEB/V607As+KoYazQG8drorw==
+ -----END CERTIFICATE-----
+ key: |-
+ -----BEGIN EC PRIVATE KEY-----
+ MHcCAQEEIC8CsJ/B115S+JtR1/l3ZQwKA3XdXt9zLqusF1VXc/KloAoGCCqGSM49
+ AwEHoUQDQgAEpwUmRIZHFt8CdDHYm1ikScCScd2q6QVYXxJu+G3fQZ78ScGtN7fu
+ KXMnQqVjXVRAr8qUY8yipVKuMCepnPXScQ==
+ -----END EC PRIVATE KEY-----
+```
+
+### store.redis
+
+Connection parameters to your [Redis](https://redis.io/ "Link to website of Redis") server are attached to your Middleware deployment.
+
+The following Redis modes are supported:
+
+- Single instance mode
+- [Redis Cluster](https://redis.io/docs/management/scaling "Link to official Redis documentation about Redis Cluster mode")
+- [Redis Sentinel](https://redis.io/docs/management/sentinel "Link to official Redis documentation about Redis Sentinel mode")
+
+!!! info
+
+ If you use Redis in single instance mode or Redis Sentinel, you can configure the `database` field.
+ This value won't be taken into account if you use Redis Cluster (only database `0` is available).
+
+ In this case, a warning is displayed, and the value is ignored.
+
+For more information about Redis, we recommend the [official Redis documentation](https://redis.io/docs/ "Link to official Redis documentation").
+
+{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/oauth2-token-introspection.md b/docs/content/reference/routing-configuration/http/middlewares/oauth2-token-introspection.md
new file mode 100644
index 000000000..8633abcbb
--- /dev/null
+++ b/docs/content/reference/routing-configuration/http/middlewares/oauth2-token-introspection.md
@@ -0,0 +1,209 @@
+---
+title: 'OAuth 2.0 Token Introspection Authentication'
+description: 'Traefik Hub API Gateway - OAuth 2.0 Token Introspection allows to retrieve metadata about an access token from an OAuth 2.0 server.'
+---
+
+!!! info "Traefik Hub Feature"
+ This middleware is available exclusively in [Traefik Hub](https://traefik.io/traefik-hub/). Learn more about [Traefik Hub's advanced features](https://doc.traefik.io/traefik-hub/api-gateway/intro).
+
+OAuth 2.0 Token Introspection allows Traefik Hub to retrieve metadata about an access token from an OAuth 2.0 server with the Token Introspection extension.
+
+The metadata can be used to restrict the access to applications. For more information please refer to the [RFC](https://tools.ietf.org/html/rfc7662).
+
+---
+
+## Configuration Example
+
+```yaml tab="Middleware OAuth Token Introspection"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-oauth-intro
+spec:
+ plugin:
+ oAuthIntrospection:
+ tokenSource:
+ header: Authorization
+ headerAuthScheme: Bearer
+ clientConfig:
+ url: "https://YOUR-KEYCLOAK-ADDRESS/realms/YOUR-REALM/protocol/openid-connect/token/introspect"
+ headers:
+ Authorization: Basic ZXhhbXBsZTpleGFtcGxl # echo -n "$CLIENT_ID:$CLIENT_SECRET" | base64
+ tokenTypeHint: access_token
+ forwardHeaders:
+ Group: grp
+ Expires-At: exp
+ claims: Equals(`grp`, `admin`)
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|:------|:------------|:--------|:---------|
+| `claims` | Defines the claims to validate in order to authorize the request.
The `claims` option can only be used with JWT-formatted token. (More information [here](#claims)) | "" | No |
+| `clientConfig.url` | Defines the introspection endpoint URL. It must include the scheme and path. | "" | Yes |
+| | Defines the headers to send in every introspection request. Values can be plain strings or a valid [Go template](https://pkg.go.dev/text/template).
Currently, a variable of type [`Request`](https://pkg.go.dev/net/http#Request) corresponding to the request being introspected is accessible in templates. | "" | No |
+| `clientConfig.tokenTypeHint` | Defines the type of token being introspected, sent as a hint to the introspection server.
Please refer to the [official documentation](https://tools.ietf.org/html/rfc7662) for more details. | "" | No |
+| `clientConfig.tls.ca` | PEM-encoded certificate bundle or a URN referencing a secret containing the certificate bundle used to establish a TLS connection with the authorization server (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.tls.cert` | PEM-encoded certificate or a URN referencing a secret containing the certificate used to establish a TLS connection with the Vault server (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.tls.key` | PEM-encoded key or a URN referencing a secret containing the key used to establish a TLS connection with the Vault server. (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.tls.insecureSkipVerify` | Disables TLS certificate verification when communicating with the authorization server.
Useful for testing purposes but strongly discouraged for production. (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.timeoutSeconds` | Defines the time before giving up requests to the authorization server. | 5 | No |
+| `clientConfig.maxRetries` | Defines the number of retries for requests to authorization server that fail. | 3 | No |
+| `forwardAuthorization` | Defines whether the authorization header will be forwarded or stripped from a request after it has been approved by the middleware. | false | No |
+| | Defines the HTTP headers to add to requests and populates them with values extracted from the access token claims returned by the authorization server.
Claims to be forwarded that are not found in the JWT result in empty headers.
The `forwardHeaders` option can only be used with JWT-formatted token. | [] | No |
+| | Defines the header name containing the secret sent by the client.
At least one `tokenSource`option must be set.| "" | No |
+| | Defines the scheme when using `Authorization` as header name.
Check out the `Authorization` header [documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization#syntax).
At least one `tokenSource`option must be set. | "" | No |
+| `tokenSource.query` | Defines the query parameter name containing the secret sent by the client.
At least one `tokenSource`option must be set.| "" | No |
+| `tokenSource.cookie` | Defines the cookie name containing the secret sent by the client.
At least one `tokenSource`option must be set.| "" | No |
+| `usernameClaim` | Defines the claim that will be evaluated to populate the `clientusername` in the access logs.
The `usernameClaim` option can only be used with JWT-formatted token.| "" | No |
+
+### claims
+
+#### Syntax
+
+The following functions are supported in `claims`:
+
+| Function | Description | Example |
+|-------------------|--------------------|-----------------|
+| Equals | Validates the equality of the value in `key` with `value`. | Equals(\`grp\`, \`admin\`) |
+| Prefix | Validates the value in `key` has the prefix of `value`. | Prefix(\`referrer\`, \`http://example.com\`) |
+| Contains (string) | Validates the value in `key` contains `value`. | Contains(\`referrer\`, \`/foo/\`) |
+| Contains (array) | Validates the `key` array contains the `value`. | Contains(\`areas\`, \`home\`) |
+| SplitContains | Validates the value in `key` contains the `value` once split by the separator. | SplitContains(\`scope\`, \` \`, \`writer\`) |
+| OneOf | Validates the `key` array contains one of the `values`. | OneOf(\`areas\`, \`office\`, \`lab\`) |
+
+All functions can be joined by boolean operands. The supported operands are:
+
+| Operand | Description | Example |
+|---------|--------------------|-----------------|
+| && | Compares two functions and returns true only if both evaluate to true. | Equals(\`grp\`, \`admin\`) && Equals(\`active\`, \`true\`) |
+| \|\| | Compares two functions and returns true if either evaluate to true. | Equals(\`grp\`, \`admin\`) \|\| Equals(\`active\`, \`true\`) |
+| ! | Returns false if the function is true, otherwise returns true. | !Equals(\`grp\`, \`testers\`) |
+
+All examples will return true for the following data structure:
+
+```json tab="JSON"
+{
+ "active": true,
+ "grp": "admin",
+ "scope": "reader writer deploy",
+ "referrer": "http://example.com/foo/bar",
+ "areas": [
+ "office",
+ "home"
+ ]
+}
+```
+
+#### Nested Claims
+
+Nested claims are supported by using a `.` between keys. For example:
+
+```bash tab="Key"
+user.name
+```
+
+```json tab="Claims"
+{
+ "active": true,
+ "grp": "admin",
+ "scope": "reader writer deploy",
+ "referrer": "http://example.com/foo/bar",
+ "areas": [
+ "office",
+ "home"
+ ],
+ "user" {
+ "name": "John Snow",
+ "status": "undead"
+ }
+}
+```
+
+```bash tab="Result"
+John Snow
+```
+
+!!! note "Handling keys that contain a '.'"
+
+If the `key` contains a dot, the dot can be escaped using `\.`
+
+!!! note "Handling a key that contains a '\'"
+
+If the `key` contains a `\`, it needs to be doubled `\\`.
+
+### clientConfig
+
+Defines the configuration used to connect the API Gateway to a Third Party Software such as an Identity Provider.
+
+#### `clientConfig.tls`
+
+##### Storing secret values in Kubernetes secrets
+
+When configuring the `tls.ca`, `tls.cert`, `tls.key`, it is possible to reference Kubernetes secrets defined in the same namespace as the Middleware.
+The reference to a Kubernetes secret takes the form of a URN:
+
+```text
+urn:k8s:secret:[name]:[valueKey]
+```
+
+```yaml tab="Middleware JWT"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-oauth-intro
+spec:
+ plugin:
+ oAuthIntrospection:
+ clientConfig:
+ tls:
+ ca: "urn:k8s:secret:tls:ca"
+ cert: "urn:k8s:secret:tls:cert"
+ key: "urn:k8s:secret:tls:key"
+ insecureSkipVerify: true
+```
+
+```yaml tab="Kubernetes TLS Secret"
+apiVersion: v1
+kind: Secret
+metadata:
+ name: tls
+stringData:
+ ca: |-
+ -----BEGIN CERTIFICATE-----
+ MIIB9TCCAWACAQAwgbgxGTAXBgNVBAoMEFF1b1ZhZGlzIExpbWl0ZWQxHDAaBgNV
+ BAsME0RvY3VtZW50IERlcGFydG1lbnQxOTA3BgNVBAMMMFdoeSBhcmUgeW91IGRl
+ Y29kaW5nIG1lPyAgVGhpcyBpcyBvbmx5IGEgdGVzdCEhITERMA8GA1UEBwwISGFt
+ aWx0b24xETAPBgNVBAgMCFBlbWJyb2tlMQswCQYDVQQGEwJCTTEPMA0GCSqGSIb3
+ DQEJARYAMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJ9WRanG/fUvcfKiGl
+ EL4aRLjGt537mZ28UU9/3eiJeJznNSOuNLnF+hmabAu7H0LT4K7EdqfF+XUZW/2j
+ RKRYcvOUDGF9A7OjW7UfKk1In3+6QDCi7X34RE161jqoaJjrm/T18TOKcgkkhRzE
+ apQnIDm0Ea/HVzX/PiSOGuertwIDAQABMAsGCSqGSIb3DQEBBQOBgQBzMJdAV4QP
+ Awel8LzGx5uMOshezF/KfP67wJ93UW+N7zXY6AwPgoLj4Kjw+WtU684JL8Dtr9FX
+ ozakE+8p06BpxegR4BR3FMHf6p+0jQxUEAkAyb/mVgm66TyghDGC6/YkiKoZptXQ
+ 98TwDIK/39WEB/V607As+KoYazQG8drorw==
+ -----END CERTIFICATE-----
+ cert: |-
+ -----BEGIN CERTIFICATE-----
+ MIIB9TCCAWACAQAwgbgxGTAXBgNVBAoMEFF1b1ZhZGlzIExpbWl0ZWQxHDAaBgNV
+ BAsME0RvY3VtZW50IERlcGFydG1lbnQxOTA3BgNVBAMMMFdoeSBhcmUgeW91IGRl
+ Y29kaW5nIG1lPyAgVGhpcyBpcyBvbmx5IGEgdGVzdCEhITERMA8GA1UEBwwISGFt
+ aWx0b24xETAPBgNVBAgMCFBlbWJyb2tlMQswCQYDVQQGEwJCTTEPMA0GCSqGSIb3
+ DQEJARYAMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJ9WRanG/fUvcfKiGl
+ EL4aRLjGt537mZ28UU9/3eiJeJznNSOuNLnF+hmabAu7H0LT4K7EdqfF+XUZW/2j
+ RKRYcvOUDGF9A7OjW7UfKk1In3+6QDCi7X34RE161jqoaJjrm/T18TOKcgkkhRzE
+ apQnIDm0Ea/HVzX/PiSOGuertwIDAQABMAsGCSqGSIb3DQEBBQOBgQBzMJdAV4QP
+ Awel8LzGx5uMOshezF/KfP67wJ93UW+N7zXY6AwPgoLj4Kjw+WtU684JL8Dtr9FX
+ ozakE+8p06BpxegR4BR3FMHf6p+0jQxUEAkAyb/mVgm66TyghDGC6/YkiKoZptXQ
+ 98TwDIK/39WEB/V607As+KoYazQG8drorw==
+ -----END CERTIFICATE-----
+ key: |-
+ -----BEGIN EC PRIVATE KEY-----
+ MHcCAQEEIC8CsJ/B115S+JtR1/l3ZQwKA3XdXt9zLqusF1VXc/KloAoGCCqGSM49
+ AwEHoUQDQgAEpwUmRIZHFt8CdDHYm1ikScCScd2q6QVYXxJu+G3fQZ78ScGtN7fu
+ KXMnQqVjXVRAr8qUY8yipVKuMCepnPXScQ==
+ -----END EC PRIVATE KEY-----
+```
+
+{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/oidc.md b/docs/content/reference/routing-configuration/http/middlewares/oidc.md
new file mode 100644
index 000000000..120e79bf9
--- /dev/null
+++ b/docs/content/reference/routing-configuration/http/middlewares/oidc.md
@@ -0,0 +1,430 @@
+---
+title: 'OpenID Connect Authentication'
+description: 'Traefik Hub API Gateway - The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider.'
+---
+
+!!! info "Traefik Hub Feature"
+ This middleware is available exclusively in [Traefik Hub](https://traefik.io/traefik-hub/). Learn more about [Traefik Hub's advanced features](https://doc.traefik.io/traefik-hub/api-gateway/intro).
+
+The OIDC Authentication middleware secures your applications by delegating the authentication to an external provider
+
+---
+
+## Configuration Example
+
+```yaml tab="Middleware OIDC"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-oidc
+ namespace: whoami
+spec:
+ plugin:
+ oidc:
+ issuer: "https://tenant.auth0.com/realms/myrealm"
+ redirectUrl: "/callback"
+ clientID: "urn:k8s:secret:my-secret:clientId"
+ clientSecret: "urn:k8s:secret:my-secret:clientSecret"
+ session:
+ name: customsessioncookiename
+ sliding: false
+ refresh: false
+ expiry: 10
+ sameSite: none
+ httpOnly: false
+ secure: true
+ stateCookie:
+ name: customstatecookiename
+ maxAge: 10
+ sameSite: none
+ httpOnly: true
+ secure: true
+ forwardHeaders:
+ Group: grp
+ Expires-At: exp
+ claims: Equals(`grp`, `admin`)
+ csrf: {}
+```
+
+```yaml tab="Kubernetes Secret"
+apiVersion: v1
+kind: Secret
+metadata:
+ name: my-secret
+stringData:
+ clientID: my-oidc-client-name
+ clientSecret: mysecret
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|:------|:------------|:--------|:---------|
+| `issuer` | Defines the URL to the OpenID Connect provider (for example, `https://accounts.google.com`).
It should point to the server which provides the OpenID Connect configuration. | "" | Yes |
+| `redirectUrl` | Defines the URL used by the OpenID Connect provider to redirect back to the middleware once the authorization is complete. (More information [here](#redirecturl)) | "" | Yes |
+| `clientID` | Defines the unique client identifier for an account on the OpenID Connect provider, must be set when the `clientSecret` option is set. (More information [here](#clientid-clientsecret)) | "" | Yes |
+| `clientSecret` | Defines the unique client secret for an account on the OpenID Connect provider, must be set when the `clientID` option is set. (More information [here](#clientid-clientsecret)) | "" | Yes |
+| `claims` | Defines the claims to validate in order to authorize the request.
The `claims` option can only be used with JWT-formatted token. (More information [here](#claims)) | "" | No |
+| `usernameClaim` | Defines the claim that will be evaluated to populate the `clientusername` in the access logs.
The `usernameClaim` option can only be used with JWT-formatted token.| "" | No |
+| | Defines the HTTP headers to add to requests and populates them with values extracted from the access token claims returned by the authorization server.
Claims to be forwarded that are not found in the JWT result in empty headers.
The `forwardHeaders` option can only be used with JWT-formatted token. | [] | No |
+| `clientConfig.tls.ca` | PEM-encoded certificate bundle or a URN referencing a secret containing the certificate bundle used to establish a TLS connection with the authorization server (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.tls.cert` | PEM-encoded certificate or a URN referencing a secret containing the certificate used to establish a TLS connection with the Vault server (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.tls.key` | PEM-encoded key or a URN referencing a secret containing the key used to establish a TLS connection with the Vault server. (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.tls.insecureSkipVerify` | Disables TLS certificate verification when communicating with the authorization server.
Useful for testing purposes but strongly discouraged for production. (More information [here](#clientconfig)) | "" | No |
+| `clientConfig.timeoutSeconds` | Defines the time before giving up requests to the authorization server. | 5 | No |
+| `clientConfig.maxRetries` | Defines the number of retries for requests to authorization server that fail. | 3 | No |
+| `pkce` | Defines the Proof Key for Code Exchange as described in [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636). | false | No |
+| `discoveryParams` | A map of arbitrary query parameters to be added to the openid-configuration well-known URI during the discovery mechanism. | "" | No |
+| `scopes` | The scopes to request. Must include `openid`. | openid | No |
+| `authParams` | A map of the arbitrary query parameters to be passed to the Authentication Provider.
When a `prompt` key is set to an empty string in the AuthParams,the prompt parameter is not added to the OAuth2 authorization URL Which means the user won't be prompted for consent.| "" | No |
+| `disableLogin` | Disables redirections to the authentication provider
This can be useful for protecting APIs where redirecting to a login page is undesirable. | false | No |
+| `loginUrl` | Defines the URL used to start authorization when needed.
All other requests that are not already authorized will return a 401 Unauthorized. When left empty, all requests can start authorization.
It can be a path (`/login` for example), a host and a path (`example.com/login`) or a complete URL (`https://example.com/login`).
Only `http` and `https` schemes are supported.| "" | No |
+| `logoutUrl` |Defines the URL on which the session should be deleted in order to log users out.
It can be a path (`/logout` for example), a host and a path (`example.com/logout`) or a complete URL (`https://example.com/logout`).
Only `http` and `https` schemes are supported.| "" | No |
+| `postLoginRedirectUrl` |If set and used in conjunction with `loginUrl`, the middleware will redirect to this URL after successful login.
It can be a path (`/after/login` for example), a host and a path (`example.com/after/login`) or a complete URL (`https://example.com/after/login`).
Only `http` and `https` schemes are supported. | "" | No |
+| `postLogoutRedirectUrl` | If set and used in conjunction with `logoutUrl`, the middleware will redirect to this URL after logout.
It can be a path (`/after/logout` for example), a host and a path (`example.com/after/logout`) or a complete URL (`https://example.com/after/logout`).
Only `http` and `https` schemes are supported. | "" | No |
+| `backchannelLogoutUrl` | Defines the URL called by the OIDC provider when a user logs out (see https://openid.net/specs/openid-connect-rpinitiated-1_0.html#OpenID.BackChannel).
It can be a path (`/backchannel-logout` for example), a host and a path (`example.com/backchannel-logout`) or a complete URL (`https://example.com/backchannel-logout`).
Only `http` and `https` schemes are supported.
This feature is currently in an experimental state and has been tested exclusively with the Keycloak OIDC provider. | "" | No |
+| `backchannelLogoutSessionsRequired` | This specifies whether the OIDC provider includes the sid (session ID) Claim in the Logout Token to identify the user session (see https://openid.net/specs/openid-connect-backchannel-1_0.html#BCRegistration).
If omitted, the default value is false.
This feature is currently in an experimental state and has been tested exclusively with the Keycloak OIDC provider. | false | No |
+| `stateCookie.name` | Defines the name of the state cookie. |"`MIDDLEWARE_NAME`-state" | No |
+| `stateCookie.path` | Defines the URL path that must exist in the requested URL in order to send the Cookie header.
The `%x2F` ('/') character is considered a directory separator, and subdirectories will match as well.
For example, if `stateCookie.path` is set to `/docs`, these paths will match: `/docs`,`/docs/web/`,`/docs/web/http`.| "/" | No |
+| `stateCookie.domain` | Defines the hosts that are allowed to receive the cookie.
If specified, then subdomains are always included.
For example, if it is set to `example.com`, then cookies are included on subdomains like `api.example.com`. | "" | No |
+| `stateCookie.maxAge` |Defines the number of seconds after which the state cookie should expire.
A zero or negative number will expire the cookie immediately. | 600 | No |
+| `stateCookie.sameSite` | Informsbrowsers how they should handle the state cookie on cross-site requests.
Setting it to `lax` or `strict` can provide some protection against cross-site request forgery attacks ([CSRF](https://developer.mozilla.org/en-US/docs/Glossary/CSRF)).
More information [here](#samesite---accepted-values). | lax | No |
+| `stateCookie.httpOnly` | Forbids JavaScript from accessing the cookie.
For example, through the `Document.cookie` property, the `XMLHttpRequest` API, or the `Request` API.
This mitigates attacks against cross-site scripting ([XSS](https://developer.mozilla.org/en-US/docs/Glossary/XSS)). | true | No |
+| `stateCookie.secure` | Defines whether the state cookie is only sent to the server when a request is made with the `https` scheme. | false | No |
+| `session.name` | The name of the session cookie. |"`MIDDLEWARE_NAME`-session"| No |
+| `session.path` | Defines the URL path that must exist in the requested URL in order to send the Cookie header.
The `%x2F` ('/'') character is considered a directory separator, and subdirectories will match as well.
For example, if `stateCookie.path` is set to `/docs`, these paths will match: `/docs`,`/docs/web/`,`/docs/web/http`.| "/" | No |
+| `session.domain` | Specifies the hosts that are allowed to receive the cookie. If specified, then subdomains are always included. If specified, then subdomains are always included.
For example, if it is set to `example.com`, then cookies are included on subdomains like `api.example.com`.| "" | No |
+| `session.expiry` | Number of seconds after which the session should expire. A zero or negative number is **prohibited**. | 86400 (24h) | No |
+| `session.sliding` | Forces the middleware to renew the session cookie each time an authenticated request is received. | true | No |
+| `session.refresh` | Enables the access token refresh when it expires. | true | No |
+| `session.sameSite` | Inform browsers how they should handle the session cookie on cross-site requests.
Setting it to `lax` or `strict` can provide some protection against cross-site request forgery attacks ([CSRF](https://developer.mozilla.org/en-US/docs/Glossary/CSRF)).
More information [here](#samesite---accepted-values). | lax | No |
+| `session.httpOnly` | Forbids JavaScript from accessing the cookie.
For example, through the `Document.cookie` property, the `XMLHttpRequest` API, or the `Request` API.
This mitigates attacks against cross-site scripting ([XSS](https://developer.mozilla.org/en-US/docs/Glossary/XSS)). | true | No |
+| `session.secure` | Defines whether the session cookie is only sent to the server when a request is made with the `https` scheme. | false | No |
+| `session.store.redis.endpoints` | Endpoints of the Redis instances to connect to (example: `redis.traefik-hub.svc.cluster.local:6379`) | "" | Yes |
+| `session.store.redis.username` | The username Traefik Hub will use to connect to Redis | "" | No |
+| `session.store.redis.password` | The password Traefik Hub will use to connect to Redis | "" | No |
+| `session.store.redis.database` | The database Traefik Hub will use to sore information (default: `0`) | "" | No |
+| `session.store.redis.cluster` | Enable Redis Cluster | "" | No |
+| `session.store.redis.tls.caBundle` | Custom CA bundle | "" | No |
+| `session.store.redis.tls.cert` | TLS certificate | "" | No |
+| `session.store.redis.tls.key` | TLS key | "" | No |
+| `session.store.redis.tls.insecureSkipVerify` | Allow skipping the TLS verification | "" | No |
+| `session.store.redis.sentinel.masterSet` | Name of the set of main nodes to use for main selection. Required when using Sentinel. | "" | No |
+| `session.store.redis.sentinel.username` | Username to use for sentinel authentication (can be different from `username`) | "" | No |
+| `session.store.redis.sentinel.password` | Password to use for sentinel authentication (can be different from `password`) | "" | No |
+| `csrf` | When enabled, a CSRF cookie, named `traefikee-csrf-token`, is bound to the OIDC session to protect service from CSRF attacks.
It is based on the [Signed Double Submit Cookie](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#signed-double-submit-cookie) implementation as defined by the OWASP Foundation.
Moreinformation [here](#csrf). | "" | No |
+| `csrf.secure` | Defines whether the CSRF cookie is only sent to the server when a request is made with the `https` scheme. | false | No |
+| | Defines the name of the header used to send the CSRF token value received previously in the CSRF cookie. | TraefikHub-Csrf-Token | No |
+
+### redirectUrl
+
+#### Add specific rule on the IngressRoute
+
+The URL informs the OpenID Connect provider how to return to the middleware.
+If the router rule is accepting all paths on a domain, no extra work is needed.
+If the router rule is specific about the paths allowed, the path set in this option should be included.
+
+```yaml tab="Defining specific rule for redirectUrl"
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+ name: whoami
+spec:
+ entryPoints:
+ - web
+ - websecure
+ routes:
+ # Rules to match the loginUrl and redirectUrl can be added into
+ # your current router.
+ - match: Path(`/myapi`) || Path(`/login`) || Path(`/callback`)
+ kind: Rule
+ middlewares:
+ - name: test-oidc
+```
+
+This URL will not be passed to the upstream application, but rather handled by the middleware itself.
+The chosen URL should therefore not conflict with any URLs needed by the upstream application.
+
+This URL sometimes needs to be set in the OpenID Connect Provider's configuration as well (like for Google Accounts for example).
+
+It can be the absolute URL, relative to the protocol (inherits the request protocol), or relative to the domain (inherits the request domain and protocol).
+See the following examples.
+
+#### Inherit the Protocol and Domain from the Request and Uses the Redirecturl’s Path
+
+| Request URL | RedirectURL| Result |
+|:------------|:-----------|:-------|
+| `http://expl.co` | `/cback` | `http://expl.co/cback` |
+
+#### Inherit the Protocol from the Request and Uses the Redirecturl’s Domain and Path
+
+| Request URL | RedirectURL| Result |
+|:------------|:-----------|:-------|
+| `https://scur.co` | `expl.co/cback`| `https://expl.co/cback` |
+
+#### Replace the Request URL with the Redirect URL since It Is an Absolute URL
+
+| Request URL | RedirectURL| Result |
+|:------------|:-----------|:-------|
+| `https://scur.co` | `http://expl.co/cback` | `http://expl.co/cback` |
+
+!!! note "Supported Schemes"
+
+ Only `http` and `https` schemes are supported.
+
+```yaml tab="Defining the redirectUrl"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-oidc
+spec:
+ plugin:
+ oidc:
+ issuer: "https://tenant.auth0.com/realms/myrealm"
+ redirectUrl: "/callback"
+ clientID: my-oidc-client-name
+ clientSecret: mysecret
+```
+
+### clientID, clientSecret
+
+#### Storing secret values in Kubernetes secrets
+
+When configuring the `clientID` and the `clientSecret`, it is possible to reference Kubernetes secrets defined in the same namespace as the Middleware.
+The reference to a Kubernetes secret takes the form of a URN:
+
+```text
+urn:k8s:secret:[name]:[valueKey]
+```
+
+### claims
+
+#### Syntax
+
+The following functions are supported in `claims`:
+
+| Function | Description | Example |
+|-------------------|--------------------|-----------------|
+| Equals | Validates the equality of the value in `key` with `value`. | Equals(\`grp\`, \`admin\`) |
+| Prefix | Validates the value in `key` has the prefix of `value`. | Prefix(\`referrer\`, \`http://example.com\`) |
+| Contains (string) | Validates the value in `key` contains `value`. | Contains(\`referrer\`, \`/foo/\`) |
+| Contains (array) | Validates the `key` array contains the `value`. | Contains(\`areas\`, \`home\`) |
+| SplitContains | Validates the value in `key` contains the `value` once split by the separator. | SplitContains(\`scope\`, \` \`, \`writer\`) |
+| OneOf | Validates the `key` array contains one of the `values`. | OneOf(\`areas\`, \`office\`, \`lab\`) |
+
+All functions can be joined by boolean operands. The supported operands are:
+
+| Operand | Description | Example |
+|---------|--------------------|-----------------|
+| && | Compares two functions and returns true only if both evaluate to true. | Equals(\`grp\`, \`admin\`) && Equals(\`active\`, \`true\`) |
+| \|\| | Compares two functions and returns true if either evaluate to true. | Equals(\`grp\`, \`admin\`) \|\| Equals(\`active\`, \`true\`) |
+| ! | Returns false if the function is true, otherwise returns true. | !Equals(\`grp\`, \`testers\`) |
+
+All examples will return true for the following data structure:
+
+```json tab="JSON"
+{
+ "active": true,
+ "grp": "admin",
+ "scope": "reader writer deploy",
+ "referrer": "http://example.com/foo/bar",
+ "areas": [
+ "office",
+ "home"
+ ]
+}
+```
+
+#### Nested Claims
+
+Nested claims are supported by using a `.` between keys. For example:
+
+```bash tab="Key"
+user.name
+```
+
+```json tab="Claims"
+{
+ "active": true,
+ "grp": "admin",
+ "scope": "reader writer deploy",
+ "referrer": "http://example.com/foo/bar",
+ "areas": [
+ "office",
+ "home"
+ ],
+ "user" {
+ "name": "John Snow",
+ "status": "undead"
+ }
+}
+```
+
+```bash tab="Result"
+John Snow
+```
+
+!!! note "Handling keys that contain a '.'"
+
+If the `key` contains a dot, the dot can be escaped using `\.`
+
+!!! note "Handling a key that contains a '\'"
+
+If the `key` contains a `\`, it needs to be doubled `\\`.
+
+!!! note "Access Token and ID Token claims"
+
+ The first argument of the function, which represents the key to look for in the token claims, can be prefixed to specify which of the two kinds of token is inspected.
+ Possible prefix values are `id_token.` and `access_token.`. If no prefix is specified, it defaults to the ID token.
+
+ | Example | Description |
+ | ----------------------------------------- | ------------------------------------------------------------------------------ |
+ | Equals(\`id_token.grp\`, \`admin\`) | Checks if the value of claim `grp` in the ID token is `admin`. |
+ | Prefix(\`access_token.referrer\`, \`http://example.com\`) | Checks if the value of claim `referrer` in the access token is prefixed by `http://example.com\`.|
+ | OneOf(\`areas\`, \`office\`, \`lab\`) | Checks if the value of claim `areas` in the ID token is `office` or `labs`. |
+
+### clientConfig
+
+Defines the configuration used to connect the API Gateway to a Third Party Software such as an Identity Provider.
+
+#### `clientConfig.tls`
+
+##### Storing secret values in Kubernetes secrets
+
+When configuring the `tls.ca`, `tls.cert`, `tls.key`, it is possible to reference Kubernetes secrets defined in the same namespace as the Middleware.
+The reference to a Kubernetes secret takes the form of a URN:
+
+```text
+urn:k8s:secret:[name]:[valueKey]
+```
+
+```yaml tab="Middleware JWT"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-oidc
+spec:
+ plugin:
+ oidc:
+ clientConfig:
+ tls:
+ ca: "urn:k8s:secret:tls:ca"
+ cert: "urn:k8s:secret:tls:cert"
+ key: "urn:k8s:secret:tls:key"
+ insecureSkipVerify: true
+```
+
+```yaml tab="Kubernetes TLS Secret"
+apiVersion: v1
+kind: Secret
+metadata:
+ name: tls
+stringData:
+ ca: |-
+ -----BEGIN CERTIFICATE-----
+ MIIB9TCCAWACAQAwgbgxGTAXBgNVBAoMEFF1b1ZhZGlzIExpbWl0ZWQxHDAaBgNV
+ BAsME0RvY3VtZW50IERlcGFydG1lbnQxOTA3BgNVBAMMMFdoeSBhcmUgeW91IGRl
+ Y29kaW5nIG1lPyAgVGhpcyBpcyBvbmx5IGEgdGVzdCEhITERMA8GA1UEBwwISGFt
+ aWx0b24xETAPBgNVBAgMCFBlbWJyb2tlMQswCQYDVQQGEwJCTTEPMA0GCSqGSIb3
+ DQEJARYAMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJ9WRanG/fUvcfKiGl
+ EL4aRLjGt537mZ28UU9/3eiJeJznNSOuNLnF+hmabAu7H0LT4K7EdqfF+XUZW/2j
+ RKRYcvOUDGF9A7OjW7UfKk1In3+6QDCi7X34RE161jqoaJjrm/T18TOKcgkkhRzE
+ apQnIDm0Ea/HVzX/PiSOGuertwIDAQABMAsGCSqGSIb3DQEBBQOBgQBzMJdAV4QP
+ Awel8LzGx5uMOshezF/KfP67wJ93UW+N7zXY6AwPgoLj4Kjw+WtU684JL8Dtr9FX
+ ozakE+8p06BpxegR4BR3FMHf6p+0jQxUEAkAyb/mVgm66TyghDGC6/YkiKoZptXQ
+ 98TwDIK/39WEB/V607As+KoYazQG8drorw==
+ -----END CERTIFICATE-----
+ cert: |-
+ -----BEGIN CERTIFICATE-----
+ MIIB9TCCAWACAQAwgbgxGTAXBgNVBAoMEFF1b1ZhZGlzIExpbWl0ZWQxHDAaBgNV
+ BAsME0RvY3VtZW50IERlcGFydG1lbnQxOTA3BgNVBAMMMFdoeSBhcmUgeW91IGRl
+ Y29kaW5nIG1lPyAgVGhpcyBpcyBvbmx5IGEgdGVzdCEhITERMA8GA1UEBwwISGFt
+ aWx0b24xETAPBgNVBAgMCFBlbWJyb2tlMQswCQYDVQQGEwJCTTEPMA0GCSqGSIb3
+ DQEJARYAMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJ9WRanG/fUvcfKiGl
+ EL4aRLjGt537mZ28UU9/3eiJeJznNSOuNLnF+hmabAu7H0LT4K7EdqfF+XUZW/2j
+ RKRYcvOUDGF9A7OjW7UfKk1In3+6QDCi7X34RE161jqoaJjrm/T18TOKcgkkhRzE
+ apQnIDm0Ea/HVzX/PiSOGuertwIDAQABMAsGCSqGSIb3DQEBBQOBgQBzMJdAV4QP
+ Awel8LzGx5uMOshezF/KfP67wJ93UW+N7zXY6AwPgoLj4Kjw+WtU684JL8Dtr9FX
+ ozakE+8p06BpxegR4BR3FMHf6p+0jQxUEAkAyb/mVgm66TyghDGC6/YkiKoZptXQ
+ 98TwDIK/39WEB/V607As+KoYazQG8drorw==
+ -----END CERTIFICATE-----
+ key: |-
+ -----BEGIN EC PRIVATE KEY-----
+ MHcCAQEEIC8CsJ/B115S+JtR1/l3ZQwKA3XdXt9zLqusF1VXc/KloAoGCCqGSM49
+ AwEHoUQDQgAEpwUmRIZHFt8CdDHYm1ikScCScd2q6QVYXxJu+G3fQZ78ScGtN7fu
+ KXMnQqVjXVRAr8qUY8yipVKuMCepnPXScQ==
+ -----END EC PRIVATE KEY-----
+```
+
+### sameSite - Accepted values
+
+- `none`: Thebrowser will send cookies with both cross-site requests and same-site requests.
+- `strict`: Thebrowser will only send cookies for same-site requests (requests originating from the site that set the cookie).
+ If the request originated from a different URL than the URL of the current location, none of the cookies tagged with the `strict` attribute will be included.
+- `lax`: Same-site cookies are withheld on cross-site subrequests, such as calls to load images or frames, but will be sent when a user navigates to the URL from an external site; for example, by following a link.
+
+### session.store
+
+An OpenID Connect Authentication middleware can use a persistent KV storage to store the `HTTP` sessions data
+instead of keeping all the state in cookies.
+It avoids cookies growing inconveniently large, which can lead to latency issues.
+
+Refer to the [redis options](#configuration-options) to configure the Redis connection.
+
+Connection parameters to your [Redis](https://redis.io/ "Link to website of Redis") server are attached to your Middleware deployment.
+
+The following Redis modes are supported:
+
+- Single instance mode
+- [Redis Cluster](https://redis.io/docs/management/scaling "Link to official Redis documentation about Redis Cluster mode")
+- [Redis Sentinel](https://redis.io/docs/management/sentinel "Link to official Redis documentation about Redis Sentinel mode")
+
+!!! info
+
+ If you use Redis in single instance mode or Redis Sentinel, you can configure the `database` field.
+ This value won't be taken into account if you use Redis Cluster (only database `0` is available).
+
+ In this case, a warning is displayed, and the value is ignored.
+
+For more information about Redis, we recommend the [official Redis documentation](https://redis.io/docs/ "Link to official Redis documentation").
+
+```yaml tab="Defining Redis connection"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: test-oidc
+spec:
+ plugin:
+ oidc:
+ issuer: "https://tenant.auth0.com/realms/myrealm"
+ redirectUrl: "/callback"
+ clientID: my-oidc-client-name
+ clientSecret: mysecret
+ session:
+ store:
+ redis:
+ endpoints:
+ - redis-master.traefik-hub.svc.cluster.local:6379
+ password: "urn:k8s:secret:oidc:redisPass"
+```
+
+```yaml tab="Creating the Kubernetes secret"
+apiVersion: v1
+kind: Secret
+metadata:
+ name: oidc
+stringData:
+ redisPass: mysecret12345678
+```
+
+### csrf
+
+#### CSRF Internal Behavior
+
+When the OIDC session is expired, the corresponding CSRF cookie is deleted.
+This means that a new CSRF token will be generated and sent to the client whenever the session is refreshed or recreated.
+
+When a request is sent and uses a non-safe method (see [RFC7231#section-4.2.1](https://datatracker.ietf.org/doc/html/rfc7231.html#section-4.2.1)),
+the CSRF token value (extracted from the cookie) have to be sent to the server in the header configured with the [headerName option](#configuration-options).
+
+{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/opa.md b/docs/content/reference/routing-configuration/http/middlewares/opa.md
new file mode 100644
index 000000000..4dabfe455
--- /dev/null
+++ b/docs/content/reference/routing-configuration/http/middlewares/opa.md
@@ -0,0 +1,72 @@
+---
+title: 'Open Policy Agent'
+description: 'Traefik Hub API Gateway - The Open Policy Agent (OPA) middleware that allows you to restrict access to your services.'
+---
+
+!!! info "Traefik Hub Feature"
+ This middleware is available exclusively in [Traefik Hub](https://traefik.io/traefik-hub/). Learn more about [Traefik Hub's advanced features](https://doc.traefik.io/traefik-hub/api-gateway/intro).
+
+Traefik Hub comes with an Open Policy Agent middleware that allows you to restrict access to your services. It also allows you to enrich request headers with data extracted from policies.
+The OPA middleware works as an [OPA agent](https://www.openpolicyagent.org/).
+
+!!! note "OPA Version"
+
+ This middleware uses the [v1.3.0 of the OPA specification](https://www.openpolicyagent.org/docs).
+
+## Configuration Example
+
+```yaml tab="Allow requests with specific JWT claim"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: opa-allow-jwt-claim
+ namespace: apps
+spec:
+ plugin:
+ opa:
+ policy: |
+ package example.policies
+
+ allow {
+ [_, encoded] := split(input.headers.Authorization, " ")
+ [header, payload, signature] = io.jwt.decode(encoded)
+ payload["email"] == "bibi@example.com"
+ }
+ forwardHeaders:
+ Group: data.package.grp
+```
+
+```yaml tab="Deny requests with JSON Accept Header"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: opa-deny-json
+ namespace: apps
+spec:
+ plugin:
+ opa:
+ policy: |
+ package example.policies
+
+ default allow = false
+
+ json_content {
+ input.headers["Accept"] == "application/json"
+ }
+
+ allow {
+ not json_content
+ }
+ allow: data.example.policies.allow
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|:---------|-----------------------|:--------|:----------------------------|
+| `policy` | Path or the content of a [policy file](https://www.openpolicyagent.org/docs/v0.66.0/kubernetes-primer/#writing-policies). | "" | No (one of `policy` or `bundlePath` must be set) |
+| `bundlePath` | The `bundlePath` option should contain the path to an OPA [bundle](https://www.openpolicyagent.org/docs/v0.66.0/management-bundles/). | "" | No (one of `policy` or `bundlePath` must be set) |
+| `allow` | The `allow` option sets the expression to evaluate that determines if the request should be authorized. | "" | No (one of `allow` or `forwardHeaders` must be set) |
+| | The `forwardHeaders` option sets the HTTP headers to add to requests and populates them with the result of the given expression. | "" | No (one of `allow` or `forwardHeaders` must be set) |
+
+{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/overview.md b/docs/content/reference/routing-configuration/http/middlewares/overview.md
index 07ea72df0..40ddb6015 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/overview.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/overview.md
@@ -20,29 +20,29 @@ Middlewares that use the same protocol can be combined into chains to fit every
| Middleware | Purpose | Area |
|-------------------------------------------|---------------------------------------------------|-----------------------------|
-| [AddPrefix](addprefix.md) | Adds a Path Prefix | Path Modifier |
-| [BasicAuth](basicauth.md) | Adds Basic Authentication | Security, Authentication |
-| [Buffering](buffering.md) | Buffers the request/response | Request Lifecycle |
-| [Chain](chain.md) | Combines multiple pieces of middleware | Misc |
-| [CircuitBreaker](circuitbreaker.md) | Prevents calling unhealthy services | Request Lifecycle |
-| [Compress](compress.md) | Compresses the response | Content Modifier |
-| [ContentType](contenttype.md) | Handles Content-Type auto-detection | Misc |
-| [DigestAuth](digestauth.md) | Adds Digest Authentication | Security, Authentication |
-| [Errors](errorpages.md) | Defines custom error pages | Request Lifecycle |
-| [ForwardAuth](forwardauth.md) | Delegates Authentication | Security, Authentication |
-| [GrpcWeb](grpcweb.md) | Converts gRPC Web requests to HTTP/2 gRPC requests. | Request |
-| [Headers](headers.md) | Adds / Updates headers | Security |
-| [IPAllowList](ipallowlist.md) | Limits the allowed client IPs | Security, Request lifecycle |
-| [InFlightReq](inflightreq.md) | Limits the number of simultaneous connections | Security, Request lifecycle |
-| [PassTLSClientCert](passtlsclientcert.md) | Adds Client Certificates in a Header | Security |
-| [RateLimit](ratelimit.md) | Limits the call frequency | Security, Request lifecycle |
-| [RedirectScheme](redirectscheme.md) | Redirects based on scheme | Request lifecycle |
-| [RedirectRegex](redirectregex.md) | Redirects based on regex | Request lifecycle |
-| [ReplacePath](replacepath.md) | Changes the path of the request | Path Modifier |
-| [ReplacePathRegex](replacepathregex.md) | Changes the path of the request | Path Modifier |
-| [Retry](retry.md) | Automatically retries in case of error | Request lifecycle |
-| [StripPrefix](stripprefix.md) | Changes the path of the request | Path Modifier |
-| [StripPrefixRegex](stripprefixregex.md) | Changes the path of the request | Path Modifier |
+| [AddPrefix](addprefix.md) | Adds a Path Prefix | Path Modifier |
+| [BasicAuth](basicauth.md) | Adds Basic Authentication | Security, Authentication |
+| [Buffering](buffering.md) | Buffers the request/response | Request Lifecycle |
+| [Chain](chain.md) | Combines multiple pieces of middleware | Misc |
+| [CircuitBreaker](circuitbreaker.md) | Prevents calling unhealthy services | Request Lifecycle |
+| [Compress](compress.md) | Compresses the response | Content Modifier |
+| [ContentType](contenttype.md) | Handles Content-Type auto-detection | Misc |
+| [DigestAuth](digestauth.md) | Adds Digest Authentication | Security, Authentication |
+| [Errors](errorpages.md) | Defines custom error pages | Request Lifecycle |
+| [ForwardAuth](forwardauth.md) | Delegates Authentication | Security, Authentication |
+| [GrpcWeb](grpcweb.md) | Converts gRPC Web requests to HTTP/2 gRPC requests. | Request |
+| | Adds / Updates headers | Security |
+| [IPAllowList](ipallowlist.md) | Limits the allowed client IPs | Security, Request lifecycle |
+| [InFlightReq](inflightreq.md) | Limits the number of simultaneous connections | Security, Request lifecycle |
+| [PassTLSClientCert](passtlsclientcert.md) | Adds Client Certificates in a Header | Security |
+| [RateLimit](ratelimit.md) | Limits the call frequency | Security, Request lifecycle |
+| [RedirectScheme](redirectscheme.md) | Redirects based on scheme | Request lifecycle |
+| [RedirectRegex](redirectregex.md) | Redirects based on regex | Request lifecycle |
+| [ReplacePath](replacepath.md) | Changes the path of the request | Path Modifier |
+| [ReplacePathRegex](replacepathregex.md) | Changes the path of the request | Path Modifier |
+| [Retry](retry.md) | Automatically retries in case of error | Request lifecycle |
+| [StripPrefix](stripprefix.md) | Changes the path of the request | Path Modifier |
+| [StripPrefixRegex](stripprefixregex.md) | Changes the path of the request | Path Modifier |
## Community Middlewares
diff --git a/docs/content/reference/routing-configuration/http/middlewares/passtlsclientcert.md b/docs/content/reference/routing-configuration/http/middlewares/passtlsclientcert.md
index 10b40bb01..c56394109 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/passtlsclientcert.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/passtlsclientcert.md
@@ -206,28 +206,28 @@ spec:
| Field | Description | Default | Required |
|:-----------|:------------------------------------------------------------|:--------|:---------|
-| `pem` | Fills the `X-Forwarded-Tls-Client-Cert` header with the certificate information.
More information [here](#pem). | false | No |
-| `info.serialNumber` | Add the `Serial Number` of the certificate.
More information about `info` [here](#info). | false | No |
-| `info.notAfter` | Add the `Not After` information from the `Validity` part.
More information about `info` [here](#info). | false | No |
-| `info.notBefore` | Add the `Not Before` information from the `Validity` part.
More information about `info` [here](#info). | false | No |
-| `info.sans` | Add the `Subject Alternative Name` information from the `Subject Alternative Name` part.
More information about `info` [here](#info). | false | No |
-| `info.subject` | The `info.subject` selects the specific client certificate subject details you want to add to the `X-Forwarded-Tls-Client-Cert-Info` header.
More information about `info` [here](#info). | false | No |
-| `info.subject.country` | Add the `country` information into the subject.
The data is taken from the subject part with the `C` key.
More information about `info` [here](#info). | false | No |
-| `info.subject.province` | Add the `province` information into the subject.
The data is taken from the subject part with the `ST` key.
More information about `info` [here](#info). | false | No |
-| `info.subject.locality` | Add the `locality` information into the subject.
The data is taken from the subject part with the `L` key.
More information about `info` [here](#info). | false | No |
-| `info.subject.organization` | Add the `organization` information into the subject.
The data is taken from the subject part with the `O` key.
More information about `info` [here](#info). | false | No |
-| `info.subject.organizationalUnit` | Add the `organizationalUnit` information into the subject.
The data is taken from the subject part with the `OU` key.
More information about `info` [here](#info). | false | No |
-| `info.subject.commonName` | Add the `commonName` information into the subject.
The data is taken from the subject part with the `CN` key.| false | No |
-| `info.subject.serialNumber` | Add the `serialNumber` information into the subject.
The data is taken from the subject part with the `SN` key.| false | No |
-| `info.subject.domainComponent` | Add the `domainComponent` information into the subject.
The data is taken from the subject part with the `DC` key.
More information about `info` [here](#info). | false | No |
-| `info.issuer` | The `info.issuer` selects the specific client certificate issuer details you want to add to the `X-Forwarded-Tls-Client-Cert-Info` header.
More information about `info` [here](#info). | false | No |
-| `info.issuer.country` | Add the `country` information into the issuer.
The data is taken from the issuer part with the `C` key.
More information about `info` [here](#info). | false | No |
-| `info.issuer.province` | Add the `province` information into the issuer.
The data is taken from the issuer part with the `ST` key.
More information about `info` [here](#info). | false | No |
-| `info.issuer.locality` | Add the `locality` information into the issuer.
The data is taken from the issuer part with the `L` key.
More information about `info` [here](#info). | false | No |
-| `info.issuer.organization` | Add the `organization` information into the issuer.
The data is taken from the issuer part with the `O` key.
More information about `info` [here](#info). | false | No |
-| `info.issuer.commonName` |Add the `commonName` information into the issuer.
The data is taken from the issuer part with the `CN` key.
More information about `info` [here](#info). | false | No |
-| `info.issuer.serialNumber` |Add the `serialNumber` information into the issuer.
The data is taken from the issuer part with the `SN` key.
More information about `info` [here](#info). | false | No |
-| `info.issuer.domainComponent` | Add the `domainComponent` information into the issuer.
The data is taken from the issuer part with the `DC` key.
More information about `info` [here](#info). | false | No |
+| `pem` | Fills the `X-Forwarded-Tls-Client-Cert` header with the certificate information.
More information [here](#pem). | false | No |
+| `info.serialNumber` | Add the `Serial Number` of the certificate.
More information about `info` [here](#info). | false | No |
+| `info.notAfter` | Add the `Not After` information from the `Validity` part.
More information about `info` [here](#info). | false | No |
+| `info.notBefore` | Add the `Not Before` information from the `Validity` part.
More information about `info` [here](#info). | false | No |
+| `info.sans` | Add the `Subject Alternative Name` information from the `Subject Alternative Name` part.
More information about `info` [here](#info). | false | No |
+| `info.subject` | The `info.subject` selects the specific client certificate subject details you want to add to the `X-Forwarded-Tls-Client-Cert-Info` header.
More information about `info` [here](#info). | false | No |
+| `info.subject.country` | Add the `country` information into the subject.
The data is taken from the subject part with the `C` key.
More information about `info` [here](#info). | false | No |
+| `info.subject.province` | Add the `province` information into the subject.
The data is taken from the subject part with the `ST` key.
More information about `info` [here](#info). | false | No |
+| `info.subject.locality` | Add the `locality` information into the subject.
The data is taken from the subject part with the `L` key.
More information about `info` [here](#info). | false | No |
+| `info.subject.organization` | Add the `organization` information into the subject.
The data is taken from the subject part with the `O` key.
More information about `info` [here](#info). | false | No |
+| `info.subject.organizationalUnit` | Add the `organizationalUnit` information into the subject.
The data is taken from the subject part with the `OU` key.
More information about `info` [here](#info). | false | No |
+| `info.subject.commonName` | Add the `commonName` information into the subject.
The data is taken from the subject part with the `CN` key.| false | No |
+| `info.subject.serialNumber` | Add the `serialNumber` information into the subject.
The data is taken from the subject part with the `SN` key.| false | No |
+| `info.subject.domainComponent` | Add the `domainComponent` information into the subject.
The data is taken from the subject part with the `DC` key.
More information about `info` [here](#info). | false | No |
+| `info.issuer` | The `info.issuer` selects the specific client certificate issuer details you want to add to the `X-Forwarded-Tls-Client-Cert-Info` header.
More information about `info` [here](#info). | false | No |
+| `info.issuer.country` | Add the `country` information into the issuer.
The data is taken from the issuer part with the `C` key.
More information about `info` [here](#info). | false | No |
+| `info.issuer.province` | Add the `province` information into the issuer.
The data is taken from the issuer part with the `ST` key.
More information about `info` [here](#info). | false | No |
+| `info.issuer.locality` | Add the `locality` information into the issuer.
The data is taken from the issuer part with the `L` key.
More information about `info` [here](#info). | false | No |
+| `info.issuer.organization` | Add the `organization` information into the issuer.
The data is taken from the issuer part with the `O` key.
More information about `info` [here](#info). | false | No |
+| `info.issuer.commonName` |Add the `commonName` information into the issuer.
The data is taken from the issuer part with the `CN` key.
More information about `info` [here](#info). | false | No |
+| `info.issuer.serialNumber` |Add the `serialNumber` information into the issuer.
The data is taken from the issuer part with the `SN` key.
More information about `info` [here](#info). | false | No |
+| `info.issuer.domainComponent` | Add the `domainComponent` information into the issuer.
The data is taken from the issuer part with the `DC` key.
More information about `info` [here](#info). | false | No |
### pem
diff --git a/docs/content/reference/routing-configuration/http/middlewares/ratelimit.md b/docs/content/reference/routing-configuration/http/middlewares/ratelimit.md
index 216d3d9f1..80d1b4d49 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/ratelimit.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/ratelimit.md
@@ -18,38 +18,108 @@ For a rate below 1 req/s, define a `period` larger than a second
```yaml tab="Structured (YAML)"
# Here, an average of 100 requests per second is allowed.
# In addition, a burst of 200 requests is allowed.
+# Redis distributed rate limiting is configured with all available options.
http:
middlewares:
test-ratelimit:
rateLimit:
average: 100
+ period: 1s
burst: 200
+ redis:
+ endpoints:
+ - "redis-primary.example.com:6379"
+ - "redis-replica.example.com:6379"
+ username: "ratelimit-user"
+ password: "secure-password"
+ db: 2
+ poolSize: 50
+ minIdleConns: 10
+ maxActiveConns: 200
+ readTimeout: 3s
+ writeTimeout: 3s
+ dialTimeout: 5s
+ tls:
+ ca: "/etc/ssl/redis-ca.crt"
+ cert: "/etc/ssl/redis-client.crt"
+ key: "/etc/ssl/redis-client.key"
+ insecureSkipVerify: false
```
```toml tab="Structured (TOML)"
# Here, an average of 100 requests per second is allowed.
# In addition, a burst of 200 requests is allowed.
+# Redis distributed rate limiting is configured with all available options.
[http.middlewares]
[http.middlewares.test-ratelimit.rateLimit]
average = 100
+ period = "1s"
burst = 200
+ [http.middlewares.test-ratelimit.rateLimit.redis]
+ endpoints = ["redis-primary.example.com:6379", "redis-replica.example.com:6379"]
+ username = "ratelimit-user"
+ password = "secure-password"
+ db = 2
+ poolSize = 50
+ minIdleConns = 10
+ maxActiveConns = 200
+ readTimeout = "3s"
+ writeTimeout = "3s"
+ dialTimeout = "5s"
+ [http.middlewares.test-ratelimit.rateLimit.redis.tls]
+ ca = "/etc/ssl/redis-ca.crt"
+ cert = "/etc/ssl/redis-client.crt"
+ key = "/etc/ssl/redis-client.key"
+ insecureSkipVerify = false
```
```yaml tab="Labels"
# Here, an average of 100 requests per second is allowed.
# In addition, a burst of 200 requests is allowed.
+# Redis distributed rate limiting is configured with all available options.
labels:
- "traefik.http.middlewares.test-ratelimit.ratelimit.average=100"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.period=1s"
- "traefik.http.middlewares.test-ratelimit.ratelimit.burst=200"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.redis.endpoints=redis-primary.example.com:6379,redis-replica.example.com:6379"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.redis.username=ratelimit-user"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.redis.password=secure-password"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.redis.db=2"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.redis.poolSize=50"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.redis.minIdleConns=10"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.redis.maxActiveConns=200"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.redis.readTimeout=3s"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.redis.writeTimeout=3s"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.redis.dialTimeout=5s"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.redis.tls.ca=/etc/ssl/redis-ca.crt"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.redis.tls.cert=/etc/ssl/redis-client.crt"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.redis.tls.key=/etc/ssl/redis-client.key"
+ - "traefik.http.middlewares.test-ratelimit.ratelimit.redis.tls.insecureSkipVerify=false"
```
```json tab="Tags"
// Here, an average of 100 requests per second is allowed.
// In addition, a burst of 200 requests is allowed.
+// Redis distributed rate limiting is configured with all available options.
{
"Tags": [
"traefik.http.middlewares.test-ratelimit.ratelimit.average=100",
- "traefik.http.middlewares.test-ratelimit.ratelimit.burst=50"
+ "traefik.http.middlewares.test-ratelimit.ratelimit.period=1s",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.burst=200",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.redis.endpoints=redis-primary.example.com:6379,redis-replica.example.com:6379",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.redis.username=ratelimit-user",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.redis.password=secure-password",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.redis.db=2",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.redis.poolSize=50",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.redis.minIdleConns=10",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.redis.maxActiveConns=200",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.redis.readTimeout=3s",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.redis.writeTimeout=3s",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.redis.dialTimeout=5s",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.redis.tls.ca=/etc/ssl/redis-ca.crt",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.redis.tls.cert=/etc/ssl/redis-client.crt",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.redis.tls.key=/etc/ssl/redis-client.key",
+ "traefik.http.middlewares.test-ratelimit.ratelimit.redis.tls.insecureSkipVerify=false"
]
}
```
@@ -57,6 +127,7 @@ labels:
```yaml tab="Kubernetes"
# Here, an average of 100 requests per second is allowed.
# In addition, a burst of 200 requests is allowed.
+# Redis distributed rate limiting is configured with all available options.
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
@@ -64,21 +135,82 @@ metadata:
spec:
rateLimit:
average: 100
+ period: 1s
burst: 200
+ redis:
+ endpoints:
+ - "redis-primary.example.com:6379"
+ - "redis-replica.example.com:6379"
+ secret: redis-credentials
+ db: 2
+ poolSize: 50
+ minIdleConns: 10
+ maxActiveConns: 200
+ readTimeout: 3s
+ writeTimeout: 3s
+ dialTimeout: 5s
+ tls:
+ caSecret: redis-ca
+ certSecret: redis-client-cert
+ insecureSkipVerify: false
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: redis-credentials
+ namespace: default
+data:
+ username: cmF0ZWxpbWl0LXVzZXI= # base64 encoded "ratelimit-user"
+ password: c2VjdXJlLXBhc3N3b3Jk # base64 encoded "secure-password"
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: redis-ca
+ namespace: default
+data:
+ tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t...
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: redis-client-cert
+ namespace: default
+data:
+ tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t...
+ tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0t...
```
## Configuration Options
| Field | Description | Default | Required |
|:-----------|:-------------------------------------------------------|:--------|:---------|
-| `average` | Number of requests used to define the rate using the `period`.
0 means **no rate limiting**.
More information [here](#rate-and-burst). | 0 | No |
-| `period` | Period of time used to define the rate.
More information [here](#rate-and-burst). | 1s | No |
-| `burst` | Maximum number of requests allowed to go through at the very same moment.
More information [here](#rate-and-burst).| 1 | No |
-| `sourceCriterion.requestHost` | Whether to consider the request host as the source.
More information about `sourceCriterion`[here](#sourcecriterion). | false | No |
-| `sourceCriterion.requestHeaderName` | Name of the header used to group incoming requests.
More information about `sourceCriterion`[here](#sourcecriterion). | "" | No |
-| `sourceCriterion.ipStrategy.depth` | Depth position of the IP to select in the `X-Forwarded-For` header (starting from the right).
0 means no depth.
If greater than the total number of IPs in `X-Forwarded-For`, then the client IP is empty
If higher than 0, the `excludedIPs` options is not evaluated.
More information about [`sourceCriterion`](#sourcecriterion), [`ipStrategy`](#ipstrategy), and [`depth`](#sourcecriterionipstrategydepth) below. | 0 | No |
-| `sourceCriterion.ipStrategy.excludedIPs` | Allows scanning the `X-Forwarded-For` header and select the first IP not in the list.
If `depth` is specified, `excludedIPs` is ignored.
More information about [`sourceCriterion`](#sourcecriterion), [`ipStrategy`](#ipstrategy), and [`excludedIPs`](#sourcecriterionipstrategyexcludedips) below. | | No |
-| `sourceCriterion.ipStrategy.ipv6Subnet` | If `ipv6Subnet` is provided and the selected IP is IPv6, the IP is transformed into the first IP of the subnet it belongs to.
More information about [`sourceCriterion`](#sourcecriterion), [`ipStrategy.ipv6Subnet`](#sourcecriterionipstrategyipv6subnet) below. | | No |
+| `average` | Number of requests used to define the rate using the `period`.
0 means **no rate limiting**.
More information [here](#rate-and-burst). | 0 | No |
+| `period` | Period of time used to define the rate.
More information [here](#rate-and-burst). | 1s | No |
+| `burst` | Maximum number of requests allowed to go through at the very same moment.
More information [here](#rate-and-burst).| 1 | No |
+| `sourceCriterion.requestHost` | Whether to consider the request host as the source.
More information about `sourceCriterion`[here](#sourcecriterion). | false | No |
+| | Name of the header used to group incoming requests.
More information about `sourceCriterion`[here](#sourcecriterion). | "" | No |
+| `sourceCriterion.ipStrategy.depth` | Depth position of the IP to select in the `X-Forwarded-For` header (starting from the right).
0 means no depth.
If greater than the total number of IPs in `X-Forwarded-For`, then the client IP is empty
If higher than 0, the `excludedIPs` options is not evaluated.
More information about [`sourceCriterion`](#sourcecriterion), [`ipStrategy`](#ipstrategy), and [`depth`](#sourcecriterionipstrategydepth) below. | 0 | No |
+| `sourceCriterion.ipStrategy.excludedIPs` | Allows scanning the `X-Forwarded-For` header and select the first IP not in the list.
If `depth` is specified, `excludedIPs` is ignored.
More information about [`sourceCriterion`](#sourcecriterion), [`ipStrategy`](#ipstrategy), and [`excludedIPs`](#sourcecriterionipstrategyexcludedips) below. | | No |
+| `sourceCriterion.ipStrategy.ipv6Subnet` | If `ipv6Subnet` is provided and the selected IP is IPv6, the IP is transformed into the first IP of the subnet it belongs to.
More information about [`sourceCriterion`](#sourcecriterion), [`ipStrategy.ipv6Subnet`](#sourcecriterionipstrategyipv6subnet) below. | | No |
+| `redis` | The `redis` configuration enables distributed rate limiting by using Redis to store rate limit tokens across multiple Traefik instances. This allows you to enforce consistent rate limits across a cluster of Traefik proxies.
When Redis is not configured, Traefik uses in-memory storage for rate limiting, which works only for the individual Traefik instance.| | No |
+| `redis.endpoints` | List of Redis server endpoints for distributed rate limiting. You can specify multiple endpoints for Redis cluster or high availability setups. | "127.0.0.1:6379" | No |
+| `redis.username` | Username for Redis authentication. | "" | No |
+| `redis.password` | Password for Redis authentication. In Kubernetes, these can be provided via secrets. | "" | No |
+| `redis.db` | Redis database number to select. | 0 | No |
+| `redis.poolSize` | Defines the base number of socket connections in the pool. If set to 0, it defaults to 10 connections per CPU core as reported by `runtime.GOMAXPROCS`.
If there are not enough connections in the pool, new connections will be allocated beyond `poolSize`, up to `maxActiveConns`. | 0 | No |
+| `redis.minIdleConns` | Minimum number of idle connections to maintain in the pool. This is useful when establishing new connections is slow. A value of 0 means idle connections are not automatically closed. | 0 | No |
+| `redis.maxActiveConns` | Maximum number of connections the pool can allocate at any given time. A value of 0 means no limit. | 0 | No |
+| `redis.readTimeout` | Timeout for socket reads. If reached, commands will fail with a timeout instead of blocking. Zero means no timeout. | 3s | No |
+| `redis.writeTimeout` | Timeout for socket writes. If reached, commands will fail with a timeout instead of blocking. Zero means no timeout. | 3s | No |
+| `redis.dialTimeout` | Timeout for establishing new connections. Zero means no timeout. | 5s | No |
+| `redis.tls.ca` | Path to the certificate authority used for the secure connection to Redis, it defaults to the system bundle. | "" | No |
+| `redis.tls.cert` | Path to the public certificate used for the secure connection to Redis. When this option is set, the `key` option is required. | "" | No |
+| `redis.tls.key` | Path to the private key used for the secure connection to Redis. When this option is set, the `cert` option is required. | "" | No |
+| `redis.tls.insecureSkipVerify` | If `insecureSkipVerify` is `true`, the TLS connection to Redis accepts any certificate presented by the server regardless of the hostnames it covers. | false | No |
### sourceCriterion
@@ -109,9 +241,9 @@ If `ipv6Subnet` is provided, the IP is transformed in the following way.
| `IP` | `ipv6Subnet` | clientIP |
|---------------------------|--------------|-----------------------|
-| `"::abcd:1111:2222:3333"` | `64` | `"::0:0:0:0"` |
-| `"::abcd:1111:2222:3333"` | `80` | `"::abcd:0:0:0:0"` |
-| `"::abcd:1111:2222:3333"` | `96` | `"::abcd:1111:0:0:0"` |
+| `"::abcd:1111:2222:3333"` | `64` | `"::0:0:0:0"` |
+| `"::abcd:1111:2222:3333"` | `80` | `"::abcd:0:0:0:0"` |
+| `"::abcd:1111:2222:3333"` | `96` | `"::abcd:1111:0:0:0"` |
### sourceCriterion.ipStrategy.depth
@@ -119,9 +251,9 @@ If `depth` is set to 2, and the request `X-Forwarded-For` header is `"10.0.0.1,1
| `X-Forwarded-For` | `depth` | clientIP |
|-----------------------------------------|---------|--------------|
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `1` | `"13.0.0.1"` |
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `3` | `"11.0.0.1"` |
-| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `5` | `""` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `1` | `"13.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `3` | `"11.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `5` | `""` |
### sourceCriterion.ipStrategy.excludedIPs
@@ -134,17 +266,17 @@ In this case, `excludedIPs` should be set to match the list of `X-Forwarded-For
Example to use each IP as a distinct source:
-| X-Forwarded-For | excludedIPs | clientIP |
+| `X-Forwarded-For` | excludedIPs | clientIP |
|--------------------------------|-----------------------|--------------|
-| `"10.0.0.1,11.0.0.1,12.0.0.1"` | `"11.0.0.1,12.0.0.1"` | `"10.0.0.1"` |
-| `"10.0.0.2,11.0.0.1,12.0.0.1"` | `"11.0.0.1,12.0.0.1"` | `"10.0.0.2"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1"` | `"11.0.0.1,12.0.0.1"` | `"10.0.0.1"` |
+| `"10.0.0.2,11.0.0.1,12.0.0.1"` | `"11.0.0.1,12.0.0.1"` | `"10.0.0.2"` |
2. Group together a set of IPs (also behind a common set of reverse-proxies) so that they are considered the same source, and all contribute to the same rate-limit bucket.
Example to group IPs together as same source:
-| X-Forwarded-For | excludedIPs | clientIP |
+| `X-Forwarded-For` | excludedIPs | clientIP |
|--------------------------------|--------------|--------------|
-| `"10.0.0.1,11.0.0.1,12.0.0.1"` | `"12.0.0.1"` | `"11.0.0.1"` |
-| `"10.0.0.2,11.0.0.1,12.0.0.1"` | `"12.0.0.1"` | `"11.0.0.1"` |
-| `"10.0.0.3,11.0.0.1,12.0.0.1"` | `"12.0.0.1"` | `"11.0.0.1"` |
+| `"10.0.0.1,11.0.0.1,12.0.0.1"` | `"12.0.0.1"` | `"11.0.0.1"` |
+| `"10.0.0.2,11.0.0.1,12.0.0.1"` | `"12.0.0.1"` | `"11.0.0.1"` |
+| `"10.0.0.3,11.0.0.1,12.0.0.1"` | `"12.0.0.1"` | `"11.0.0.1"` |
diff --git a/docs/content/reference/routing-configuration/http/middlewares/redirectregex.md b/docs/content/reference/routing-configuration/http/middlewares/redirectregex.md
index 0685e0153..942f2e833 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/redirectregex.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/redirectregex.md
@@ -63,9 +63,9 @@ spec:
| Field | Description | Default | Required |
|:-----------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
-| `regex` | The `regex` option is the regular expression to match and capture elements from the request URL.| "" | Yes |
-| `permanent` | Enable a permanent redirection. | false | No |
-| `replacement` | The `replacement` option defines how to modify the URL to have the new target URL..
`$1x` is equivalent to `${1x}`, not `${1}x` (see [Regexp.Expand](https://golang.org/pkg/regexp/#Regexp.Expand)), so use `${1}` syntax. | "" | No |
+| `regex` | The `regex` option is the regular expression to match and capture elements from the request URL.| "" | Yes |
+| `permanent` | Enable a permanent redirection. | false | No |
+| `replacement` | The `replacement` option defines how to modify the URL to have the new target URL..
`$1x` is equivalent to `${1x}`, not `${1}x` (see [Regexp.Expand](https://golang.org/pkg/regexp/#Regexp.Expand)), so use `${1}` syntax. | "" | No |
### `regex`
diff --git a/docs/content/reference/routing-configuration/http/middlewares/redirectscheme.md b/docs/content/reference/routing-configuration/http/middlewares/redirectscheme.md
index 73002551e..4589fd3df 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/redirectscheme.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/redirectscheme.md
@@ -10,7 +10,7 @@ The `RedirectScheme` middleware redirects the request if the request scheme is d
When there is at least one other reverse-proxy between the client and Traefik,
the other reverse-proxy (i.e. the last hop) needs to be a [trusted](../../../install-configuration/entrypoints.md#configuration-options) one.
- Otherwise, Traefik would clean up the X-Forwarded headers coming from this last hop,
+ Otherwise, Traefik would clean up the `X-Forwarded` headers coming from this last hop,
and as the RedirectScheme middleware relies on them to determine the scheme used,
it would not function as intended.
@@ -69,6 +69,6 @@ spec:
| Field | Description | Default | Required |
|:-----------------------------|----------------------------------------------------------|:--------|:---------|
-| `scheme` | Scheme of the new URL. | "" | Yes |
-| `permanent` | Enable a permanent redirection. | false | No |
-| `port` | Port of the new URL.
Set a string, **not** a numeric value. | "" | No |
+| `scheme` | Scheme of the new URL. | "" | Yes |
+| `permanent` | Enable a permanent redirection. | false | No |
+| `port` | Port of the new URL.
Set a string, **not** a numeric value. | "" | No |
diff --git a/docs/content/reference/routing-configuration/http/middlewares/replacepath.md b/docs/content/reference/routing-configuration/http/middlewares/replacepath.md
index f26a83daa..55fed2b9a 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/replacepath.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/replacepath.md
@@ -57,4 +57,4 @@ spec:
| Field | Description |
|:------|:------------|
-| `path` | The `path` option defines the path to use as replacement in the request URL. |
+| `path` | The `path` option defines the path to use as replacement in the request URL. |
diff --git a/docs/content/reference/routing-configuration/http/middlewares/replacepathregex.md b/docs/content/reference/routing-configuration/http/middlewares/replacepathregex.md
index 6ed264409..11506ae1c 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/replacepathregex.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/replacepathregex.md
@@ -57,8 +57,8 @@ labels:
| Field | Description | Default | Required |
|:-----------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
-| `regex` | Regular expression to match and capture the path from the request URL. | | Yes |
-| `replacement` | Replacement path format, which can include captured variables.
`$1x` is equivalent to `${1x}`, not `${1}x` (see [Regexp.Expand](https://golang.org/pkg/regexp/#Regexp.Expand)), so use `${1}` syntax. | | No
+| `regex` | Regular expression to match and capture the path from the request URL. | | Yes |
+| `replacement` | Replacement path format, which can include captured variables.
`$1x` is equivalent to `${1x}`, not `${1}x` (see [Regexp.Expand](https://golang.org/pkg/regexp/#Regexp.Expand)), so use `${1}` syntax. | | No
!!! tip
diff --git a/docs/content/reference/routing-configuration/http/middlewares/retry.md b/docs/content/reference/routing-configuration/http/middlewares/retry.md
index 4c8135244..e17a2965e 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/retry.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/retry.md
@@ -64,5 +64,5 @@ spec:
| Field | Description | Default | Required |
|:------|:------------|:--------|:---------|
-| `attempts` | number of times the request should be retried. | | Yes |
-| `initialInterval` | First wait time in the exponential backoff series.
The maximum interval is calculated as twice the `initialInterval`.
If unspecified, requests will be retried immediately.
Defined in seconds or as a valid duration format, see [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration). | 0 | No |
+| `attempts` | number of times the request should be retried. | | Yes |
+| `initialInterval` | First wait time in the exponential backoff series.
The maximum interval is calculated as twice the `initialInterval`.
If unspecified, requests will be retried immediately.
Defined in seconds or as a valid duration format, see [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration). | 0 | No |
diff --git a/docs/content/reference/routing-configuration/http/middlewares/stripprefix.md b/docs/content/reference/routing-configuration/http/middlewares/stripprefix.md
index f1209b8a2..b3e6ebfd8 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/stripprefix.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/stripprefix.md
@@ -61,6 +61,6 @@ spec:
| Field | Description | Default | Required |
|:-----------------------------|:--------------------------------------------------------------|:--------|:---------|
-| `prefixes` | List of prefixes to strip from the request URL.
If your backend is serving assets (for example, images or JavaScript files), it can use the `X-Forwarded-Prefix` header to construct relative URLs. | [] | No |
+| `prefixes` | List of prefixes to strip from the request URL.
If your backend is serving assets (for example, images or JavaScript files), it can use the `X-Forwarded-Prefix` header to construct relative URLs. | [] | No |
{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/http/middlewares/stripprefixregex.md b/docs/content/reference/routing-configuration/http/middlewares/stripprefixregex.md
index b9a3fef6d..01f07b2e1 100644
--- a/docs/content/reference/routing-configuration/http/middlewares/stripprefixregex.md
+++ b/docs/content/reference/routing-configuration/http/middlewares/stripprefixregex.md
@@ -56,7 +56,7 @@ spec:
| Field | Description | Default | Required |
|:-----------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
-| `regex` | List of regular expressions to match the path prefix from the request URL.
For instance, `/products` also matches `/products/shoes` and `/products/shirts`.
More information [here](#regex). | | No |
+| `regex` | List of regular expressions to match the path prefix from the request URL.
For instance, `/products` also matches `/products/shoes` and `/products/shirts`.
More information [here](#regex). | | No |
### regex
diff --git a/docs/content/reference/routing-configuration/http/middlewares/waf.md b/docs/content/reference/routing-configuration/http/middlewares/waf.md
new file mode 100644
index 000000000..e5e864db7
--- /dev/null
+++ b/docs/content/reference/routing-configuration/http/middlewares/waf.md
@@ -0,0 +1,64 @@
+---
+title: 'Coraza Web Application Firewall'
+description: 'Traefik Hub API Gateway - The HTTP Coraza in Traefik Hub API Gateway provides web application firewall capabilities'
+---
+
+!!! info "Traefik Hub Feature"
+ This middleware is available exclusively in [Traefik Hub](https://traefik.io/traefik-hub/). Learn more about [Traefik Hub's advanced features](https://doc.traefik.io/traefik-hub/api-gateway/intro).
+
+The [Coraza WAF](https://coraza.io/) middleware in Traefik Hub API Gateway provides web application firewall capabilities.
+
+The native middleware in Hub API Gateway provides at least 23 times more performance compared to the
+WASM-based [Coraza plugin](https://plugins.traefik.io/plugins/65f2aea146079255c9ffd1ec/coraza-waf) available with the open-source Traefik Proxy.
+
+To learn how to write rules, please visit [Coraza documentation](https://coraza.io/docs/tutorials/introduction/ "Link to Coraza introduction tutorial") and
+[OWASP CRS documentation](https://coreruleset.org/docs/ "Link to the OWAP CRS project documentation").
+
+!!! warning
+
+ Starting with Traefik Hub v3.11.0, Coraza needs to have read/write permissions to `/tmp`. This is related to [this upstream PR](https://github.com/corazawaf/coraza/pull/1030).
+
+---
+
+## Configuration Examples
+
+```yaml tab="Deny the /admin path"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: waf
+spec:
+ plugin:
+ coraza:
+ directives:
+ - SecRuleEngine On
+ - SecRule REQUEST_URI "@streq /admin" "id:101,phase:1,t:lowercase,log,deny"
+```
+
+```yaml tab="Allow only GET methods"
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+ name: wafcrs
+ namespace: apps
+spec:
+ plugin:
+ coraza:
+ crsEnabled: true
+ directives:
+ - SecDefaultAction "phase:1,log,auditlog,deny,status:403"
+ - SecDefaultAction "phase:2,log,auditlog,deny,status:403"
+ - SecAction "id:900110, phase:1, pass, t:none, nolog, setvar:tx.inbound_anomaly_score_threshold=5, setvar:tx.outbound_anomaly_score_threshold=4"
+ - SecAction "id:900200, phase:1, pass, t:none, nolog, setvar:'tx.allowed_methods=GET'"
+ - Include @owasp_crs/REQUEST-911-METHOD-ENFORCEMENT.conf
+ - Include @owasp_crs/REQUEST-949-BLOCKING-EVALUATION.conf
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|:---------|:-----------------------|:--------|:----------------------------|
+| `directives` | List of WAF rules to enforce. | | Yes |
+| `crsEnabled` | Enable [CRS rulesets](https://github.com/corazawaf/coraza-coreruleset/tree/main/rules/%40owasp_crs).
Once the ruleset is enabled, it can be used in the middleware. | false | False |
+
+{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/http/router/observability.md b/docs/content/reference/routing-configuration/http/router/observability.md
deleted file mode 100644
index ecadcaeed..000000000
--- a/docs/content/reference/routing-configuration/http/router/observability.md
+++ /dev/null
@@ -1,80 +0,0 @@
----
-title: "Per-Router Observability"
-description: "You can disable access logs, metrics, and tracing for a specific entrypoint attached to a HTTP Router. Read the technical documentation."
----
-
-Traefik's observability features include logs, access logs, metrics, and tracing. You can configure these options globally or at more specific levels, such as per router or per entry point.
-
-By default, the router observability configuration is inherited from the attached EntryPoints and can be configured with the observability [options](../../../install-configuration/entrypoints.md#configuration-options)).
-However, a router defining its own observability configuration will opt-out from these defaults.
-
-!!! info
- To enable router-level observability, you must first enable access-logs, tracing, and metrics.
-
- When metrics layers are not enabled with the `addEntryPointsLabels`, `addRoutersLabels` and/or `addServicesLabels` options,
- enabling metrics for a router will not enable them.
-
-!!! warning "AddInternals option"
-
- By default, and for any type of signal (access-logs, metrics and tracing),
- Traefik disables observability for internal resources.
- The observability options described below cannot interfere with the `AddInternals` ones,
- and will be ignored.
-
- For instance, if a router exposes the `api@internal` service and `metrics.AddInternals` is false,
- it will never produces metrics, even if the router observability configuration enables metrics.
-
-## Configuration Example
-
-```yaml tab="Structured (YAML)"
-http:
- routers:
- my-router:
- rule: "Path(`/foo`)"
- service: service-foo
- observability:
- metrics: false
- accessLogs: false
- tracing: false
-```
-
-```yaml tab="Structured (TOML)"
-[http.routers.my-router]
- rule = "Path(`/foo`)"
- service = "service-foo"
-
- [http.routers.my-router.observability]
- metrics = false
- accessLogs = false
- tracing = false
-```
-
-```yaml tab="Labels"
-labels:
- - "traefik.http.routers.my-router.rule=Path(`/foo`)"
- - "traefik.http.routers.my-router.service=service-foo"
- - "traefik.http.routers.my-router.observability.metrics=false"
- - "traefik.http.routers.my-router.observability.accessLogs=false"
- - "traefik.http.routers.my-router.observability.tracing=false"
-```
-
-```json tab="Tags"
-{
- // ...
- "Tags": [
- "traefik.http.routers.my-router.rule=Path(`/foo`)",
- "traefik.http.routers.my-router.service=service-foo",
- "traefik.http.routers.my-router.observability.metrics=false",
- "traefik.http.routers.my-router.observability.accessLogs=false",
- "traefik.http.routers.my-router.observability.tracing=false"
- ]
-}
-```
-
-## Configuration Options
-
-| Field | Description | Default | Required |
-|:------|:------------|:--------|:---------|
-| `accessLogs` | The `accessLogs` option controls whether the router will produce access-logs. | `true` | No |
-| `metrics` | The `metrics` option controls whether the router will produce metrics. | `true` | No |
-| `tracing` | The `tracing` option controls whether the router will produce traces. | `true` | No |
diff --git a/docs/content/reference/routing-configuration/http/router/rules-and-priority.md b/docs/content/reference/routing-configuration/http/router/rules-and-priority.md
deleted file mode 100644
index ad095da07..000000000
--- a/docs/content/reference/routing-configuration/http/router/rules-and-priority.md
+++ /dev/null
@@ -1,296 +0,0 @@
----
-title: "Traefik HTTP Routers Rules & Priority Documentation"
-description: "In Traefik Proxy, an HTTP router is in charge of connecting incoming requests to the Services that can handle them. Read the technical documentation."
----
-
-An HTTP router is in charge of connecting incoming requests to the services that can handle them. Traefik allows you to define your matching rules and [prioritize](#priority-calculation) the routes.
-
-## Rules
-
-Rules are a set of matchers configured with values, that determine if a particular request matches a specific criteria.
-If the rule is verified, the router becomes active, calls middlewares, and then forwards the request to the service.
-
-- The character `@` is not authorized in the router name.
-- To set the value of a rule, use [backticks](https://en.wiktionary.org/wiki/backtick) ` or escaped double-quotes ``\"``.
-- Single quotes ' are not accepted since the values are [Go's String Literals](https://golang.org/ref/spec#String_literals).
-- Regular Expressions:
- - Matchers that accept a regexp as their value use a [Go](https://golang.org/pkg/regexp/) flavored syntax.
- - The usual `AND` (&&) and `OR` (||) logical operators can be used, with the expected precedence rules, as well as parentheses to express complex rules.
- - The `NOT` (!) operator allows you to invert the matcher.
-
-The table below lists all the available matchers:
-
-| Matcher | Description |
-|-----------------------------------------------------------------|:-------------------------------------------------------------------------------|
-| [```Header(`key`, `value`)```](#header-and-headerregexp) | Matches requests containing a header named `key` set to `value`. |
-| [```HeaderRegexp(`key`, `regexp`)```](#header-and-headerregexp) | Matches requests containing a header named `key` matching `regexp`. |
-| [```Host(`domain`)```](#host-and-hostregexp) | Matches requests host set to `domain`. |
-| [```HostRegexp(`regexp`)```](#host-and-hostregexp) | Matches requests host matching `regexp`. |
-| [```Method(`method`)```](#method) | Matches requests method set to `method`. |
-| [```Path(`path`)```](#path-pathprefix-and-pathregexp) | Matches requests path set to `path`. |
-| [```PathPrefix(`prefix`)```](#path-pathprefix-and-pathregexp) | Matches requests path prefix set to `prefix`. |
-| [```PathRegexp(`regexp`)```](#path-pathprefix-and-pathregexp) | Matches request path using `regexp`. |
-| [```Query(`key`, `value`)```](#query-and-queryregexp) | Matches requests query parameters named `key` set to `value`. |
-| [```QueryRegexp(`key`, `regexp`)```](#query-and-queryregexp) | Matches requests query parameters named `key` matching `regexp`. |
-| [```ClientIP(`ip`)```](#clientip) | Matches requests client IP using `ip`. It accepts IPv4, IPv6 and CIDR formats. |
-
-### Header and HeaderRegexp
-
-The `Header` and `HeaderRegexp` matchers allow matching requests that contain specific header.
-
-| Behavior | Rule |
-|-----------------------------------------------------------------|:------------------------------------------------------------------------|
-| Match requests with a `Content-Type` header set to `application/yaml`.| ```Header(`Content-Type`, `application/yaml`)``` |
-| Match requests with a `Content-Type` header set to either `application/json` or `application/yaml`. | ```HeaderRegexp(`Content-Type`, `^application/(json\|yaml)$`)``` |
-| Match headers [case-insensitively](https://en.wikipedia.org/wiki/Case_sensitivity). | ```HeaderRegexp(`Content-Type`, `(?i)^application/(json\|yaml)$`)``` |
-
-### Host and HostRegexp
-
-The `Host` and `HostRegexp` matchers allow matching requests that are targeted to a given host.
-
-These matchers do not support non-ASCII characters, use punycode encoded values ([rfc 3492](https://tools.ietf.org/html/rfc3492)) to match such domains.
-
-If no `Host` is set in the request URL (for example, it's an IP address), these matchers will look at the `Host` header.
-
-These matchers will match the request's host in lowercase.
-
-| Behavior | Rule |
-|-----------------------------------------------------------------|:------------------------------------------------------------------------|
-| Match requests with `Host` set to `example.com`. | ```Host(`example.com`)``` |
-| Match requests sent to any subdomain of `example.com`. | ```HostRegexp(`^.+\.example\.com$`)``` |
-| Match requests with `Host` set to either `example.com` or `example.org`. | ```HostRegexp(`^example\.(com\|org)$`)``` |
-| Match `Host` [case-insensitively](https://en.wikipedia.org/wiki/Case_sensitivity). | ```HostRegexp(`(?i)^example\.(com\|org)$`)``` |
-
-### Method
-
-The `Method` matchers allows matching requests sent based on their HTTP method (also known as request verb).
-
-| Behavior | Rule |
-|-----------------------------------------------------------------|:------------------------------------------------------------------------|
-| Match `OPTIONS` requests. | ```Method(`OPTIONS`)``` |
-
-### Path, PathPrefix, and PathRegexp
-
-These matchers allow matching requests based on their URL path.
-
-For exact matches, use `Path` and its prefixed alternative `PathPrefix`, for regexp matches, use `PathRegexp`.
-
-Path are always starting with a `/`, except for `PathRegexp`.
-
-| Behavior | Rule |
-|-----------------------------------------------------------------|:------------------------------------------------------------------------|
-| Match `/products` but neither `/products/shoes` nor `/products/`. | ```Path(`/products`)``` |
-| Match `/products` as well as everything under `/products`, such as `/products/shoes`, `/products/` but also `/products-for-sale`. | ```PathPrefix(`/products`)``` |
-| Match both `/products/shoes` and `/products/socks` with and ID like `/products/shoes/31`. | ```PathRegexp(`^/products/(shoes\|socks)/[0-9]+$`)``` |
-| Match requests with a path ending in either `.jpeg`, `.jpg` or `.png`. | ```PathRegexp(`\.(jpeg\|jpg\|png)$`)``` |
-| Match `/products` as well as everything under `/products`, such as `/products/shoes`, `/products/` but also `/products-for-sale`, [case-insensitively](https://en.wikipedia.org/wiki/Case_sensitivity). | ```HostRegexp(`(?i)^/products`)``` |
-
-### Query and QueryRegexp
-
-The `Query` and `QueryRegexp` matchers allow matching requests based on query parameters.
-
-| Behavior | Rule |
-|-----------------------------------------------------------------|:------------------------------------------------------------------------|
-| Match requests with a `mobile` query parameter set to `true`, such as in `/search?mobile=true`. | ```Query(`mobile`, `true`)``` |
-| Match requests with a query parameter `mobile` that has no value, such as in `/search?mobile`. | ```Query(`mobile`)``` |
-| Match requests with a `mobile` query parameter set to either `true` or `yes`. | ```QueryRegexp(`mobile`, `^(true\|yes)$`)``` |
-| Match requests with a `mobile` query parameter set to any value (including the empty value). | ```QueryRegexp(`mobile`, `^.*$`)``` |
-| Match query parameters [case-insensitively](https://en.wikipedia.org/wiki/Case_sensitivity). | ```QueryRegexp(`mobile`, `(?i)^(true\|yes)$`)``` |
-
-### ClientIP
-
-The `ClientIP` matcher allows matching requests sent from the given client IP.
-
-It only matches the request client IP and does not use the `X-Forwarded-For` header for matching.
-
-| Behavior | Rule |
-|-----------------------------------------------------------------|:------------------------------------------------------------------------|
-| Match requests coming from a given IP (IPv4). | ```ClientIP(`10.76.105.11`)``` |
-| Match requests coming from a given IP (IPv6). | ```ClientIP(`::1`)``` |
-| Match requests coming from a given subnet (IPv4). | ```ClientIP(`192.168.1.0/24`)``` |
-| Match requests coming from a given subnet (IPv6). | ```ClientIP(`fe80::/10`)``` |
-
-### RuleSyntax
-
-!!! warning
-
- RuleSyntax option is deprecated and will be removed in the next major version.
- Please do not use this field and rewrite the router rules to use the v3 syntax.
-
-In Traefik v3 a new rule syntax has been introduced ([migration guide](../../../../migration/v3.md)). the `ruleSyntax` option allows to configure the rule syntax to be used for parsing the rule on a per-router basis. This allows to have heterogeneous router configurations and ease migration.
-
-The default value of the `ruleSyntax` option is inherited from the `defaultRuleSyntax` option in the install configuration (formerly known as static configuration). By default, the `defaultRuleSyntax` static option is v3, meaning that the default rule syntax is also v3
-
-#### Configuration Example
-
-The configuration below uses the [File Provider (Structured)](../../../install-configuration/providers/others/file.md) to configure the `ruleSyntax` to allow `Router-v2` to use v2 syntax, while for `Router-v3` it is configured to use v3 syntax.
-
-```yaml tab="Structured (YAML)"
-## Dynamic configuration
-http:
- routers:
- Router-v3:
- rule: HostRegexp(`[a-z]+\\.traefik\\.com`)
- ruleSyntax: v3
- Router-v2:
- rule: HostRegexp(`{subdomain:[a-z]+}.traefik.com`)
- ruleSyntax: v2
-```
-
-```toml tab="Structured (TOML)"
-## Dynamic configuration
-[http.routers]
- [http.routers.Router-v3]
- rule = "HostRegexp(`[a-z]+\\.traefik\\.com`)"
- ruleSyntax = v3
- [http.routers.Router-v2]
- rule = "HostRegexp(`{subdomain:[a-z]+}.traefik.com`)"
- ruleSyntax = v2
-```
-
-```yaml tab="Labels"
-labels:
- - "traefik.http.routers.Router-v3.rule=HostRegexp(`[a-z]+\\.traefik\\.com`)"
- - "traefik.http.routers.Router-v3.ruleSyntax=v3"
- - "traefik.http.routers.Router-v2.rule=HostRegexp(`{subdomain:[a-z]+}.traefik.com`)"
- - "traefik.http.routers.Router-v2.ruleSyntax=v2"
-```
-
-```json tab="Tags"
-{
- // ...
- "Tags": [
- "traefik.http.routers.Router-v3.rule=HostRegexp(`[a-z]+\\.traefik\\.com`)",
- "traefik.http.routers.Router-v3.ruleSyntax=v3"
- "traefik.http.routers.Router-v2.rule=HostRegexp(`{subdomain:[a-z]+}.traefik.com`)",
- "traefik.http.routers.Router-v2.ruleSyntax=v2"
- ]
-},
-```
-
-## Priority Calculation
-
-??? info "How default priorities are computed"
-
- ```yaml tab="Structured (YAML)"
- http:
- routers:
- Router-1:
- rule: "HostRegexp(`[a-z]+\.traefik\.com`)"
- # ...
- Router-2:
- rule: "Host(`foobar.traefik.com`)"
- # ...
- ```
-
- ```toml tab="Structured (TOML)"
- [http.routers]
- [http.routers.Router-1]
- rule = "HostRegexp(`[a-z]+\\.traefik\\.com`)"
- # ...
- [http.routers.Router-2]
- rule = "Host(`foobar.traefik.com`)"
- # ...
- ```
-
- ```yaml tab="Labels"
- labels:
- - "traefik.http.routers.Router-1.rule=HostRegexp(`[a-z]+\\.traefik\\.com`)"
- - "traefik.http.routers.Router-2.rule=Host(`foobar.traefik.com`)"
- ```
-
- ```json tab="Tags"
- {
- // ...
- "Tags": [
- "traefik.http.routers.Router-1.rule=HostRegexp(`[a-z]+\\.traefik\\.com`)",
- "traefik.http.routers.Router-2.rule=Host(`foobar.traefik.com`)"
- ]
- }
- ```
-
- In this case, all requests with host `foobar.traefik.com` will be routed through `Router-1` instead of `Router-2`.
-
- | Name | Rule | Priority |
- |----------|------------------------------------------|----------|
- | Router-1 | ```HostRegexp(`[a-z]+\.traefik\.com`)``` | 34 |
- | Router-2 | ```Host(`foobar.traefik.com`)``` | 26 |
-
- The previous table shows that `Router-1` has a higher priority than `Router-2`.
-
- To solve this issue, the priority must be set.
-
-To avoid path overlap, routes are sorted, by default, in descending order using rules length.
-The priority is directly equal to the length of the rule, and so the longest length has the highest priority.
-
-A value of `0` for the priority is ignored: `priority: 0` means that the default rules length sorting is used.
-
-Traefik reserves a range of priorities for its internal routers, the maximum user-defined router priority value is:
-
-- `(MaxInt32 - 1000)` for 32-bit platforms,
-- `(MaxInt64 - 1000)` for 64-bit platforms.
-
-### Example
-
-```yaml tab="Structured (YAML)"
-## Dynamic configuration
-http:
- routers:
- Router-1:
- rule: "HostRegexp(`[a-z]+\\.traefik\\.com`)"
- entryPoints:
- - "web"
- service: service-1
- priority: 1
- Router-2:
- rule: "Host(`foobar.traefik.com`)"
- entryPoints:
- - "web"
- priority: 2
- service: service-2
-```
-
-```toml tab="Structured (TOML)"
-## Dynamic configuration
-[http.routers]
- [http.routers.Router-1]
- rule = "HostRegexp(`[a-z]+\\.traefik\\.com`)"
- entryPoints = ["web"]
- service = "service-1"
- priority = 1
- [http.routers.Router-2]
- rule = "Host(`foobar.traefik.com`)"
- entryPoints = ["web"]
- priority = 2
- service = "service-2"
-```
-
-```yaml tab="Labels"
-labels:
- - "traefik.http.routers.Router-1.rule=HostRegexp(`[a-z]+\\.traefik\\.com`)"
- - "traefik.http.routers.Router-1.entryPoints=web"
- - "traefik.http.routers.Router-1.service=service-1"
- - "traefik.http.routers.Router-1.priority=1"
- - "traefik.http.routers.Router-2.rule=Host(`foobar.traefik.com`)"
- - "traefik.http.routers.Router-2.entryPoints=web"
- - "traefik.http.routers.Router-2.service=service-2"
- - "traefik.http.routers.Router-2.priority=2"
-```
-
-```json tab="Tags"
- {
- // ...
- "Tags": [
- "traefik.http.routers.Router-1.rule=HostRegexp(`[a-z]+\\.traefik\\.com`)",
- "traefik.http.routers.Router-1.entryPoints=web",
- "traefik.http.routers.Router-1.service=service-1",
- "traefik.http.routers.Router-1.priority=1"
- "traefik.http.routers.Router-2.rule=Host(`foobar.traefik.com`)",
- "traefik.http.routers.Router-2.entryPoints=web",
- "traefik.http.routers.Router-2.service=service-2",
- "traefik.http.routers.Router-2.priority=2"
- ]
- }
-```
-
-In the example above, the priority is configured to allow `Router-2` to handle requests with the `foobar.traefik.com` host.
diff --git a/docs/content/reference/routing-configuration/http/routing/observability.md b/docs/content/reference/routing-configuration/http/routing/observability.md
new file mode 100644
index 000000000..59110cd30
--- /dev/null
+++ b/docs/content/reference/routing-configuration/http/routing/observability.md
@@ -0,0 +1,97 @@
+---
+title: "Per-Router Observability"
+description: "You can disable access logs, metrics, and tracing for a specific entrypoint attached to a HTTP Router. Read the technical documentation."
+---
+
+Traefik's observability features include logs, access logs, metrics, and tracing. You can configure these options globally or at more specific levels, such as per router or per entry point.
+
+By default, the router observability configuration is inherited from the attached EntryPoints and can be configured with the observability [options](../../../install-configuration/entrypoints.md#configuration-options).
+However, a router defining its own observability configuration will opt-out from these defaults.
+
+!!! info
+ To enable router-level observability, you must first enable
+ [access-logs](../../../install-configuration/observability/logs-and-accesslogs.md#accesslogs),
+ [tracing](../../../install-configuration/observability/tracing.md),
+ and [metrics](../../../install-configuration/observability/metrics.md).
+
+ When metrics layers are not enabled with the `addEntryPointsLabels`, `addRoutersLabels` and/or `addServicesLabels` options,
+ enabling metrics for a router will not enable them.
+
+!!! warning "AddInternals option"
+
+ By default, and for any type of signal (access-logs, metrics and tracing),
+ Traefik disables observability for internal resources.
+ The observability options described below cannot interfere with the `AddInternals` ones,
+ and will be ignored.
+
+ For instance, if a router exposes the `api@internal` service and `metrics.AddInternals` is false,
+ it will never produces metrics, even if the router observability configuration enables metrics.
+
+## Configuration Example
+
+```yaml tab="Structured (YAML)"
+http:
+ routers:
+ my-router:
+ rule: "Path(`/foo`)"
+ service: service-foo
+ observability:
+ metrics: false
+ accessLogs: false
+ tracing: false
+ traceVerbosity: detailed
+```
+
+```yaml tab="Structured (TOML)"
+[http.routers.my-router]
+ rule = "Path(`/foo`)"
+ service = "service-foo"
+
+ [http.routers.my-router.observability]
+ metrics = false
+ accessLogs = false
+ tracing = false
+ traceVerbosity = "detailed"
+```
+
+```yaml tab="Labels"
+labels:
+ - "traefik.http.routers.my-router.rule=Path(`/foo`)"
+ - "traefik.http.routers.my-router.service=service-foo"
+ - "traefik.http.routers.my-router.observability.metrics=false"
+ - "traefik.http.routers.my-router.observability.accessLogs=false"
+ - "traefik.http.routers.my-router.observability.tracing=false"
+ - "traefik.http.routers.my-router.observability.traceVerbosity=detailed"
+```
+
+```json tab="Tags"
+{
+ // ...
+ "Tags": [
+ "traefik.http.routers.my-router.rule=Path(`/foo`)",
+ "traefik.http.routers.my-router.service=service-foo",
+ "traefik.http.routers.my-router.observability.metrics=false",
+ "traefik.http.routers.my-router.observability.accessLogs=false",
+ "traefik.http.routers.my-router.observability.tracing=false",
+ "traefik.http.routers.my-router.observability.traceVerbosity=detailed"
+ ]
+}
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|:-----------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------|:---------|
+| `accessLogs` | The `accessLogs` option controls whether the router will produce access-logs. | `true` | No |
+| `metrics` | The `metrics` option controls whether the router will produce metrics. | `true` | No |
+| `tracing` | The `tracing` option controls whether the router will produce traces. | `true` | No |
+| `traceVerbosity` | The `traceVerbosity` option controls the tracing verbosity level for the router. Possible values: `minimal` (default), `detailed`. If not set, the value is inherited from the entryPoint. | `minimal` | No |
+
+#### traceVerbosity
+
+`observability.traceVerbosity` defines the tracing verbosity level for the router.
+
+Possible values are:
+
+- `minimal`: produces a single server span and one client span for each request processed by a router.
+- `detailed`: enables the creation of additional spans for each middleware executed for each request processed by a router.
diff --git a/docs/content/reference/routing-configuration/http/routing/router.md b/docs/content/reference/routing-configuration/http/routing/router.md
new file mode 100644
index 000000000..2e9a7eb56
--- /dev/null
+++ b/docs/content/reference/routing-configuration/http/routing/router.md
@@ -0,0 +1,116 @@
+---
+title: "Traefik HTTP Routers Documentation"
+description: "HTTP routers are responsible for connecting incoming requests to the services that can handle them. Read the technical documentation."
+---
+
+## HTTP Router
+
+An HTTP router is in charge of connecting incoming requests to the services that can handle them. Routers analyze incoming requests based on rules, and when a match is found, forward the request through any configured middlewares to the appropriate service.
+
+## Configuration Example
+
+```yaml tab="Structured (YAML)"
+http:
+ routers:
+ my-router:
+ entryPoints:
+ - "web"
+ - "websecure"
+ rule: "Host(`example.com`) && Path(`/api`)"
+ priority: 10
+ middlewares:
+ - "auth"
+ - "ratelimit"
+ tls:
+ certResolver: "letsencrypt"
+ options: "modern"
+ domains:
+ - main: "example.com"
+ sans:
+ - "www.example.com"
+ observability:
+ metrics: true
+ accessLogs: true
+ tracing: true
+ service: my-service
+```
+
+```toml tab="Structured (TOML)"
+[http.routers]
+ [http.routers.my-router]
+ entryPoints = ["web", "websecure"]
+ rule = "Host(`example.com`) && Path(`/api`)"
+ priority = 10
+ middlewares = ["auth", "ratelimit"]
+ service = "my-service"
+
+ [http.routers.my-router.tls]
+ certResolver = "letsencrypt"
+ options = "modern"
+
+ [[http.routers.my-router.tls.domains]]
+ main = "example.com"
+ sans = ["www.example.com"]
+
+ [http.routers.my-router.observability]
+ metrics = true
+ accessLogs = true
+ tracing = true
+```
+
+```yaml tab="Labels"
+labels:
+ - "traefik.http.routers.my-router.entrypoints=web,websecure"
+ - "traefik.http.routers.my-router.rule=Host(`example.com`) && Path(`/api`)"
+ - "traefik.http.routers.my-router.priority=10"
+ - "traefik.http.routers.my-router.middlewares=auth,ratelimit"
+ - "traefik.http.routers.my-router.service=my-service"
+ - "traefik.http.routers.my-router.tls.certresolver=letsencrypt"
+ - "traefik.http.routers.my-router.tls.options=modern"
+ - "traefik.http.routers.my-router.tls.domains[0].main=example.com"
+ - "traefik.http.routers.my-router.tls.domains[0].sans=www.example.com"
+ - "traefik.http.routers.my-router.observability.metrics=true"
+ - "traefik.http.routers.my-router.observability.accessLogs=true"
+ - "traefik.http.routers.my-router.observability.tracing=true"
+```
+
+```json tab="Tags"
+{
+ "Tags": [
+ "traefik.http.routers.my-router.entrypoints=web,websecure",
+ "traefik.http.routers.my-router.rule=Host(`example.com`) && Path(`/api`)",
+ "traefik.http.routers.my-router.priority=10",
+ "traefik.http.routers.my-router.middlewares=auth,ratelimit",
+ "traefik.http.routers.my-router.service=my-service",
+ "traefik.http.routers.my-router.tls.certresolver=letsencrypt",
+ "traefik.http.routers.my-router.tls.options=modern",
+ "traefik.http.routers.my-router.tls.domains[0].main=example.com",
+ "traefik.http.routers.my-router.tls.domains[0].sans=www.example.com",
+ "traefik.http.routers.my-router.observability.metrics=true",
+ "traefik.http.routers.my-router.observability.accessLogs=true",
+ "traefik.http.routers.my-router.observability.tracing=true"
+ ]
+}
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|----------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------|----------|
+| `entryPoints` | The list of entry points to which the router is attached. If not specified, HTTP routers are attached to all entry points. | All entry points | No |
+| `rule` | Rules are a set of matchers configured with values, that determine if a particular request matches specific criteria. If the rule is verified, the router becomes active, calls middlewares, and then forwards the request to the service. See [Rules & Priority](./rules-and-priority.md) for details. | | Yes |
+| `priority` | To avoid path overlap, routes are sorted, by default, in descending order using rules length. The priority is directly equal to the length of the rule, and so the longest length has the highest priority. A value of `0` for the priority is ignored. See [Rules & Priority](./rules-and-priority.md) for details. | Rule length | No |
+| `middlewares` | The list of middlewares that are applied to the router. Middlewares are applied in the order they are declared. See [Middlewares overview](../middlewares/overview.md) for available middlewares. | | No |
+| `tls` | TLS configuration for the router. When specified, the router will only handle HTTPS requests. | | No |
+| `tls.certResolver` | The name of the certificate resolver to use for automatic certificate generation. See [Certificate Resolver](../tls/overview.md#certificate-resolver) for details. | | No |
+| `tls.options` | The name of the TLS options to use for configuring TLS parameters (cipher suites, min/max TLS version, client authentication, etc.). See [TLS Options](../tls/tls-options.md) for detailed configuration. | `default` | No |
+| `tls.domains` | List of domains and Subject Alternative Names (SANs) for explicit certificate domain specification. When using ACME certificate resolvers, domains are automatically extracted from router rules, making this option optional. | | No |
+| `observability` | Observability configuration for the router. Allows fine-grained control over access logs, metrics, and tracing per router. See [Observability](./observability.md) for details. | Inherited from entry points | No |
+| `service` | The name of the service that will handle the matched requests. Services can be load balancer services, weighted round robin, mirroring, or failover services. See [Service](../load-balancing/service.md) for details. | | Yes |
+
+## Router Naming
+
+- The character `@` is not authorized in the router name
+- In provider-specific configurations (Docker, Kubernetes), router names are often auto-generated based on service names and rules
+
+{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/http/routing/rules-and-priority.md b/docs/content/reference/routing-configuration/http/routing/rules-and-priority.md
new file mode 100644
index 000000000..7e15cb954
--- /dev/null
+++ b/docs/content/reference/routing-configuration/http/routing/rules-and-priority.md
@@ -0,0 +1,296 @@
+---
+title: "Traefik HTTP Routers Rules & Priority Documentation"
+description: "In Traefik Proxy, an HTTP router is in charge of connecting incoming requests to the Services that can handle them. Read the technical documentation."
+---
+
+An HTTP router is in charge of connecting incoming requests to the services that can handle them. Traefik allows you to define your matching rules and [prioritize](#priority-calculation) the routes.
+
+## Rules
+
+Rules are a set of matchers configured with values, that determine if a particular request matches a specific criteria.
+If the rule is verified, the router becomes active, calls middlewares, and then forwards the request to the service.
+
+- The character `@` is not authorized in the router name.
+- To set the value of a rule, use [backticks](https://en.wiktionary.org/wiki/backtick) ` or escaped double-quotes ``\"``.
+- Single quotes ' are not accepted since the values are [Go's String Literals](https://golang.org/ref/spec#String_literals).
+- Regular Expressions:
+ - Matchers that accept a regexp as their value use a [Go](https://golang.org/pkg/regexp/) flavored syntax.
+ - The usual `AND` (&&) and `OR` (||) logical operators can be used, with the expected precedence rules, as well as parentheses to express complex rules.
+ - The `NOT` (!) operator allows you to invert the matcher.
+
+The table below lists all the available matchers:
+
+| Matcher | Description |
+|-----------------------------------------------------------------|:-------------------------------------------------------------------------------|
+| | Matches requests containing a header named `key` set to `value`. |
+| | Matches requests containing a header named `key` matching `regexp`. |
+| [```Host(`domain`)```](#host-and-hostregexp) | Matches requests host set to `domain`. |
+| [```HostRegexp(`regexp`)```](#host-and-hostregexp) | Matches requests host matching `regexp`. |
+| [```Method(`method`)```](#method) | Matches requests method set to `method`. |
+| [```Path(`path`)```](#path-pathprefix-and-pathregexp) | Matches requests path set to `path`. |
+| [```PathPrefix(`prefix`)```](#path-pathprefix-and-pathregexp) | Matches requests path prefix set to `prefix`. |
+| [```PathRegexp(`regexp`)```](#path-pathprefix-and-pathregexp) | Matches request path using `regexp`. |
+| [```Query(`key`, `value`)```](#query-and-queryregexp) | Matches requests query parameters named `key` set to `value`. |
+| [```QueryRegexp(`key`, `regexp`)```](#query-and-queryregexp) | Matches requests query parameters named `key` matching `regexp`. |
+| [```ClientIP(`ip`)```](#clientip) | Matches requests client IP using `ip`. It accepts IPv4, IPv6 and CIDR formats. |
+
+### Header and HeaderRegexp
+
+The `Header` and `HeaderRegexp` matchers allow matching requests that contain specific header.
+
+| Behavior | Rule |
+|-----------------------------------------------------------------|:------------------------------------------------------------------------|
+| | ```Header(`Content-Type`, `application/yaml`)``` |
+| | ```HeaderRegexp(`Content-Type`, `^application/(json\|yaml)$`)``` |
+| | ```HeaderRegexp(`Content-Type`, `(?i)^application/(json\|yaml)$`)``` |
+
+### Host and HostRegexp
+
+The `Host` and `HostRegexp` matchers allow matching requests that are targeted to a given host.
+
+These matchers do not support non-ASCII characters, use punycode encoded values ([rfc 3492](https://tools.ietf.org/html/rfc3492)) to match such domains.
+
+If no `Host` is set in the request URL (for example, it's an IP address), these matchers will look at the `Host` header.
+
+These matchers will match the request's host in lowercase.
+
+| Behavior | Rule |
+|-----------------------------------------------------------------|:------------------------------------------------------------------------|
+| Match requests with `Host` set to `example.com`. | ```Host(`example.com`)``` |
+| Match requests sent to any subdomain of `example.com`. | ```HostRegexp(`^.+\.example\.com$`)``` |
+| Match requests with `Host` set to either `example.com` or `example.org`. | ```HostRegexp(`^example\.(com\|org)$`)``` |
+| Match `Host` [case-insensitively](https://en.wikipedia.org/wiki/Case_sensitivity). | ```HostRegexp(`(?i)^example\.(com\|org)$`)``` |
+
+### Method
+
+The `Method` matchers allows matching requests sent based on their HTTP method (also known as request verb).
+
+| Behavior | Rule |
+|-----------------------------------------------------------------|:------------------------------------------------------------------------|
+| Match `OPTIONS` requests. | ```Method(`OPTIONS`)``` |
+
+### Path, PathPrefix, and PathRegexp
+
+These matchers allow matching requests based on their URL path.
+
+For exact matches, use `Path` and its prefixed alternative `PathPrefix`, for regexp matches, use `PathRegexp`.
+
+Path are always starting with a `/`, except for `PathRegexp`.
+
+| Behavior | Rule |
+|-----------------------------------------------------------------|:------------------------------------------------------------------------|
+| Match `/products` but neither `/products/shoes` nor `/products/`. | ```Path(`/products`)``` |
+| Match `/products` as well as everything under `/products`, such as `/products/shoes`, `/products/` but also `/products-for-sale`. | ```PathPrefix(`/products`)``` |
+| Match both `/products/shoes` and `/products/socks` with and ID like `/products/shoes/31`. | ```PathRegexp(`^/products/(shoes\|socks)/[0-9]+$`)``` |
+| Match requests with a path ending in either `.jpeg`, `.jpg` or `.png`. | ```PathRegexp(`\.(jpeg\|jpg\|png)$`)``` |
+| Match `/products` as well as everything under `/products`, such as `/products/shoes`, `/products/` but also `/products-for-sale`, [case-insensitively](https://en.wikipedia.org/wiki/Case_sensitivity). | ```PathRegexp(`(?i)^/products`)``` |
+
+### Query and QueryRegexp
+
+The `Query` and `QueryRegexp` matchers allow matching requests based on query parameters.
+
+| Behavior | Rule |
+|-----------------------------------------------------------------|:------------------------------------------------------------------------|
+| Match requests with a `mobile` query parameter set to `true`, such as in `/search?mobile=true`. | ```Query(`mobile`, `true`)``` |
+| Match requests with a query parameter `mobile` that has no value, such as in `/search?mobile`. | ```Query(`mobile`)``` |
+| Match requests with a `mobile` query parameter set to either `true` or `yes`. | ```QueryRegexp(`mobile`, `^(true\|yes)$`)``` |
+| Match requests with a `mobile` query parameter set to any value (including the empty value). | ```QueryRegexp(`mobile`, `^.*$`)``` |
+| Match query parameters [case-insensitively](https://en.wikipedia.org/wiki/Case_sensitivity). | ```QueryRegexp(`mobile`, `(?i)^(true\|yes)$`)``` |
+
+### ClientIP
+
+The `ClientIP` matcher allows matching requests sent from the given client IP.
+
+It only matches the request client IP and does not use the `X-Forwarded-For` header for matching.
+
+| Behavior | Rule |
+|-----------------------------------------------------------------|:------------------------------------------------------------------------|
+| Match requests coming from a given IP (IPv4). | ```ClientIP(`10.76.105.11`)``` |
+| Match requests coming from a given IP (IPv6). | ```ClientIP(`::1`)``` |
+| Match requests coming from a given subnet (IPv4). | ```ClientIP(`192.168.1.0/24`)``` |
+| Match requests coming from a given subnet (IPv6). | ```ClientIP(`fe80::/10`)``` |
+
+### RuleSyntax
+
+!!! warning
+
+ RuleSyntax option is deprecated and will be removed in the next major version.
+ Please do not use this field and rewrite the router rules to use the v3 syntax.
+
+In Traefik v3 a new rule syntax has been introduced ([migration guide](../../../../migrate/v3.md)). the `ruleSyntax` option allows to configure the rule syntax to be used for parsing the rule on a per-router basis. This allows to have heterogeneous router configurations and ease migration.
+
+The default value of the `ruleSyntax` option is inherited from the `defaultRuleSyntax` option in the install configuration (formerly known as static configuration). By default, the `defaultRuleSyntax` static option is v3, meaning that the default rule syntax is also v3
+
+#### Configuration Example
+
+The configuration below uses the [File Provider (Structured)](../../../install-configuration/providers/others/file.md) to configure the `ruleSyntax` to allow `Router-v2` to use v2 syntax, while for `Router-v3` it is configured to use v3 syntax.
+
+```yaml tab="Structured (YAML)"
+## Dynamic configuration
+http:
+ routers:
+ Router-v3:
+ rule: HostRegexp(`[a-z]+\\.traefik\\.com`)
+ ruleSyntax: v3
+ Router-v2:
+ rule: HostRegexp(`{subdomain:[a-z]+}.traefik.com`)
+ ruleSyntax: v2
+```
+
+```toml tab="Structured (TOML)"
+## Dynamic configuration
+[http.routers]
+ [http.routers.Router-v3]
+ rule = "HostRegexp(`[a-z]+\\.traefik\\.com`)"
+ ruleSyntax = v3
+ [http.routers.Router-v2]
+ rule = "HostRegexp(`{subdomain:[a-z]+}.traefik.com`)"
+ ruleSyntax = v2
+```
+
+```yaml tab="Labels"
+labels:
+ - "traefik.http.routers.Router-v3.rule=HostRegexp(`[a-z]+\\.traefik\\.com`)"
+ - "traefik.http.routers.Router-v3.ruleSyntax=v3"
+ - "traefik.http.routers.Router-v2.rule=HostRegexp(`{subdomain:[a-z]+}.traefik.com`)"
+ - "traefik.http.routers.Router-v2.ruleSyntax=v2"
+```
+
+```json tab="Tags"
+{
+ // ...
+ "Tags": [
+ "traefik.http.routers.Router-v3.rule=HostRegexp(`[a-z]+\\.traefik\\.com`)",
+ "traefik.http.routers.Router-v3.ruleSyntax=v3"
+ "traefik.http.routers.Router-v2.rule=HostRegexp(`{subdomain:[a-z]+}.traefik.com`)",
+ "traefik.http.routers.Router-v2.ruleSyntax=v2"
+ ]
+},
+```
+
+## Priority Calculation
+
+??? info "How default priorities are computed"
+
+ ```yaml tab="Structured (YAML)"
+ http:
+ routers:
+ Router-1:
+ rule: "HostRegexp(`[a-z]+\.traefik\.com`)"
+ # ...
+ Router-2:
+ rule: "Host(`foobar.traefik.com`)"
+ # ...
+ ```
+
+ ```toml tab="Structured (TOML)"
+ [http.routers]
+ [http.routers.Router-1]
+ rule = "HostRegexp(`[a-z]+\\.traefik\\.com`)"
+ # ...
+ [http.routers.Router-2]
+ rule = "Host(`foobar.traefik.com`)"
+ # ...
+ ```
+
+ ```yaml tab="Labels"
+ labels:
+ - "traefik.http.routers.Router-1.rule=HostRegexp(`[a-z]+\\.traefik\\.com`)"
+ - "traefik.http.routers.Router-2.rule=Host(`foobar.traefik.com`)"
+ ```
+
+ ```json tab="Tags"
+ {
+ // ...
+ "Tags": [
+ "traefik.http.routers.Router-1.rule=HostRegexp(`[a-z]+\\.traefik\\.com`)",
+ "traefik.http.routers.Router-2.rule=Host(`foobar.traefik.com`)"
+ ]
+ }
+ ```
+
+ In this case, all requests with host `foobar.traefik.com` will be routed through `Router-1` instead of `Router-2`.
+
+ | Name | Rule | Priority |
+ |----------|------------------------------------------|----------|
+ | Router-1 | ```HostRegexp(`[a-z]+\.traefik\.com`)``` | 34 |
+ | Router-2 | ```Host(`foobar.traefik.com`)``` | 26 |
+
+ The previous table shows that `Router-1` has a higher priority than `Router-2`.
+
+ To solve this issue, the priority must be set.
+
+To avoid path overlap, routes are sorted, by default, in descending order using rules length.
+The priority is directly equal to the length of the rule, and so the longest length has the highest priority.
+
+A value of `0` for the priority is ignored: `priority: 0` means that the default rules length sorting is used.
+
+Traefik reserves a range of priorities for its internal routers, the maximum user-defined router priority value is:
+
+- `(MaxInt32 - 1000)` for 32-bit platforms,
+- `(MaxInt64 - 1000)` for 64-bit platforms.
+
+### Example
+
+```yaml tab="Structured (YAML)"
+## Dynamic configuration
+http:
+ routers:
+ Router-1:
+ rule: "HostRegexp(`[a-z]+\\.traefik\\.com`)"
+ entryPoints:
+ - "web"
+ service: service-1
+ priority: 1
+ Router-2:
+ rule: "Host(`foobar.traefik.com`)"
+ entryPoints:
+ - "web"
+ priority: 2
+ service: service-2
+```
+
+```toml tab="Structured (TOML)"
+## Dynamic configuration
+[http.routers]
+ [http.routers.Router-1]
+ rule = "HostRegexp(`[a-z]+\\.traefik\\.com`)"
+ entryPoints = ["web"]
+ service = "service-1"
+ priority = 1
+ [http.routers.Router-2]
+ rule = "Host(`foobar.traefik.com`)"
+ entryPoints = ["web"]
+ priority = 2
+ service = "service-2"
+```
+
+```yaml tab="Labels"
+labels:
+ - "traefik.http.routers.Router-1.rule=HostRegexp(`[a-z]+\\.traefik\\.com`)"
+ - "traefik.http.routers.Router-1.entryPoints=web"
+ - "traefik.http.routers.Router-1.service=service-1"
+ - "traefik.http.routers.Router-1.priority=1"
+ - "traefik.http.routers.Router-2.rule=Host(`foobar.traefik.com`)"
+ - "traefik.http.routers.Router-2.entryPoints=web"
+ - "traefik.http.routers.Router-2.service=service-2"
+ - "traefik.http.routers.Router-2.priority=2"
+```
+
+```json tab="Tags"
+ {
+ // ...
+ "Tags": [
+ "traefik.http.routers.Router-1.rule=HostRegexp(`[a-z]+\\.traefik\\.com`)",
+ "traefik.http.routers.Router-1.entryPoints=web",
+ "traefik.http.routers.Router-1.service=service-1",
+ "traefik.http.routers.Router-1.priority=1"
+ "traefik.http.routers.Router-2.rule=Host(`foobar.traefik.com`)",
+ "traefik.http.routers.Router-2.entryPoints=web",
+ "traefik.http.routers.Router-2.service=service-2",
+ "traefik.http.routers.Router-2.priority=2"
+ ]
+ }
+```
+
+In the example above, the priority is configured to allow `Router-2` to handle requests with the `foobar.traefik.com` host.
diff --git a/docs/content/reference/routing-configuration/http/tls/overview.md b/docs/content/reference/routing-configuration/http/tls/overview.md
index 3c9a3b712..c1e1a6892 100644
--- a/docs/content/reference/routing-configuration/http/tls/overview.md
+++ b/docs/content/reference/routing-configuration/http/tls/overview.md
@@ -1,10 +1,103 @@
---
-title: "Traefik TLS Documentation"
-description: "Learn how to configure the transport layer security (TLS) connection in Traefik Proxy. Read the technical documentation."
+title: "Traefik HTTP TLS Documentation"
+description: "Learn how to configure the transport layer security (TLS) connection for HTTP services in Traefik Proxy. Read the technical documentation."
---
-Traefik's TLS configuration defines how TLS negotiation is handled for incoming connections.
+## General
-The next section of this documentation explains how to configure TLS connections through a definition in the dynamic configuration and how to configure TLS options, and certificates stores.
+When an HTTP router is configured to handle HTTPS traffic, include a `tls` field in its definition.
+This field tells Traefik that the router should process only TLS requests and ignore non-TLS traffic.
+
+By default, an HTTP router with a TLS field will terminate the TLS connections,
+meaning that it will send decrypted data to the services.
+The TLS configuration provides several options for fine-tuning the TLS behavior,
+including automatic certificate generation, custom TLS options, and explicit domain specification.
+
+## Configuration Example
+
+```yaml tab="Structured (YAML)"
+http:
+ routers:
+ my-https-router:
+ rule: "Host(`example.com`) && Path(`/api`)"
+ service: "my-http-service"
+ tls:
+ certResolver: "letsencrypt"
+ options: "modern-tls"
+ domains:
+ - main: "example.com"
+ sans:
+ - "www.example.com"
+ - "api.example.com"
+```
+
+```toml tab="Structured (TOML)"
+[http.routers.my-https-router]
+ rule = "Host(`example.com`) && Path(`/api`)"
+ service = "my-http-service"
+
+ [http.routers.my-https-router.tls]
+ certResolver = "letsencrypt"
+ options = "modern-tls"
+
+ [[http.routers.my-https-router.tls.domains]]
+ main = "example.com"
+ sans = ["www.example.com", "api.example.com"]
+```
+
+```yaml tab="Labels"
+labels:
+ - "traefik.http.routers.my-https-router.rule=Host(`example.com`) && Path(`/api`)"
+ - "traefik.http.routers.my-https-router.service=my-http-service"
+ - "traefik.http.routers.my-https-router.tls=true"
+ - "traefik.http.routers.my-https-router.tls.certresolver=letsencrypt"
+ - "traefik.http.routers.my-https-router.tls.options=modern-tls"
+ - "traefik.http.routers.my-https-router.tls.domains[0].main=example.com"
+ - "traefik.http.routers.my-https-router.tls.domains[0].sans=www.example.com,api.example.com"
+```
+
+```json tab="Tags"
+{
+ "Tags": [
+ "traefik.http.routers.my-https-router.rule=Host(`example.com`) && Path(`/api`)",
+ "traefik.http.routers.my-https-router.service=my-http-service",
+ "traefik.http.routers.my-https-router.tls=true",
+ "traefik.http.routers.my-https-router.tls.certresolver=letsencrypt",
+ "traefik.http.routers.my-https-router.tls.options=modern-tls",
+ "traefik.http.routers.my-https-router.tls.domains[0].main=example.com",
+ "traefik.http.routers.my-https-router.tls.domains[0].sans=www.example.com,api.example.com"
+ ]
+}
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|:-----------------------------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------|:---------|
+| `options` | The name of the TLS options to use for configuring TLS parameters (cipher suites, min/max TLS version, client authentication, etc.). See [TLS Options](./tls-options.md) for detailed configuration. | `default` | No |
+| `certResolver` | The name of the certificate resolver to use for automatic certificate generation via ACME providers (such as Let's Encrypt). See the [Certificate Resolver](./#certificate-resolver) section for more details. | "" | No |
+| `domains` | List of domains and Subject Alternative Names (SANs) for explicit certificate domain specification. See the [Custom Domains](./#custom-domains) section for more details. | [] | No |
+
+## Certificate Resolver
+
+The `tls.certResolver` option allows you to specify a certificate resolver for automatic certificate generation via ACME providers (such as Let's Encrypt).
+
+When a certificate resolver is configured for a router,
+Traefik will automatically obtain and manage TLS certificates for the domains specified in the router's rule (in the `Host` matcher) or in the `tls.domains` configuration (with `tls.domains` taking precedence).
+
+!!! important "Prerequisites"
+
+ - Certificate resolvers must be defined in the [static configuration](../../../install-configuration/tls/certificate-resolvers/acme.md)
+ - The router must have `tls` enabled
+ - An ACME challenge type must be configured for the certificate resolver
+
+## Custom Domains
+
+When using ACME certificate resolvers, domains are automatically extracted from router rules,
+but the `tls.domains` option allows you to explicitly specify the domains and Subject Alternative Names (SANs) for which certificates should be generated.
+
+This provides fine-grained control over certificate generation and takes precedence over domains automatically extracted from router rules.
+
+Every domain must have A/AAAA records pointing to Traefik.
{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/http/tls/tls-options.md b/docs/content/reference/routing-configuration/http/tls/tls-options.md
index 992b3497c..939edf91e 100644
--- a/docs/content/reference/routing-configuration/http/tls/tls-options.md
+++ b/docs/content/reference/routing-configuration/http/tls/tls-options.md
@@ -106,7 +106,7 @@ tls:
### Curve Preferences
-This option allows to set the preferred elliptic curves in a specific order.
+This option allows to set the preferred elliptic curves.
The names of the curves defined by [`crypto`](https://godoc.org/crypto/tls#CurveID) (e.g. `CurveP521`) and the [RFC defined names](https://tools.ietf.org/html/rfc8446#section-4.2.7) (e. g. `secp521r1`) can be used.
@@ -188,17 +188,17 @@ Traefik supports mutual authentication, through the `clientAuth` section.
For authentication policies that require verification of the client certificate, the certificate authority for the certificates should be set in `clientAuth.caFiles`.
-In Kubernetes environment, CA certificate can be set in `clientAuth.secretNames`. See [TLSOption resource](../../kubernetes/crd/http/tlsoption.md) for more details.
+In Kubernetes environment, CA certificate can be set in `clientAuth.secretNames`. See [TLSOption resource](../../kubernetes/crd/tls/tlsoption.md) for more details.
The `clientAuth.clientAuthType` option governs the behaviour as follows:
| Option | Operation |
| --------- | ----------- |
-| `NoClientCert` | Disregards any client certificate.|
-| `RequestClientCert` | Asks for a certificate but proceeds anyway if none is provided. |
-| `RequireAnyClientCert` | Requires a certificate but does not verify if it is signed by a CA listed in `clientAuth.caFiles` or in `clientAuth.secretNames`. |
-| `VerifyClientCertIfGiven` | If a certificate is provided, verifies if it is signed by a CA listed in `clientAuth.caFiles` or in `clientAuth.secretNames`. Otherwise proceeds without any certificate. |
-| `RequireAndVerifyClientCert` | requires a certificate, which must be signed by a CA listed in `clientAuth.caFiles` or in `clientAuth.secretNames`. |
+| `NoClientCert` | Disregards any client certificate.|
+| `RequestClientCert` | Asks for a certificate but proceeds anyway if none is provided. |
+| `RequireAnyClientCert` | Requires a certificate but does not verify if it is signed by a CA listed in `clientAuth.caFiles` or in `clientAuth.secretNames`. |
+| `VerifyClientCertIfGiven` | If a certificate is provided, verifies if it is signed by a CA listed in `clientAuth.caFiles` or in `clientAuth.secretNames`. Otherwise proceeds without any certificate. |
+| `RequireAndVerifyClientCert` | requires a certificate, which must be signed by a CA listed in `clientAuth.caFiles` or in `clientAuth.secretNames`. |
```yaml tab="Structured (YAML)"
# Dynamic configuration
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/http/ingressroute.md b/docs/content/reference/routing-configuration/kubernetes/crd/http/ingressroute.md
index 28651bb89..4328ebfd1 100644
--- a/docs/content/reference/routing-configuration/kubernetes/crd/http/ingressroute.md
+++ b/docs/content/reference/routing-configuration/kubernetes/crd/http/ingressroute.md
@@ -3,7 +3,7 @@ title: "Kubernetes IngressRoute"
description: "An IngressRoute is a Traefik CRD is in charge of connecting incoming requests to the Services that can handle them in HTTP."
---
-`IngressRoute` is the CRD implementation of a [Traefik HTTP router](../../../http/router/rules-and-priority.md).
+`IngressRoute` is the CRD implementation of a [Traefik HTTP router](../../../http/routing/rules-and-priority.md).
Before creating `IngressRoute` objects, you need to apply the [Traefik Kubernetes CRDs](https://doc.traefik.io/traefik/reference/dynamic-configuration/kubernetes-crd/#definitions) to your Kubernetes cluster.
@@ -36,7 +36,7 @@ spec:
accessLogs: true
metrics: true
tracing: true
- # Set a pirority
+ # Set a priority
priority: 10
services:
# Target a Kubernetes Support
@@ -74,164 +74,29 @@ spec:
## Configuration Options
-| Field | Description | Default | Required |
-|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `entryPoints` | List of [entry points](../../../../install-configuration/entrypoints.md) names.
If not specified, HTTP routers will accept requests from all EntryPoints in the list of default EntryPoints. | | No |
-| `routes` | List of routes. | | Yes |
-| `routes[n].kind` | Kind of router matching, only `Rule` is allowed yet. | "Rule" | No |
-| `routes[n].match` | Defines the [rule](../../../http/router/rules-and-priority.md#rules) corresponding to an underlying router. | | Yes |
-| `routes[n].priority` | Defines the [priority](../../../http/router/rules-and-priority.md#priority-calculation) to disambiguate rules of the same length, for route matching.
If not set, the priority is directly equal to the length of the rule, and so the longest length has the highest priority.
A value of `0` for the priority is ignored, the default rules length sorting is used. | 0 | No |
-| `routes[n].middlewares` | List of middlewares to attach to the IngressRoute.
More information [here](#middleware). | "" | No |
-| `routes[n].`
`middlewares[m].`
`name` | Middleware name.
The character `@` is not authorized.
More information [here](#middleware). | | Yes |
-| `routes[n].`
`middlewares[m].`
`namespace` | Middleware namespace.
Can be empty if the middleware belongs to the same namespace as the IngressRoute.
More information [here](#middleware). | | No |
-| `routes[n].`
`observability.`
`accesslogs` | Defines whether the route will produce [access-logs](../../../../install-configuration/observability/logs-and-accesslogs.md). See [here](../../../http/router/observability.md) for more information. | false | No |
-| `routes[n].`
`observability.`
`metrics` | Defines whether the route will produce [metrics](../../../../install-configuration/observability/metrics.md). See [here](../../../http/router/observability.md) for more information. | false | No |
-| `routes[n].`
`observability.`
`tracing` | Defines whether the route will produce [traces](../../../../install-configuration/observability/tracing.md). See [here](../../../http/router/observability.md) for more information. | false | No |
-| `routes[n].`
`services` | List of any combination of TraefikService and [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/).
More information [here](#externalname-service). | | No |
-| `routes[n].`
`services[m].`
`kind` | Kind of the service targeted.
Two values allowed:
- **Service**: Kubernetes Service
**TraefikService**: Traefik Service.
More information [here](#externalname-service). | "Service" | No |
-| `routes[n].`
`services[m].`
`name` | Service name.
The character `@` is not authorized.
More information [here](#middleware). | | Yes |
-| `routes[n].`
`services[m].`
`namespace` | Service namespace.
Can be empty if the service belongs to the same namespace as the IngressRoute.
More information [here](#externalname-service). | | No |
-| `routes[n].`
`services[m].`
`port` | Service port (number or port name).
Evaluated only if the kind is **Service**. | | No |
-| `routes[n].`
`services[m].`
`responseForwarding.`
`flushInterval` | Interval, in milliseconds, in between flushes to the client while copying the response body.
A negative value means to flush immediately after each write to the client.
This configuration is ignored when a response is a streaming response; for such responses, writes are flushed to the client immediately.
Evaluated only if the kind is **Service**. | 100ms | No |
-| `routes[n].`
`services[m].`
`scheme` | Scheme to use for the request to the upstream Kubernetes Service.
Evaluated only if the kind is **Service**. | "http"
"https" if `port` is 443 or contains the string *https*. | No |
-| `routes[n].`
`services[m].`
`serversTransport` | Name of ServersTransport resource to use to configure the transport between Traefik and your servers.
Evaluated only if the kind is **Service**. | "" | No |
-| `routes[n].`
`services[m].`
`passHostHeader` | Forward client Host header to server.
Evaluated only if the kind is **Service**. | true | No |
-| `routes[n].`
`services[m].`
`healthCheck.scheme` | Server URL scheme for the health check endpoint.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "" | No |
-| `routes[n].`
`services[m].`
`healthCheck.mode` | Health check mode.
If defined to grpc, will use the gRPC health check protocol to probe the server.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "http" | No |
-| `routes[n].`
`services[m].`
`healthCheck.path` | Server URL path for the health check endpoint.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "" | No |
-| `routes[n].`
`services[m].`
`healthCheck.interval` | Frequency of the health check calls.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "100ms" | No |
-| `routes[n].`
`services[m].`
`healthCheck.method` | HTTP method for the health check endpoint.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "GET" | No |
-| `routes[n].`
`services[m].`
`healthCheck.status` | Expected HTTP status code of the response to the health check request.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type ExternalName.
If not set, expect a status between 200 and 399.
Evaluated only if the kind is **Service**. | | No |
-| `routes[n].`
`services[m].`
`healthCheck.port` | URL port for the health check endpoint.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | | No |
-| `routes[n].`
`services[m].`
`healthCheck.timeout` | Maximum duration to wait before considering the server unhealthy.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "5s" | No |
-| `routes[n].`
`services[m].`
`healthCheck.hostname` | Value in the Host header of the health check request.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "" | No |
-| `routes[n].`
`services[m].`
`healthCheck.`
`followRedirect` | Follow the redirections during the healtchcheck.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | true | No |
-| `routes[n].`
`services[m].`
`healthCheck.headers` | Map of header to send to the health check endpoint
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service)). | | No |
-| `routes[n].`
`services[m].`
`sticky.`
`cookie.name` | Name of the cookie used for the stickiness.
When sticky sessions are enabled, a `Set-Cookie` header is set on the initial response to let the client know which server handles the first response.
On subsequent requests, to keep the session alive with the same server, the client should send the cookie with the value set.
If the server pecified in the cookie becomes unhealthy, the request will be forwarded to a new server (and the cookie will keep track of the new server).
Evaluated only if the kind is **Service**. | "" | No |
-| `routes[n].`
`services[m].`
`sticky.`
`cookie.httpOnly` | Allow the cookie can be accessed by client-side APIs, such as JavaScript.
Evaluated only if the kind is **Service**. | false | No |
-| `routes[n].`
`services[m].`
`sticky.`
`cookie.secure` | Allow the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).
Evaluated only if the kind is **Service**. | false | No |
-| `routes[n].`
`services[m].`
`sticky.`
`cookie.sameSite` | [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) policy
Allowed values:
-`none`
-`lax`
`strict`
Evaluated only if the kind is **Service**. | "" | No |
-| `routes[n].`
`services[m].`
`sticky.`
`cookie.maxAge` | Number of seconds until the cookie expires.
Negative number, the cookie expires immediately.
0, the cookie never expires.
Evaluated only if the kind is **Service**. | 0 | No |
-| `routes[n].`
`services[m].`
`strategy` | Load balancing strategy between the servers.
RoundRobin is the only supported value yet.
Evaluated only if the kind is **Service**. | "RoundRobin" | No |
-| `routes[n].`
`services[m].`
`weight` | Service weight.
To use only to refer to WRR TraefikService | "" | No |
-| `routes[n].`
`services[m].`
`nativeLB` | Allow using the Kubernetes Service load balancing between the pods instead of the one provided by Traefik.
Evaluated only if the kind is **Service**. | false | No |
-| `routes[n].`
`services[m].`
`nodePortLB` | Use the nodePort IP address when the service type is NodePort.
It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
Evaluated only if the kind is **Service**. | false | No |
-| `tls` | TLS configuration.
Can be an empty value(`{}`):
A self signed is generated in such a case
(or the [default certificate](tlsstore.md) is used if it is defined.) | | No |
-| `tls.secretName` | [Secret](https://kubernetes.io/docs/concepts/configuration/secret/) name used to store the certificate (in the same namesapce as the `IngressRoute`) | "" | No |
-| `tls.`
`options.name` | Name of the [`TLSOption`](tlsoption.md) to use.
More information [here](#tls-options). | "" | No |
-| `tls.`
`options.namespace` | Namespace of the [`TLSOption`](tlsoption.md) to use. | "" | No |
-| `tls.certResolver` | Name of the [Certificate Resolver](../../../../install-configuration/tls/certificate-resolvers/overview.md) to use to generate automatic TLS certificates. | "" | No |
-| `tls.domains` | List of domains to serve using the certificates generates (one `tls.domain`= one certificate).
More information in the [dedicated section](../../../../install-configuration/tls/certificate-resolvers/acme.md#domain-definition). | | No |
-| `tls.`
`domains[n].main` | Main domain name | "" | Yes |
-| `tls.`
`domains[n].sans` | List of alternative domains (SANs) | | No |
+| Field | Description | Default | Required |
+|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
+| `entryPoints` | List of [entry points](../../../../install-configuration/entrypoints.md) names.
If not specified, HTTP routers will accept requests from all EntryPoints in the list of default EntryPoints. | | No |
+| `routes` | List of routes. | | Yes |
+| `routes[n].kind` | Kind of router matching, only `Rule` is allowed yet. | "Rule" | No |
+| `routes[n].match` | Defines the [rule](../../../http/routing/rules-and-priority.md#rules) corresponding to an underlying router. | | Yes |
+| `routes[n].priority` | Defines the [priority](../../../http/routing/rules-and-priority.md#priority-calculation) to disambiguate rules of the same length, for route matching.
If not set, the priority is directly equal to the length of the rule, and so the longest length has the highest priority.
A value of `0` for the priority is ignored, the default rules length sorting is used. | 0 | No |
+| `routes[n].middlewares` | List of middlewares to attach to the IngressRoute.
More information [here](#middleware). | "" | No |
+| `routes[n].`
`middlewares[m].`
`name` | Middleware name.
The character `@` is not authorized.
More information [here](#middleware). | | Yes |
+| `routes[n].`
`middlewares[m].`
`namespace` | Middleware namespace.
Can be empty if the middleware belongs to the same namespace as the IngressRoute.
More information [here](#middleware). | | No |
+| `routes[n].`
`observability.`
`accesslogs` | Defines whether the route will produce [access-logs](../../../../install-configuration/observability/logs-and-accesslogs.md). See [here](../../../http/routing/observability.md) for more information. | false | No |
+| `routes[n].`
`observability.`
`metrics` | Defines whether the route will produce [metrics](../../../../install-configuration/observability/metrics.md). See [here](../../../http/routing/observability.md) for more information. | false | No |
+| `routes[n].`
`observability.`
`tracing` | Defines whether the route will produce [traces](../../../../install-configuration/observability/tracing.md). See [here](../../../http/routing/observability.md) for more information. | false | No |
+| `tls` | TLS configuration.
Can be an empty value(`{}`):
A self signed is generated in such a case
(or the [default certificate](../tls/tlsstore.md) is used if it is defined.) | | No |
+| `routes[n].`
`services` | List of any combination of [TraefikService](./traefikservice.md) and [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/).
Exhaustive list of option in the [`Service`](./service.md#configuration-options) documentation. | | No |
+| `tls.secretName` | [Secret](https://kubernetes.io/docs/concepts/configuration/secret/) name used to store the certificate (in the same namesapce as the `IngressRoute`) | "" | No |
+| `tls.`
`options.name` | Name of the [`TLSOption`](../tls/tlsoption.md) to use.
More information [here](#tls-options). | "" | No |
+| `tls.`
`options.namespace` | Namespace of the [`TLSOption`](../tls/tlsoption.md) to use. | "" | No |
+| `tls.certResolver` | Name of the [Certificate Resolver](../../../../install-configuration/tls/certificate-resolvers/overview.md) to use to generate automatic TLS certificates. | "" | No |
+| `tls.domains` | List of domains to serve using the certificates generates (one `tls.domain`= one certificate).
More information in the [dedicated section](../../../../install-configuration/tls/certificate-resolvers/acme.md#domain-definition). | | No |
+| `tls.`
`domains[n].main` | Main domain name | "" | Yes |
+| `tls.`
`domains[n].sans` | List of alternative domains (SANs) | | No |
-### ExternalName Service
-
-Traefik backends creation needs a port to be set, however Kubernetes [ExternalName Service](https://kubernetes.io/docs/concepts/services-networking/service/#externalname) could be defined without any port. Accordingly, Traefik supports defining a port in two ways:
-
-- only on `IngressRoute` service
-- on both sides, you'll be warned if the ports don't match, and the `IngressRoute` service port is used
-
-Thus, in case of two sides port definition, Traefik expects a match between ports.
-
-=== "Ports defined on Resource"
-
- ```yaml tab="IngressRoute"
- apiVersion: traefik.io/v1alpha1
- kind: IngressRoute
- metadata:
- name: test.route
- namespace: apps
-
- spec:
- entryPoints:
- - foo
- routes:
- - match: Host(`example.net`)
- kind: Rule
- services:
- - name: external-svc
- port: 80
- ```
-
- ```yaml tab="Service ExternalName"
- apiVersion: v1
- kind: Service
- metadata:
- name: external-svc
- namespace: apps
-
- spec:
- externalName: external.domain
- type: ExternalName
- ```
-
-=== "Port defined on the Service"
-
- ```yaml tab="IngressRoute"
- apiVersion: traefik.io/v1alpha1
- kind: IngressRoute
- metadata:
- name: test.route
- namespace: apps
-
- spec:
- entryPoints:
- - foo
- routes:
- - match: Host(`example.net`)
- kind: Rule
- services:
- - name: external-svc
- ```
-
- ```yaml tab="Service ExternalName"
- apiVersion: v1
- kind: Service
- metadata:
- name: external-svc
- namespace: apps
-
- spec:
- externalName: external.domain
- type: ExternalName
- ports:
- - port: 80
- ```
-
-=== "Port defined on both sides"
-
- ```yaml tab="IngressRoute"
- apiVersion: traefik.io/v1alpha1
- kind: IngressRoute
- metadata:
- name: test.route
- namespace: apps
-
- spec:
- entryPoints:
- - foo
- routes:
- - match: Host(`example.net`)
- kind: Rule
- services:
- - name: external-svc
- port: 80
- ```
-
- ```yaml tab="Service ExternalName"
- apiVersion: v1
- kind: Service
- metadata:
- name: external-svc
- namespace: apps
-
- spec:
- externalName: external.domain
- type: ExternalName
- ports:
- - port: 80
- ```
### Middleware
@@ -281,114 +146,11 @@ same namespace as the IngressRoute)
- `Service` (default value): to reference a [Kubernetes Service](https://kubernetes.io/docs/concepts/services-networking/service/)
- `TraefikService`: to reference an object [`TraefikService`](../http/traefikservice.md)
-### Port Definition
-
-Traefik backends creation needs a port to be set, however Kubernetes [ExternalName Service](https://kubernetes.io/docs/concepts/services-networking/service/#externalname) could be defined without any port. Accordingly, Traefik supports defining a port in two ways:
-
-- only on `IngressRoute` service
-- on both sides, you'll be warned if the ports don't match, and the `IngressRoute` service port is used
-
-Thus, in case of two sides port definition, Traefik expects a match between ports.
-
-??? example
-
- ```yaml tab="IngressRoute"
- ---
- apiVersion: traefik.io/v1alpha1
- kind: IngressRoute
- metadata:
- name: test.route
- namespace: default
-
- spec:
- entryPoints:
- - foo
-
- routes:
- - match: Host(`example.net`)
- kind: Rule
- services:
- - name: external-svc
- port: 80
-
- ---
- apiVersion: v1
- kind: Service
- metadata:
- name: external-svc
- namespace: default
- spec:
- externalName: external.domain
- type: ExternalName
- ```
-
- ```yaml tab="ExternalName Service"
- ---
- apiVersion: traefik.io/v1alpha1
- kind: IngressRoute
- metadata:
- name: test.route
- namespace: default
-
- spec:
- entryPoints:
- - foo
-
- routes:
- - match: Host(`example.net`)
- kind: Rule
- services:
- - name: external-svc
-
- ---
- apiVersion: v1
- kind: Service
- metadata:
- name: external-svc
- namespace: default
- spec:
- externalName: external.domain
- type: ExternalName
- ports:
- - port: 80
- ```
-
- ```yaml tab="Both sides"
- ---
- apiVersion: traefik.io/v1alpha1
- kind: IngressRoute
- metadata:
- name: test.route
- namespace: default
-
- spec:
- entryPoints:
- - foo
-
- routes:
- - match: Host(`example.net`)
- kind: Rule
- services:
- - name: external-svc
- port: 80
-
- ---
- apiVersion: v1
- kind: Service
- metadata:
- name: external-svc
- namespace: default
- spec:
- externalName: external.domain
- type: ExternalName
- ports:
- - port: 80
- ```
### TLS Options
The `options` field enables fine-grained control of the TLS parameters.
-It refers to a [TLSOption](./tlsoption.md) and will be applied only if a `Host`
+It refers to a [TLSOption](../tls/tlsoption.md) and will be applied only if a `Host`
rule is defined.
#### Server Name Association
@@ -454,108 +216,3 @@ TLS options references, a conflict occurs, such as in the example below.
If that happens, both mappings are discarded, and the host name
(`example.net` in the example) for these routers gets associated with
the default TLS options instead.
-
-### Load Balancing
-
-You can declare and use Kubernetes Service load balancing as detailed below:
-
-```yaml tab="IngressRoute"
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
- name: ingressroutebar
- namespace: default
-
-spec:
- entryPoints:
- - web
- routes:
- - match: Host(`example.com`) && PathPrefix(`/foo`)
- kind: Rule
- services:
- - name: svc1
- namespace: default
- - name: svc2
- namespace: default
-```
-
-```yaml tab="K8s Service"
-apiVersion: v1
-kind: Service
-metadata:
- name: svc1
- namespace: default
-
-spec:
- ports:
- - name: http
- port: 80
- selector:
- app: traefiklabs
- task: app1
----
-apiVersion: v1
-kind: Service
-metadata:
- name: svc2
- namespace: default
-
-spec:
- ports:
- - name: http
- port: 80
- selector:
- app: traefiklabs
- task: app2
-```
-
-!!! important "Kubernetes Service Native Load-Balancing"
-
- To avoid creating the server load-balancer with the pod IPs and use Kubernetes Service clusterIP directly,
- one should set the service `NativeLB` option to true.
- Please note that, by default, Traefik reuses the established connections to the backends for performance purposes. This can prevent the requests load balancing between the replicas from behaving as one would expect when the option is set.
- By default, `NativeLB` is false.
-
- ??? example "Example"
-
- ```yaml
- ---
- apiVersion: traefik.io/v1alpha1
- kind: IngressRoute
- metadata:
- name: test.route
- namespace: default
-
- spec:
- entryPoints:
- - foo
-
- routes:
- - match: Host(`example.net`)
- kind: Rule
- services:
- - name: svc
- port: 80
- # Here, nativeLB instructs to build the server load-balancer with the Kubernetes Service clusterIP only.
- nativeLB: true
-
- ---
- apiVersion: v1
- kind: Service
- metadata:
- name: svc
- namespace: default
- spec:
- type: ClusterIP
- ...
- ```
-
-### Configuring Backend Protocol
-
-There are 3 ways to configure the backend protocol for communication between Traefik and your pods:
-
-- Setting the scheme explicitly (http/https/h2c)
-- Configuring the name of the kubernetes service port to start with https (https)
-- Setting the kubernetes service port to use port 443 (https)
-
-If you do not configure the above, Traefik will assume an http connection.
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/http/serverstransport.md b/docs/content/reference/routing-configuration/kubernetes/crd/http/serverstransport.md
index 7c364f685..63f5c04a2 100644
--- a/docs/content/reference/routing-configuration/kubernetes/crd/http/serverstransport.md
+++ b/docs/content/reference/routing-configuration/kubernetes/crd/http/serverstransport.md
@@ -55,18 +55,18 @@ spec:
| Field | Description | Default | Required |
|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `serverstransport.`
`serverName` | Defines the server name that will be used for SNI. | | No |
-| `serverstransport.`
`insecureSkipVerify` | Controls whether the server's certificate chain and host name is verified. | false | No |
-| `serverstransport.`
`rootcas` | Set of root certificate authorities to use when verifying server certificates. (for mTLS connections). | | No |
-| `serverstransport.`
`certificatesSecrets` | Certificates to present to the server for mTLS. | | No |
-| `serverstransport.`
`maxIdleConnsPerHost` | Maximum idle (keep-alive) connections to keep per-host. | 200 | No |
-| `serverstransport.`
`disableHTTP2` | Disables HTTP/2 for connections with servers. | false | No |
-| `serverstransport.`
`peerCertURI` | Defines the URI used to match against SAN URIs during the server's certificate verification. | "" | No |
-| `serverstransport.`
`forwardingTimeouts.dialTimeout` | Amount of time to wait until a connection to a server can be established.
Zero means no timeout. | 30s | No |
-| `serverstransport.`
`forwardingTimeouts.responseHeaderTimeout` | Amount of time to wait for a server's response headers after fully writing the request (including its body, if any).
Zero means no timeout | 0s | No |
-| `serverstransport.`
`forwardingTimeouts.idleConnTimeout` | Maximum amount of time an idle (keep-alive) connection will remain idle before closing itself.
Zero means no timeout. | 90s | No |
-| `serverstransport.`
`spiffe.ids` | Allow SPIFFE IDs.
This takes precedence over the SPIFFE TrustDomain. | | No |
-| `serverstransport.`
`spiffe.trustDomain` | Allow SPIFFE trust domain. | "" | No |
+| `serverstransport.`
`serverName` | Defines the server name that will be used for SNI. | | No |
+| `serverstransport.`
`insecureSkipVerify` | Controls whether the server's certificate chain and host name is verified. | false | No |
+| `serverstransport.`
`rootcas` | Set of root certificate authorities to use when verifying server certificates. (for mTLS connections). | | No |
+| `serverstransport.`
`certificatesSecrets` | Certificates to present to the server for mTLS. | | No |
+| `serverstransport.`
`maxIdleConnsPerHost` | Maximum idle (keep-alive) connections to keep per-host. | 200 | No |
+| `serverstransport.`
`disableHTTP2` | Disables HTTP/2 for connections with servers. | false | No |
+| `serverstransport.`
`peerCertURI` | Defines the URI used to match against SAN URIs during the server's certificate verification. | "" | No |
+| `serverstransport.`
`forwardingTimeouts.dialTimeout` | Amount of time to wait until a connection to a server can be established.
Zero means no timeout. | 30s | No |
+| | Amount of time to wait for a server's response headers after fully writing the request (including its body, if any).
Zero means no timeout | 0s | No |
+| `serverstransport.`
`forwardingTimeouts.idleConnTimeout` | Maximum amount of time an idle (keep-alive) connection will remain idle before closing itself.
Zero means no timeout. | 90s | No |
+| `serverstransport.`
`spiffe.ids` | Allow SPIFFE IDs.
This takes precedence over the SPIFFE TrustDomain. | | No |
+| `serverstransport.`
`spiffe.trustDomain` | Allow SPIFFE trust domain. | "" | No |
!!! note "CA Secret"
The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/http/service.md b/docs/content/reference/routing-configuration/kubernetes/crd/http/service.md
new file mode 100644
index 000000000..b69515b25
--- /dev/null
+++ b/docs/content/reference/routing-configuration/kubernetes/crd/http/service.md
@@ -0,0 +1,430 @@
+---
+title: "Kubernetes Service"
+description: "A Service is a not Traefik CRD, it allows you to describe the Service option in an IngressRoute or a Traefik Service."
+---
+
+`Service` is the implementation of a [Traefik HTTP service](../../../http/load-balancing/service.md).
+
+There is no dedicated CRD, a `Service` is part of:
+
+- [`IngressRoute`](./ingressroute.md)
+- [`TraefikService`](./traefikservice.md)
+
+Note that, before creating `IngressRoute` or `TraefikService` objects, you need to apply the [Traefik Kubernetes CRDs](https://doc.traefik.io/traefik/reference/dynamic-configuration/kubernetes-crd/#definitions) to your Kubernetes cluster.
+
+This registers the Traefik-specific resources.
+
+## Configuration Example
+
+You can declare a `Service` either as part of an `IngressRoute` or a `TraefikService` as detailed below:
+
+```yaml tab="IngressRoute"
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+ name: test-name
+ namespace: apps
+spec:
+ entryPoints:
+ - web
+ routes:
+ - kind: Rule
+ # Rule on the Host
+ match: Host(`test.example.com`)
+ services:
+ # Target a Kubernetes Service
+ - kind: Service
+ name: foo
+ namespace: apps
+ # Customize the connection between Traefik and the backend
+ passHostHeader: true
+ port: 80
+ responseForwarding:
+ flushInterval: 1ms
+ scheme: https
+ sticky:
+ cookie:
+ httpOnly: true
+ name: cookie
+ secure: true
+ strategy: RoundRobin
+```
+
+```yaml tab="TraefikService"
+apiVersion: traefik.io/v1alpha1
+kind: TraefikService
+metadata:
+ name: wrr1
+ namespace: apps
+
+spec:
+ weighted:
+ services:
+ # Target a Kubernetes Service
+ - kind: Service
+ name: foo
+ namespace: apps
+ # Customize the connection between Traefik and the backend
+ passHostHeader: true
+ port: 80
+ responseForwarding:
+ flushInterval: 1ms
+ scheme: https
+ sticky:
+ cookie:
+ httpOnly: true
+ name: cookie
+ secure: true
+ strategy: RoundRobin
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|:---------------------------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------------------------------------------|:---------|
+| `kind` | Kind of the service targeted.
Two values allowed:
- **Service**: Kubernetes Service
**TraefikService**: Traefik Service.
More information [here](#externalname-service). | "Service" | No |
+| `name` | Service name.
The character `@` is not authorized.
More information [here](#middleware). | | Yes |
+| `namespace` | Service namespace.
Can be empty if the service belongs to the same namespace as the IngressRoute.
More information [here](#externalname-service). | | No |
+| `port` | Service port (number or port name).
Evaluated only if the kind is **Service**. | | No |
+| `responseForwarding.`
`flushInterval` | Interval, in milliseconds, in between flushes to the client while copying the response body.
A negative value means to flush immediately after each write to the client.
This configuration is ignored when a response is a streaming response; for such responses, writes are flushed to the client immediately.
Evaluated only if the kind is **Service**. | 100ms | No |
+| `scheme` | Scheme to use for the request to the upstream Kubernetes Service.
Evaluated only if the kind is **Service**. | "http"
"https" if `port` is 443 or contains the string *https*. | No |
+| `serversTransport` | Name of ServersTransport resource to use to configure the transport between Traefik and your servers.
Evaluated only if the kind is **Service**. | "" | No |
+| | Forward client Host header to server.
Evaluated only if the kind is **Service**. | true | No |
+| `healthCheck.scheme` | Server URL scheme for the health check endpoint.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "" | No |
+| `healthCheck.mode` | Health check mode.
If defined to grpc, will use the gRPC health check protocol to probe the server.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "http" | No |
+| `healthCheck.path` | Server URL path for the health check endpoint.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "" | No |
+| `healthCheck.interval` | Frequency of the health check calls for healthy targets.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "100ms" | No |
+| `healthCheck.unhealthyInterval` | Frequency of the health check calls for unhealthy targets.
When not defined, it defaults to the `interval` value.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "100ms" | No |
+| `healthCheck.method` | HTTP method for the health check endpoint.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "GET" | No |
+| `healthCheck.status` | Expected HTTP status code of the response to the health check request.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type ExternalName.
If not set, expect a status between 200 and 399.
Evaluated only if the kind is **Service**. | | No |
+| `healthCheck.port` | URL port for the health check endpoint.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | | No |
+| `healthCheck.timeout` | Maximum duration to wait before considering the server unhealthy.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "5s" | No |
+| `healthCheck.hostname` | Value in the Host header of the health check request.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | "" | No |
+| `healthCheck.`
`followRedirect` | Follow the redirections during the healtchcheck.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service). | true | No |
+| | Map of header to send to the health check endpoint
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#externalname-service)). | | No |
+| `sticky.`
`cookie.name` | Name of the cookie used for the stickiness.
When sticky sessions are enabled, a `Set-Cookie` header is set on the initial response to let the client know which server handles the first response.
On subsequent requests, to keep the session alive with the same server, the client should send the cookie with the value set.
If the server pecified in the cookie becomes unhealthy, the request will be forwarded to a new server (and the cookie will keep track of the new server).
Evaluated only if the kind is **Service**. | "" | No |
+| `sticky.`
`cookie.httpOnly` | Allow the cookie can be accessed by client-side APIs, such as JavaScript.
Evaluated only if the kind is **Service**. | false | No |
+| `sticky.`
`cookie.secure` | Allow the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).
Evaluated only if the kind is **Service**. | false | No |
+| `sticky.`
`cookie.sameSite` | [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) policy
Allowed values:
-`none`
-`lax`
`strict`
Evaluated only if the kind is **Service**. | "" | No |
+| `sticky.`
`cookie.maxAge` | Number of seconds until the cookie expires.
Negative number, the cookie expires immediately.
0, the cookie never expires.
Evaluated only if the kind is **Service**. | 0 | No |
+| `strategy` | Load balancing strategy between the servers.
RoundRobin is the only supported value yet.
Evaluated only if the kind is **Service**. | "RoundRobin" | No |
+| `nativeLB` | Allow using the Kubernetes Service load balancing between the pods instead of the one provided by Traefik.
Evaluated only if the kind is **Service**. | false | No |
+| `nodePortLB` | Use the nodePort IP address when the service type is NodePort.
It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
Evaluated only if the kind is **Service**. | false | No |
+
+
+### ExternalName Service
+
+Traefik backends creation needs a port to be set, however Kubernetes [ExternalName Service](https://kubernetes.io/docs/concepts/services-networking/service/#externalname) could be defined without any port. Accordingly, Traefik supports defining a port in two ways:
+
+- only on `IngressRoute` service
+- on both sides, you'll be warned if the ports don't match, and the `IngressRoute` service port is used
+
+Thus, in case of two sides port definition, Traefik expects a match between ports.
+
+=== "Ports defined on Resource"
+
+ ```yaml tab="IngressRoute"
+ apiVersion: traefik.io/v1alpha1
+ kind: IngressRoute
+ metadata:
+ name: test.route
+ namespace: apps
+
+ spec:
+ entryPoints:
+ - foo
+ routes:
+ - match: Host(`example.net`)
+ kind: Rule
+ services:
+ - name: external-svc
+ port: 80
+ ```
+
+ ```yaml tab="Service ExternalName"
+ apiVersion: v1
+ kind: Service
+ metadata:
+ name: external-svc
+ namespace: apps
+
+ spec:
+ externalName: external.domain
+ type: ExternalName
+ ```
+
+=== "Port defined on the Service"
+
+ ```yaml tab="IngressRoute"
+ apiVersion: traefik.io/v1alpha1
+ kind: IngressRoute
+ metadata:
+ name: test.route
+ namespace: apps
+
+ spec:
+ entryPoints:
+ - foo
+ routes:
+ - match: Host(`example.net`)
+ kind: Rule
+ services:
+ - name: external-svc
+ ```
+
+ ```yaml tab="Service ExternalName"
+ apiVersion: v1
+ kind: Service
+ metadata:
+ name: external-svc
+ namespace: apps
+
+ spec:
+ externalName: external.domain
+ type: ExternalName
+ ports:
+ - port: 80
+ ```
+
+=== "Port defined on both sides"
+
+ ```yaml tab="IngressRoute"
+ apiVersion: traefik.io/v1alpha1
+ kind: IngressRoute
+ metadata:
+ name: test.route
+ namespace: apps
+
+ spec:
+ entryPoints:
+ - foo
+ routes:
+ - match: Host(`example.net`)
+ kind: Rule
+ services:
+ - name: external-svc
+ port: 80
+ ```
+
+ ```yaml tab="Service ExternalName"
+ apiVersion: v1
+ kind: Service
+ metadata:
+ name: external-svc
+ namespace: apps
+
+ spec:
+ externalName: external.domain
+ type: ExternalName
+ ports:
+ - port: 80
+ ```
+
+### Port Definition
+
+Traefik backends creation needs a port to be set, however Kubernetes [ExternalName Service](https://kubernetes.io/docs/concepts/services-networking/service/#externalname) could be defined without any port. Accordingly, Traefik supports defining a port in two ways:
+
+- only on `IngressRoute` service
+- on both sides, you'll be warned if the ports don't match, and the `IngressRoute` service port is used
+
+Thus, in case of two sides port definition, Traefik expects a match between ports.
+
+??? example
+
+ ```yaml tab="IngressRoute"
+ ---
+ apiVersion: traefik.io/v1alpha1
+ kind: IngressRoute
+ metadata:
+ name: test.route
+ namespace: default
+
+ spec:
+ entryPoints:
+ - foo
+
+ routes:
+ - match: Host(`example.net`)
+ kind: Rule
+ services:
+ - name: external-svc
+ port: 80
+
+ ---
+ apiVersion: v1
+ kind: Service
+ metadata:
+ name: external-svc
+ namespace: default
+ spec:
+ externalName: external.domain
+ type: ExternalName
+ ```
+
+ ```yaml tab="ExternalName Service"
+ ---
+ apiVersion: traefik.io/v1alpha1
+ kind: IngressRoute
+ metadata:
+ name: test.route
+ namespace: default
+
+ spec:
+ entryPoints:
+ - foo
+
+ routes:
+ - match: Host(`example.net`)
+ kind: Rule
+ services:
+ - name: external-svc
+
+ ---
+ apiVersion: v1
+ kind: Service
+ metadata:
+ name: external-svc
+ namespace: default
+ spec:
+ externalName: external.domain
+ type: ExternalName
+ ports:
+ - port: 80
+ ```
+
+ ```yaml tab="Both sides"
+ ---
+ apiVersion: traefik.io/v1alpha1
+ kind: IngressRoute
+ metadata:
+ name: test.route
+ namespace: default
+
+ spec:
+ entryPoints:
+ - foo
+
+ routes:
+ - match: Host(`example.net`)
+ kind: Rule
+ services:
+ - name: external-svc
+ port: 80
+
+ ---
+ apiVersion: v1
+ kind: Service
+ metadata:
+ name: external-svc
+ namespace: default
+ spec:
+ externalName: external.domain
+ type: ExternalName
+ ports:
+ - port: 80
+ ```
+
+### Load Balancing
+
+You can declare and use Kubernetes Service load balancing as detailed below:
+
+```yaml tab="IngressRoute"
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+ name: ingressroutebar
+ namespace: default
+
+spec:
+ entryPoints:
+ - web
+ routes:
+ - match: Host(`example.com`) && PathPrefix(`/foo`)
+ kind: Rule
+ services:
+ - name: svc1
+ namespace: default
+ - name: svc2
+ namespace: default
+```
+
+```yaml tab="K8s Service"
+apiVersion: v1
+kind: Service
+metadata:
+ name: svc1
+ namespace: default
+
+spec:
+ ports:
+ - name: http
+ port: 80
+ selector:
+ app: traefiklabs
+ task: app1
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: svc2
+ namespace: default
+
+spec:
+ ports:
+ - name: http
+ port: 80
+ selector:
+ app: traefiklabs
+ task: app2
+```
+
+!!! important "Kubernetes Service Native Load-Balancing"
+
+ To avoid creating the server load-balancer with the pod IPs and use Kubernetes Service clusterIP directly,
+ one should set the service `NativeLB` option to true.
+ Please note that, by default, Traefik reuses the established connections to the backends for performance purposes. This can prevent the requests load balancing between the replicas from behaving as one would expect when the option is set.
+ By default, `NativeLB` is false.
+
+ ??? example "Example"
+
+ ```yaml
+ ---
+ apiVersion: traefik.io/v1alpha1
+ kind: IngressRoute
+ metadata:
+ name: test.route
+ namespace: default
+
+ spec:
+ entryPoints:
+ - foo
+
+ routes:
+ - match: Host(`example.net`)
+ kind: Rule
+ services:
+ - name: svc
+ port: 80
+ # Here, nativeLB instructs to build the server load-balancer with the Kubernetes Service clusterIP only.
+ nativeLB: true
+
+ ---
+ apiVersion: v1
+ kind: Service
+ metadata:
+ name: svc
+ namespace: default
+ spec:
+ type: ClusterIP
+ ...
+ ```
+
+### Configuring Backend Protocol
+
+There are 3 ways to configure the backend protocol for communication between Traefik and your pods:
+
+- Setting the scheme explicitly (http/https/h2c)
+- Configuring the name of the kubernetes service port to start with https (https)
+- Setting the kubernetes service port to use port 443 (https)
+
+If you do not configure the above, Traefik will assume an http connection.
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/http/tlsstore.md b/docs/content/reference/routing-configuration/kubernetes/crd/http/tlsstore.md
deleted file mode 100644
index cab2b1cea..000000000
--- a/docs/content/reference/routing-configuration/kubernetes/crd/http/tlsstore.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-title: "TLSStore"
-description: "TLS Store in Traefik Proxy"
----
-
-In Traefik, certificates are grouped together in certificates stores.
-
-`TLSStore` is the CRD implementation of a [Traefik TLS Store](../../../http/tls/tls-certificates.md#certificates-stores).
-
-Before creating `TLSStore` objects, you need to apply the [Traefik Kubernetes CRDs](https://doc.traefik.io/traefik/reference/dynamic-configuration/kubernetes-crd/#definitions) to your Kubernetes cluster.
-
-!!! Tip "Default TLS Store"
- Traefik currently only uses the TLS Store named "default". This default `TLSStore` should be in a namespace discoverable by Traefik. Since it is used by default on `IngressRoute` and `IngressRouteTCP` objects, there never is a need to actually reference it. This means that you cannot have two stores that are named default in different Kubernetes namespaces. As a consequence, with respect to TLS stores, the only change that makes sense (and only if needed) is to configure the default `TLSStore`.
-
-## Configuration Example
-
-```yaml tab="TLSStore"
-apiVersion: traefik.io/v1alpha1
-kind: TLSStore
-metadata:
- name: default
-
-spec:
- defaultCertificate:
- secretName: supersecret
-```
-
-## Configuration Options
-
-| Field | Description | Required |
-|:---------------------------------------|:-------------------------|:---------|
-| `certificates[n].secretName` | List of Kubernetes [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/), each of them holding a key/certificate pair to add to the store. | No |
-| `defaultCertificate.secretName` | Name of the Kubernetes [Secret](https://kubernetes.io/docs/concepts/configuration/secret/) served for connections without a SNI, or without a matching domain. If no default certificate is provided, Traefik will use the generated one. Do not use if the option `defaultGeneratedCert` is set. | No |
-| `defaultGeneratedCert.resolver` | Name of the ACME resolver to use to generate the default certificate.
Do not use if the option `defaultCertificate` is set. | No |
-| `defaultGeneratedCert.domain.main` | Main domain used to generate the default certificate.
Do not use if the option `defaultCertificate` is set. | No |
-| `defaultGeneratedCert.domain.sans` | List of [Subject Alternative Name](https://en.wikipedia.org/wiki/Subject_Alternative_Name) used to generate the default certificate.
Do not use if the option `defaultCertificate` is set. | No |
-
-!!! note "DefaultCertificate vs DefaultGeneratedCert"
- If both `defaultCertificate` and `defaultGeneratedCert` are set, the TLS certificate contained in `defaultCertificate.secretName` is served. The ACME default certificate is not generated.
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/http/traefikservice.md b/docs/content/reference/routing-configuration/kubernetes/crd/http/traefikservice.md
index acda27c48..55bae513e 100644
--- a/docs/content/reference/routing-configuration/kubernetes/crd/http/traefikservice.md
+++ b/docs/content/reference/routing-configuration/kubernetes/crd/http/traefikservice.md
@@ -148,42 +148,15 @@ data:
### Configuration Options
-| Field | Description | Default | Required |
-|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `services` | List of any combination of TraefikService and [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/).
. | | No |
-| `services[m].`
`kind` | Kind of the service targeted.
Two values allowed:
- **Service**: Kubernetes Service
- **TraefikService**: Traefik Service. | "" | No |
-| `services[m].`
`name` | Service name.
The character `@` is not authorized. | "" | Yes |
-| `services[m].`
`namespace` | Service namespace. | "" | No |
-| `services[m].`
`port` | Service port (number or port name).
Evaluated only if the kind is **Service**. | "" | No |
-| `services[m].`
`responseForwarding.`
`flushInterval` | Interval, in milliseconds, in between flushes to the client while copying the response body.
A negative value means to flush immediately after each write to the client.
This configuration is ignored when a response is a streaming response; for such responses, writes are flushed to the client immediately.
Evaluated only if the kind is **Service**. | 100ms | No |
-| `services[m].`
`scheme` | Scheme to use for the request to the upstream Kubernetes Service.
Evaluated only if the kind is **Service**. | "http"
"https" if `port` is 443 or contains the string *https*. | No |
-| `services[m].`
`serversTransport` | Name of ServersTransport resource to use to configure the transport between Traefik and your servers.
Evaluated only if the kind is **Service**. | "" | No |
-| `services[m].`
`passHostHeader` | Forward client Host header to server.
Evaluated only if the kind is **Service**. | true | No |
-| `services[m].`
`healthCheck.scheme` | Server URL scheme for the health check endpoint.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`. | "" | No |
-| `services[m].`
`healthCheck.mode` | Health check mode.
If defined to grpc, will use the gRPC health check protocol to probe the server.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`. | "http" | No |
-| `services[m].`
`healthCheck.path` | Server URL path for the health check endpoint.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`. | "" | No |
-| `services[m].`
`healthCheck.interval` | Frequency of the health check calls.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName]`ExternalName`. | "100ms" | No |
-| `services[m].`
`healthCheck.method` | HTTP method for the health check endpoint.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`. | "GET" | No |
-| `services[m].`
`healthCheck.status` | Expected HTTP status code of the response to the health check request.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type ExternalName.
If not set, expect a status between 200 and 399.
Evaluated only if the kind is **Service**. | | No |
-| `services[m].`
`healthCheck.port` | URL port for the health check endpoint.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`. | | No |
-| `services[m].`
`healthCheck.timeout` | Maximum duration to wait before considering the server unhealthy.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`. | "5s" | No |
-| `services[m].`
`healthCheck.hostname` | Value in the Host header of the health check request.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`. | "" | No |
-| `services[m].`
`healthCheck.`
`followRedirect` | Follow the redirections during the healtchcheck.
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`. | true | No |
-| `services[m].`
`healthCheck.headers` | Map of header to send to the health check endpoint
Evaluated only if the kind is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type `ExternalName`. | | No |
-| `services[m].`
`sticky.`
`cookie.name` | Name of the cookie used for the stickiness.
Evaluated only if the kind is **Service**. | Abbreviation of a sha1
(ex: `_1d52e`). | No |
-| `services[m].`
`sticky.`
`cookie.httpOnly` | Allow the cookie can be accessed by client-side APIs, such as JavaScript.
Evaluated only if the kind is **Service**. | false | No |
-| `services[m].`
`sticky.`
`cookie.secure` | Allow the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).
Evaluated only if the kind is **Service**. | false | No |
-| `services[m].`
`sticky.`
`cookie.sameSite` | [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) policy.
Allowed values:
-`none`
-`lax`
`strict`
Evaluated only if the kind is **Service**. | "" | No |
-| `services[m].`
`sticky.`
`cookie.maxAge` | Number of seconds until the cookie expires.
Negative number, the cookie expires immediately.
0, the cookie never expires.
Evaluated only if the kind is **Service**. | 0 | No |
-| `services[m].`
`strategy` | Load balancing strategy between the servers.
RoundRobin is the only supported value yet.
Evaluated only if the kind is **Service**. | "RoundRobin" | No |
-| `services[m].`
`weight` | Service weight.
To use only to refer to WRR TraefikService | "" | No |
-| `services[m].`
`nativeLB` | Allow using the Kubernetes Service load balancing between the pods instead of the one provided by Traefik.
Evaluated only if the kind is **Service**. | false | No |
-| `services[m].`
`nodePortLB` | Use the nodePort IP address when the service type is NodePort.
It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
Evaluated only if the kind is **Service**. | false | No |
-| `sticky.`
`cookie.name` | Name of the cookie used for the stickiness at the WRR service level.
When sticky sessions are enabled, a `Set-Cookie` header is set on the initial response to let the client know which server handles the first response.
On subsequent requests, to keep the session alive with the same server, the client should send the cookie with the value set.
If the server pecified in the cookie becomes unhealthy, the request will be forwarded to a new server (and the cookie will keep track of the new server).
More information about WRR stickiness [here](#stickiness-on-multiple-levels) | Abbreviation of a sha1
(ex: `_1d52e`). | No |
-| `sticky.`
`cookie.httpOnly` | Allow the cookie used for the stickiness at the WRR service level to be accessed by client-side APIs, such as JavaScript.
More information about WRR stickiness [here](#stickiness-on-multiple-levels) | false | No |
-| `sticky.`
`cookie.secure` | Allow the cookie used for the stickiness at the WRR service level to be only transmitted over an encrypted connection (i.e. HTTPS).
More information about WRR stickiness [here](#stickiness-on-multiple-levels) | false | No |
-| `sticky.`
`cookie.sameSite` | [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) policy for the cookie used for the stickiness at the WRR service level.
Allowed values:
-`none`
-`lax`
`strict`
More information about WRR stickiness [here](#stickiness-on-multiple-levels) | "" | No |
-| `sticky.`
`cookie.maxAge` | Number of seconds until the cookie used for the stickiness at the WRR service level expires.
Negative number, the cookie expires immediately.
0, the cookie never expires. | 0 | No |
+| Field | Description | Default | Required |
+|:---------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------------------------------------------|:---------|
+| `services` | List of any combination of TraefikService and [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/).
. Exhaustive list of option in the [`Service`](./service.md#configuration-options) documentation. | | No |
+| `services[m].weight` | Service weight. | "" | No |
+| `sticky.`
`cookie.name` | Name of the cookie used for the stickiness at the WRR service level.
When sticky sessions are enabled, a `Set-Cookie` header is set on the initial response to let the client know which server handles the first response.
On subsequent requests, to keep the session alive with the same server, the client should send the cookie with the value set.
If the server pecified in the cookie becomes unhealthy, the request will be forwarded to a new server (and the cookie will keep track of the new server).
More information about WRR stickiness [here](#stickiness-on-multiple-levels) | Abbreviation of a sha1
(ex: `_1d52e`). | No |
+| `sticky.`
`cookie.httpOnly` | Allow the cookie used for the stickiness at the WRR service level to be accessed by client-side APIs, such as JavaScript.
More information about WRR stickiness [here](#stickiness-on-multiple-levels) | false | No |
+| `sticky.`
`cookie.secure` | Allow the cookie used for the stickiness at the WRR service level to be only transmitted over an encrypted connection (i.e. HTTPS).
More information about WRR stickiness [here](#stickiness-on-multiple-levels) | false | No |
+| `sticky.`
`cookie.sameSite` | [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) policy for the cookie used for the stickiness at the WRR service level.
Allowed values:
-`none`
-`lax`
`strict`
More information about WRR stickiness [here](#stickiness-on-multiple-levels) | "" | No |
+| `sticky.`
`cookie.maxAge` | Number of seconds until the cookie used for the stickiness at the WRR service level expires.
Negative number, the cookie expires immediately.
0, the cookie never expires. | 0 | No |
#### Stickiness on multiple levels
@@ -304,6 +277,8 @@ spec:
mirroring:
name: svc1 # svc1 receives 100% of the traffic
port: 80
+ mirrorBody: true # Set to false by default
+ maxBodySize: 1M
mirrors:
- name: svc2 # svc2 receives a copy of 20% of this traffic
port: 80
@@ -366,71 +341,31 @@ spec:
### Configuration Options
-!!!note "Main and mirrored services"
+#### Main Service Options
- The main service properties are set as the option root level.
+The main service properties are set as the option root level.
- The mirrored services properties are set in the `mirrors` list.
+The main service provides the same options as a [`Service`](./service.md).
-| Field | Description | Default | Required |
-|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `kind` | Kind of the main service.
Two values allowed:
- **Service**: Kubernetes Service
- **TraefikService**: Traefik Service.
More information [here](#services) | "" | No |
-| `name` | Main service name.
The character `@` is not authorized. | "" | Yes |
-| `namespace` | Main service namespace.
More information [here](#services). | "" | No |
-| `port` | Main service port (number or port name).
Evaluated only if the kind of the main service is **Service**. | "" | No |
-| `responseForwarding.`
`flushInterval` | Interval, in milliseconds, in between flushes to the client while copying the response body.
A negative value means to flush immediately after each write to the client.
This configuration is ignored when a response is a streaming response; for such responses, writes are flushed to the client immediately.
Evaluated only if the kind of the main service is **Service**. | 100ms | No |
-| `scheme` | Scheme to use for the request to the upstream Kubernetes Service.
Evaluated only if the kind of the main service is **Service**. | "http"
"https" if `port` is 443 or contains the string *https*. | No |
-| `serversTransport` | Name of ServersTransport resource to use to configure the transport between Traefik and the main service's servers.
Evaluated only if the kind of the main service is **Service**. | "" | No |
-| `passHostHeader` | Forward client Host header to main service's server.
Evaluated only if the kind of the main service is **Service**. | true | No |
-| `healthCheck.scheme` | Server URL scheme for the health check endpoint.
Evaluated only if the kind of the main service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | "" | No |
-| `healthCheck.mode` | Health check mode.
If defined to grpc, will use the gRPC health check protocol to probe the server.
Evaluated only if the kind of the main service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | "http" | No |
-| `healthCheck.path` | Server URL path for the health check endpoint.
Evaluated only if the kind of the main service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | "" | No |
-| `healthCheck.interval` | Frequency of the health check calls.
Evaluated only if the kind of the main service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | "100ms" | No |
-| `healthCheck.method` | HTTP method for the health check endpoint.
Evaluated only if the kind of the main service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | "GET" | No |
-| `healthCheck.status` | Expected HTTP status code of the response to the health check request.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type ExternalName.
If not set, expect a status between 200 and 399.
Evaluated only if the kind of the main service is **Service**. | | No |
-| `healthCheck.port` | URL port for the health check endpoint.
Evaluated only if the kind of the main service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | | No |
-| `healthCheck.timeout` | Maximum duration to wait before considering the server unhealthy.
Evaluated only if the kind of the main service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | "5s" | No |
-| `healthCheck.hostname` | Value in the Host header of the health check request.
Evaluated only if the kind of the main service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | "" | No |
-| `healthCheck.`
`followRedirect` | Follow the redirections during the healtchcheck.
Evaluated only if the kind of the main service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | true | No |
-| `healthCheck.headers` | Map of header to send to the health check endpoint
Evaluated only if the kind of the main service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | | No |
-| `sticky.`
`cookie.name` | Name of the cookie used for the stickiness on the main service.
Evaluated only if the kind of the main service is **Service**. | Abbreviation of a sha1
(ex: `_1d52e`). | No |
-| `sticky.`
`cookie.httpOnly` | Allow the cookie can be accessed by client-side APIs, such as JavaScript.
Evaluated only if the kind of the main service is **Service**. | false | No |
-| `sticky.`
`cookie.secure` | Allow the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).
Evaluated only if the kind of the main service is **Service**. | false | No |
-| `sticky.`
`cookie.sameSite` | [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) policy.
Allowed values:
-`none`
-`lax`
`strict`
Evaluated only if the kind of the main service is **Service**. | "" | No |
-| `sticky.`
`cookie.maxAge` | Number of seconds until the cookie expires.
Negative number, the cookie expires immediately.
0, the cookie never expires.
Evaluated only if the kind of the main service is **Service**. | 0 | No |
-| `strategy` | Load balancing strategy between the main service's servers.
RoundRobin is the only supported value yet.
Evaluated only if the kind of the main service is **Service**. | "RoundRobin" | No |
-| `weight` | Service weight.
To use only to refer to WRR TraefikService | "" | No |
-| `nativeLB` | Allow using the Kubernetes Service load balancing between the pods instead of the one provided by Traefik.
Evaluated only if the kind of the main service is **Service**. | false | No |
-| `nodePortLB` | Use the nodePort IP address when the service type is NodePort.
It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
Evaluated only if the kind of the main service is **Service**. | false | No |
-| `maxBodySize` | Maximum size allowed for the body of the request.
If the body is larger, the request is not mirrored.
-1 means unlimited size. | -1 | No |
-| `mirrors` | List of mirrored services to target.
It can be any combination of TraefikService and [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/).
More information [here](#services). | | No |
-| `mirrors[m].`
`kind` | Kind of the mirrored service targeted.
Two values allowed:
- **Service**: Kubernetes Service
- **TraefikService**: Traefik Service.
More information [here](#services) | "" | No |
-| `mirrors[m].`
`name` | Mirrored service name.
The character `@` is not authorized. | "" | Yes |
-| `mirrors[m].`
`namespace` | Mirrored service namespace.
More information [here](#services). | "" | No |
-| `mirrors[m].`
`port` | Mirrored service port (number or port name).
Evaluated only if the kind of the mirrored service is **Service**. | "" | No |
-| `mirrors[m].`
`percent` | Part of the traffic to mirror in percent (from 0 to 100) | 0 | No |
-| `mirrors[m].`
`responseForwarding.`
`flushInterval` | Interval, in milliseconds, in between flushes to the client while copying the response body.
A negative value means to flush immediately after each write to the client.
This configuration is ignored when a response is a streaming response; for such responses, writes are flushed to the client immediately.
Evaluated only if the kind of the mirrored service is **Service**. | 100ms | No |
-| `mirrors[m].`
`scheme` | Scheme to use for the request to the mirrored service.
Evaluated only if the kind of the mirrored service is **Service**. | "http"
"https" if `port` is 443 or contains the string *https*. | No |
-| `mirrors[m].`
`serversTransport` | Name of ServersTransport resource to use to configure the transport between Traefik and the mirrored service servers.
Evaluated only if the kind of the mirrored service is **Service**. | "" | No |
-| `mirrors[m].`
`passHostHeader` | Forward client Host header to the mirrored service servers.
Evaluated only if the kind of the mirrored service is **Service**. | true | No |
-| `mirrors[m].`
`healthCheck.scheme` | Server URL scheme for the health check endpoint.
Evaluated only if the kind of the mirrored service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | "" | No |
-| `mirrors[m].`
`healthCheck.mode` | Health check mode.
If defined to grpc, will use the gRPC health check protocol to probe the server.
Evaluated only if the kind of the mirrored service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | "http" | No |
-| `mirrors[m].`
`healthCheck.path` | Server URL path for the health check endpoint.
Evaluated only if the kind of the mirrored service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | "" | No |
-| `mirrors[m].`
`healthCheck.interval` | Frequency of the health check calls.
Evaluated only if the kind of the mirrored service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | "100ms" | No |
-| `mirrors[m].`
`healthCheck.method` | HTTP method for the health check endpoint.
Evaluated only if the kind of the mirrored service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | "GET" | No |
-| `mirrors[m].`
`healthCheck.status` | Expected HTTP status code of the response to the health check request.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type ExternalName.
If not set, expect a status between 200 and 399.
Evaluated only if the kind of the mirrored service is **Service**. | | No |
-| `mirrors[m].`
`healthCheck.port` | URL port for the health check endpoint.
Evaluated only if the kind of the mirrored service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | | No |
-| `mirrors[m].`
`healthCheck.timeout` | Maximum duration to wait before considering the server unhealthy.
Evaluated only if the kind of the mirrored service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | "5s" | No |
-| `mirrors[m].`
`healthCheck.hostname` | Value in the Host header of the health check request.
Evaluated only if the kind of the mirrored service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | "" | No |
-| `mirrors[m].`
`healthCheck.`
`followRedirect` | Follow the redirections during the healtchcheck.
Evaluated only if the kind of the mirrored service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | true | No |
-| `mirrors[m].`
`healthCheck.headers` | Map of header to send to the health check endpoint
Evaluated only if the kind of the mirrored service is **Service**.
Only for [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) of type [ExternalName](#services). | | No |
-| `mirrors[m].`
`sticky.`
`cookie.name` | Name of the cookie used for the stickiness.
When sticky sessions are enabled, a `Set-Cookie` header is set on the initial response to let the client know which server handles the first response.
On subsequent requests, to keep the session alive with the same server, the client should send the cookie with the value set.
If the server pecified in the cookie becomes unhealthy, the request will be forwarded to a new server (and the cookie will keep track of the new server).
Evaluated only if the kind of the mirrored service is **Service**. | "" | No |
-| `mirrors[m].`
`sticky.`
`cookie.httpOnly` | Allow the cookie can be accessed by client-side APIs, such as JavaScript.
Evaluated only if the kind of the mirrored service is **Service**. | false | No |
-| `mirrors[m].`
`sticky.`
`cookie.secure` | Allow the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).
Evaluated only if the kind of the mirrored service is **Service**. | false | No |
-| `mirrors[m].`
`sticky.`
`cookie.sameSite` | [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) policy.
Allowed values:
-`none`
-`lax`
`strict`
Evaluated only if the kind of the mirrored service is **Service**. | "" | No |
-| `mirrors[m].`
`sticky.`
`cookie.maxAge` | Number of seconds until the cookie expires.
Negative number, the cookie expires immediately.
0, the cookie never expires.
Evaluated only if the kind of the mirrored service is **Service**. | 0 | No |
-| `mirrors[m].`
`strategy` | Load balancing strategy between the servers.
RoundRobin is the only supported value yet.
Evaluated only if the kind of the mirrored service is **Service**. | "RoundRobin" | No |
-| `mirrors[m].`
`weight` | Service weight.
To use only to refer to WRR TraefikService | "" | No |
-| `mirrors[m].`
`nativeLB` | Allow using the Kubernetes Service load balancing between the pods instead of the one provided by Traefik.
Evaluated only if the kind of the mirrored service is **Service**. | false | No |
-| `mirrors[m].`
`nodePortLB` | Use the nodePort IP address when the service type is NodePort.
It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.
Evaluated only if the kind of the mirrored service is **Service**. | false | No |
-| `mirrorBody` | Defines whether the request body should be mirrored. | true | No |
+The exhaustive list of the service options is described in the [`Service`](./service.md#configuration-options) documentation.
+The mirror main service dedicated option are described below.
+
+| Field | Description | Default | Required |
+|:--------------------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------------------------------------------|:---------|
+| `mirrorBody` | Defines whether the request body should be mirrored. | true | No |
+| `maxBodySize` | Maximum size allowed for the body of the request.
If the body is larger, the request is not mirrored.
-1 means unlimited size. | -1 | No |
+| `mirrors` | List of mirrored services to target.
It can be any combination of TraefikService and [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/).
Exhaustive list of option in the [`Service`](./service.md#configuration-options) documentation. | | Yes |
+
+#### Mirrored Services Options
+
+The mirrored services properties are set in the `mirrors` list.
+
+A mirrored service provides the same options as a [`Service`](./service.md).
+
+The exhaustive list of the service options is described in the [`Service`](./service.md#configuration-options) documentation.
+The mirrorerd service dedicated option are described below.
+
+
+| Field | Description | Default | Required |
+|:--------------------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------------------------------------------|:---------|
+| `mirrors[m].percent` | Traffic percentage to route to the service. | 0 | No |
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/tcp/ingressroutetcp.md b/docs/content/reference/routing-configuration/kubernetes/crd/tcp/ingressroutetcp.md
index 44598e18a..4ae214dae 100644
--- a/docs/content/reference/routing-configuration/kubernetes/crd/tcp/ingressroutetcp.md
+++ b/docs/content/reference/routing-configuration/kubernetes/crd/tcp/ingressroutetcp.md
@@ -3,7 +3,7 @@ title: "Kubernetes IngressRouteTCP"
description: "An IngressRouteTCP is a Traefik CRD is in charge of connecting incoming TCP connections to the Services that can handle them."
---
-`IngressRouteTCP` is the CRD implementation of a [Traefik TCP router](../../../tcp/router/rules-and-priority.md).
+`IngressRouteTCP` is the CRD implementation of a [Traefik TCP router](../../../tcp/routing/rules-and-priority.md).
Before creating `IngressRouteTCP` objects, you need to apply the [Traefik Kubernetes CRDs](https://doc.traefik.io/traefik/reference/dynamic-configuration/kubernetes-crd/#definitions) to your Kubernetes cluster.
@@ -16,7 +16,7 @@ This registers the `IngressRouteTCP` kind and other Traefik-specific resources.
You can declare an `IngressRouteTCP` as detailed below:
-```yaml tab="IngressRoute"
+```yaml tab="IngressRouteTCP"
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
@@ -36,12 +36,9 @@ spec:
- name: foo
port: 8080
weight: 10
- proxyProtocol:
- version: 1
serversTransport: transport
nativeLB: true
nodePortLB: true
- tls: false
tls:
secretName: supersecret
@@ -59,33 +56,33 @@ spec:
## Configuration Options
-| Field | Description | Default | Required |
-|-------------------------------------|-----------------------------|-------------------------------------------|-----------------------|
-| `entryPoints` | List of entrypoints names. | | No |
-| `routes` | List of routes. | | Yes |
-| `routes[n].match` | Defines the [rule](../../../tcp/router/rules-and-priority.md#rules) of the underlying router. | | Yes |
-| `routes[n].priority` | Defines the [priority](../../../tcp/router/rules-and-priority.md#priority) to disambiguate rules of the same length, for route matching. | | No |
-| `routes[n].middlewares[n].name` | Defines the [MiddlewareTCP](./middlewaretcp.md) name. | | Yes |
-| `routes[n].middlewares[n].namespace` | Defines the [MiddlewareTCP](./middlewaretcp.md) namespace. | ""| No|
-| `routes[n].services` | List of [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) definitions. | | No |
-| `routes[n].services[n].name` | Defines the name of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). | | Yes |
-| `routes[n].services[n].port` | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). This can be a reference to a named port.| | Yes |
-| `routes[n].services[n].weight` | Defines the weight to apply to the server load balancing. | 1 | No |
-| `routes[n].services[n].proxyProtocol` | Defines the [PROXY protocol](../../../../install-configuration/entrypoints.md#proxyprotocol-and-load-balancers) configuration. | | No |
-| `routes[n].services[n].proxyProtocol.version` | Defines the [PROXY protocol](../../../../install-configuration/entrypoints.md#proxyprotocol-and-load-balancers) version. | | No |
-| `routes[n].services[n].serversTransport` | Defines the [ServersTransportTCP](./serverstransporttcp.md).
The `ServersTransport` namespace is assumed to be the [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) namespace. | | No |
-| `routes[n].services[n].nativeLB` | Controls, when creating the load-balancer, whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. See [here](#nativelb) for more information. | false | No |
-| `routes[n].services[n].nodePortLB` | Controls, when creating the load-balancer, whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is `NodePort`. It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. | false | No |
-| `tls` | Defines [TLS](../../../../install-configuration/tls/certificate-resolvers/overview.md) certificate configuration. | | No |
-| `tls.secretName` | Defines the [secret](https://kubernetes.io/docs/concepts/configuration/secret/) name used to store the certificate (in the `IngressRoute` namespace). | "" | No |
-| `tls.options` | Defines the reference to a [TLSOption](../http/tlsoption.md). | "" | No |
-| `tls.options.name` | Defines the [TLSOption](../http/tlsoption.md) name. | "" | No |
-| `tls.options.namespace` | Defines the [TLSOption](../http/tlsoption.md) namespace. | "" | No |
-| `tls.certResolver` | Defines the reference to a [CertResolver](../../../../install-configuration/tls/certificate-resolvers/overview.md). | "" | No |
-| `tls.domains` | List of domains. | "" | No |
-| `tls.domains[n].main` | Defines the main domain name. | "" | No |
-| `tls.domains[n].sans` | List of SANs (alternative domains). | "" | No |
-| `tls.passthrough` | If `true`, delegates the TLS termination to the backend. | false | No |
+| Field | Description | Default | Required |
+|-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------|-----------------------|
+| `entryPoints` | List of entrypoints names. | | No |
+| `routes` | List of routes. | | Yes |
+| `routes[n].match` | Defines the [rule](../../../tcp/routing/rules-and-priority.md#rules) of the underlying router. | | Yes |
+| `routes[n].priority` | Defines the [priority](../../../tcp/routing/rules-and-priority.md#priority-calculation) to disambiguate rules of the same length, for route matching. | | No |
+| `routes[n].middlewares[n].name` | Defines the [MiddlewareTCP](./middlewaretcp.md) name. | | Yes |
+| `routes[n].middlewares[n].namespace` | Defines the [MiddlewareTCP](./middlewaretcp.md) namespace. | ""| No|
+| `routes[n].services` | List of [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) definitions. | | No |
+| `routes[n].services[n].name` | Defines the name of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). | | Yes |
+| `routes[n].services[n].port` | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). This can be a reference to a named port. | | Yes |
+| `routes[n].services[n].weight` | Defines the weight to apply to the server load balancing. | 1 | No |
+| `routes[n].services[n].proxyProtocol` | Defines the [PROXY protocol](../../../../install-configuration/entrypoints.md#proxyprotocol-and-load-balancers) configuration. | | No |
+| `routes[n].services[n].proxyProtocol.version` | Defines the [PROXY protocol](../../../../install-configuration/entrypoints.md#proxyprotocol-and-load-balancers) version. | | No |
+| `routes[n].services[n].serversTransport` | Defines the [ServersTransportTCP](./serverstransporttcp.md).
The `ServersTransport` namespace is assumed to be the [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) namespace. | | No |
+| `routes[n].services[n].nativeLB` | Controls, when creating the load-balancer, whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. See [here](#nativelb) for more information. | false | No |
+| `routes[n].services[n].nodePortLB` | Controls, when creating the load-balancer, whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is `NodePort`. It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. | false | No |
+| `tls` | Defines [TLS](../../../../install-configuration/tls/certificate-resolvers/overview.md) certificate configuration. | | No |
+| `tls.secretName` | Defines the [secret](https://kubernetes.io/docs/concepts/configuration/secret/) name used to store the certificate (in the `IngressRoute` namespace). | "" | No |
+| `tls.options` | Defines the reference to a [TLSOption](../tls/tlsoption.md). | "" | No |
+| `tls.options.name` | Defines the [TLSOption](../tls/tlsoption.md) name. | "" | No |
+| `tls.options.namespace` | Defines the [TLSOption](../tls/tlsoption.md) namespace. | "" | No |
+| `tls.certResolver` | Defines the reference to a [CertResolver](../../../../install-configuration/tls/certificate-resolvers/overview.md). | "" | No |
+| `tls.domains` | List of domains. | "" | No |
+| `tls.domains[n].main` | Defines the main domain name. | "" | No |
+| `tls.domains[n].sans` | List of SANs (alternative domains). | "" | No |
+| `tls.passthrough` | If `true`, delegates the TLS termination to the backend. | false | No |
### ExternalName Service
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/tcp/serverstransporttcp.md b/docs/content/reference/routing-configuration/kubernetes/crd/tcp/serverstransporttcp.md
index 7e275df61..456ed9d2b 100644
--- a/docs/content/reference/routing-configuration/kubernetes/crd/tcp/serverstransporttcp.md
+++ b/docs/content/reference/routing-configuration/kubernetes/crd/tcp/serverstransporttcp.md
@@ -29,6 +29,9 @@ metadata:
namespace: default
spec:
+ proxyProtocol:
+ version: 2
+ terminationDelay: 100ms
tls:
serverName: example.org
insecureSkipVerify: true
@@ -36,16 +39,18 @@ spec:
## Configuration Options
-| Field | Description | Default | Required |
-|-------------------------------------|-----------------------------|-------------------------------------------|-----------------------|
-| `dialTimeout` | The amount of time to wait until a connection to a server can be established. If zero, no timeout exists. | 30s | No |
-| `dialKeepAlive` | The interval between keep-alive probes for an active network connection.
If this option is set to zero, keep-alive probes are sent with a default value (currently 15 seconds),
if supported by the protocol and operating system. Network protocols or operating systems that do not support keep-alives ignore this field.
If negative, keep-alive probes are turned off.| 15s | No |
-| `terminationDelay` | Defines the delay to wait before fully terminating the connection, after one connected peer has closed its writing capability.| 100ms | No |
-| `tls.serverName` | ServerName used to contact the server. | "" | No |
-| `tls.insecureSkipVerify` | Controls whether the server's certificate chain and host name is verified. | false | No |
-| `tls.peerCertURI` | Defines the URI used to match against SAN URIs during the server's certificate verification. | "" | No |
-| `tls.rootCAsSecrets` | Defines the set of root certificate authorities to use when verifying server certificates.
The CA secret must contain a base64 encoded certificate under either a `tls.ca` or a `ca.crt` key.| "" | No |
-| `tls.certificatesSecrets` | Certificates to present to the server for mTLS.| "" | No |
-| `spiffe` | Configures [SPIFFE](../../../../install-configuration/tls/spiffe.md) options. | "" | No |
-| `spiffe.ids` | Defines the allowed SPIFFE IDs. This takes precedence over the SPIFFE `trustDomain`. |""| No |
-| `spiffe.trustDomain` | Defines the allowed SPIFFE trust domain. | "" | No |
+| Field | Description | Default | Required |
+|---------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|----------|
+| `dialTimeout` | The amount of time to wait until a connection to a server can be established. If zero, no timeout exists. | 30s | No |
+| `dialKeepAlive` | The interval between keep-alive probes for an active network connection.
If this option is set to zero, keep-alive probes are sent with a default value (currently 15 seconds),
if supported by the protocol and operating system. Network protocols or operating systems that do not support keep-alives ignore this field.
If negative, keep-alive probes are turned off. | 15s | No |
+| `proxyProtocol` | Defines the Proxy Protocol configuration. An empty `proxyProtocol` section enables Proxy Protocol version 2. | | No |
+| `proxyProtocol.version` | Traefik supports PROXY Protocol version 1 and 2 on TCP Services. | | No |
+| `terminationDelay` | Defines the delay to wait before fully terminating the connection, after one connected peer has closed its writing capability. | 100ms | No |
+| `tls.serverName` | ServerName used to contact the server. | "" | No |
+| `tls.insecureSkipVerify` | Controls whether the server's certificate chain and host name is verified. | false | No |
+| `tls.peerCertURI` | Defines the URI used to match against SAN URIs during the server's certificate verification. | "" | No |
+| `tls.rootCAsSecrets` | Defines the set of root certificate authorities to use when verifying server certificates.
The CA secret must contain a base64 encoded certificate under either a `tls.ca` or a `ca.crt` key. | "" | No |
+| `tls.certificatesSecrets` | Certificates to present to the server for mTLS. | "" | No |
+| `spiffe` | Configures [SPIFFE](../../../../install-configuration/tls/spiffe.md) options. | "" | No |
+| `spiffe.ids` | Defines the allowed SPIFFE IDs. This takes precedence over the SPIFFE `trustDomain`. | "" | No |
+| `spiffe.trustDomain` | Defines the allowed SPIFFE trust domain. | "" | No |
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/tcp/tlsoption.md b/docs/content/reference/routing-configuration/kubernetes/crd/tcp/tlsoption.md
deleted file mode 100644
index 4d4db1b01..000000000
--- a/docs/content/reference/routing-configuration/kubernetes/crd/tcp/tlsoption.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: "TLSOption"
-description: "TLS Options in Traefik Proxy"
----
-
---8<-- "content/reference/routing-configuration/kubernetes/crd/http/tlsoption.md"
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/tcp/tlsstore.md b/docs/content/reference/routing-configuration/kubernetes/crd/tcp/tlsstore.md
deleted file mode 100644
index 27c98164a..000000000
--- a/docs/content/reference/routing-configuration/kubernetes/crd/tcp/tlsstore.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: "TLSStore"
-description: "TLS Store in Traefik Proxy"
----
-
---8<-- "content/reference/routing-configuration/kubernetes/crd/http/tlsstore.md"
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/http/tlsoption.md b/docs/content/reference/routing-configuration/kubernetes/crd/tls/tlsoption.md
similarity index 53%
rename from docs/content/reference/routing-configuration/kubernetes/crd/http/tlsoption.md
rename to docs/content/reference/routing-configuration/kubernetes/crd/tls/tlsoption.md
index 6887e8516..8ff6515dc 100644
--- a/docs/content/reference/routing-configuration/kubernetes/crd/http/tlsoption.md
+++ b/docs/content/reference/routing-configuration/kubernetes/crd/tls/tlsoption.md
@@ -48,19 +48,19 @@ spec:
| Field | Description | Default | Required |
|:----------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------------|:---------|
-| `minVersion` | Minimum TLS version that is acceptable. | "VersionTLS12" | No |
-| `maxVersion` | Maximum TLS version that is acceptable.
We do not recommend setting this option to disable TLS 1.3. | | No |
-| `cipherSuites` | List of supported [cipher suites](https://godoc.org/crypto/tls#pkg-constants) for TLS versions up to TLS 1.2.
[Cipher suites defined for TLS 1.2 and below cannot be used in TLS 1.3, and vice versa.](https://tools.ietf.org/html/rfc8446)
With TLS 1.3, [the cipher suites are not configurable](https://golang.org/doc/go1.12#tls_1_3) (all supported cipher suites are safe in this case). | | No |
-| `curvePreferences` | List of the elliptic curves references that will be used in an ECDHE handshake, in preference order.
Use curves names from [`crypto`](https://godoc.org/crypto/tls#CurveID) or the [RFC](https://tools.ietf.org/html/rfc8446#section-4.2.7).
See [CurveID](https://godoc.org/crypto/tls#CurveID) for more information. | | No |
-| `clientAuth.secretNames` | Client Authentication (mTLS) option.
List of names of the referenced Kubernetes [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) (in TLSOption namespace).
The secret must contain a certificate under either a `tls.ca` or a `ca.crt` key. | | No |
-| `clientAuth.clientAuthType` | Client Authentication (mTLS) option.
Client authentication type to apply. Available values [here](#client-authentication-mtls). | | No |
-| `sniStrict` | Allow rejecting connections from clients connections that do not specify a server_name extension.
The [default certificate](../../../http/tls/tls-certificates.md#default-certificate) is never served is the option is enabled. | false | No |
-| `alpnProtocols` | List of supported application level protocols for the TLS handshake, in order of preference.
If the client supports ALPN, the selected protocol will be one from this list, and the connection will fail if there is no mutually supported protocol. | "h2, http/1.1, acme-tls/1" | No |
-| `disableSessiontTickets` | Allow disabling the use of session tickets, forcing every client to perform a full TLS handshake instead of resuming sessions. | false | No |
+| `minVersion` | Minimum TLS version that is acceptable. | "VersionTLS12" | No |
+| `maxVersion` | Maximum TLS version that is acceptable.
We do not recommend setting this option to disable TLS 1.3. | | No |
+| `cipherSuites` | List of supported [cipher suites](https://godoc.org/crypto/tls#pkg-constants) for TLS versions up to TLS 1.2.
[Cipher suites defined for TLS 1.2 and below cannot be used in TLS 1.3, and vice versa.](https://tools.ietf.org/html/rfc8446)
With TLS 1.3, [the cipher suites are not configurable](https://golang.org/doc/go1.12#tls_1_3) (all supported cipher suites are safe in this case). | | No |
+| `curvePreferences` | List of the elliptic curves references that will be used in an ECDHE handshake.
Use curves names from [`crypto`](https://godoc.org/crypto/tls#CurveID) or the [RFC](https://tools.ietf.org/html/rfc8446#section-4.2.7).
See [CurveID](https://godoc.org/crypto/tls#CurveID) for more information. | | No |
+| `clientAuth.secretNames` | Client Authentication (mTLS) option.
List of names of the referenced Kubernetes [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) (in TLSOption namespace).
The secret must contain a certificate under either a `tls.ca` or a `ca.crt` key. | | No |
+| `clientAuth.clientAuthType` | Client Authentication (mTLS) option.
Client authentication type to apply. Available values [here](#client-authentication-mtls). | | No |
+| `sniStrict` | Allow rejecting connections from clients connections that do not specify a server_name extension.
The [default certificate](../../../http/tls/tls-certificates.md#default-certificate) is never served is the option is enabled. | false | No |
+| `alpnProtocols` | List of supported application level protocols for the TLS handshake, in order of preference.
If the client supports ALPN, the selected protocol will be one from this list, and the connection will fail if there is no mutually supported protocol. | "h2, http/1.1, acme-tls/1" | No |
+| `disableSessiontTickets` | Allow disabling the use of session tickets, forcing every client to perform a full TLS handshake instead of resuming sessions. | false | No |
### Client Authentication (mTLS)
-The `clientAuth.clientAuthType` option governs the behaviour as follows:
+The `clientAuth.clientAuthType` option governs the behavior as follows:
- `NoClientCert`: disregards any client certificate.
- `RequestClientCert`: asks for a certificate but proceeds anyway if none is provided.
@@ -78,6 +78,6 @@ The default behavior is summed up in the table below:
| Configuration | Behavior |
|:--------------------------|:------------------------------------------------------------|
-| No `default` TLS Option | Default internal set of TLS Options by default. |
-| One `default` TLS Option | Custom TLS Options applied by default. |
-| Many `default` TLS Option | Error log + Default internal set of TLS Options by default. |
+| No `default` TLS Option | Default internal set of TLS Options by default. |
+| One `default` TLS Option | Custom TLS Options applied by default. |
+| Many `default` TLS Option | Error log + Default internal set of TLS Options by default. |
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/tls/tlsstore.md b/docs/content/reference/routing-configuration/kubernetes/crd/tls/tlsstore.md
new file mode 100644
index 000000000..f4c99c805
--- /dev/null
+++ b/docs/content/reference/routing-configuration/kubernetes/crd/tls/tlsstore.md
@@ -0,0 +1,39 @@
+---
+title: "TLSStore"
+description: "TLS Store in Traefik Proxy"
+---
+
+In Traefik, certificates are grouped together in certificates stores.
+
+`TLSStore` is the CRD implementation of a [Traefik TLS Store](../../../http/tls/tls-certificates.md#certificates-stores).
+
+Before creating `TLSStore` objects, you need to apply the [Traefik Kubernetes CRDs](https://doc.traefik.io/traefik/reference/dynamic-configuration/kubernetes-crd/#definitions) to your Kubernetes cluster.
+
+!!! Tip "Default TLS Store"
+ Traefik currently only uses the TLS Store named "default". This default `TLSStore` should be in a namespace discoverable by Traefik. Since it is used by default on `IngressRoute` and `IngressRouteTCP` objects, there never is a need to actually reference it. This means that you cannot have two stores that are named default in different Kubernetes namespaces. As a consequence, with respect to TLS stores, the only change that makes sense (and only if needed) is to configure the default `TLSStore`.
+
+## Configuration Example
+
+```yaml tab="TLSStore"
+apiVersion: traefik.io/v1alpha1
+kind: TLSStore
+metadata:
+ name: default
+
+spec:
+ defaultCertificate:
+ secretName: supersecret
+```
+
+## Configuration Options
+
+| Field | Description | Required |
+|:---------------------------------------|:-------------------------|:---------|
+| `certificates[n].secretName` | List of Kubernetes [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/), each of them holding a key/certificate pair to add to the store. | No |
+| `defaultCertificate.secretName` | Name of the Kubernetes [Secret](https://kubernetes.io/docs/concepts/configuration/secret/) served for connections without a SNI, or without a matching domain. If no default certificate is provided, Traefik will use the generated one. Do not use if the option `defaultGeneratedCert` is set. | No |
+| `defaultGeneratedCert.resolver` | Name of the ACME resolver to use to generate the default certificate.
Do not use if the option `defaultCertificate` is set. | No |
+| `defaultGeneratedCert.domain.main` | Main domain used to generate the default certificate.
Do not use if the option `defaultCertificate` is set. | No |
+| `defaultGeneratedCert.domain.sans` | List of [Subject Alternative Name](https://en.wikipedia.org/wiki/Subject_Alternative_Name) used to generate the default certificate.
Do not use if the option `defaultCertificate` is set. | No |
+
+!!! note "DefaultCertificate vs DefaultGeneratedCert"
+ If both `defaultCertificate` and `defaultGeneratedCert` are set, the TLS certificate contained in `defaultCertificate.secretName` is served. The ACME default certificate is not generated.
diff --git a/docs/content/reference/routing-configuration/kubernetes/crd/udp/ingressrouteudp.md b/docs/content/reference/routing-configuration/kubernetes/crd/udp/ingressrouteudp.md
index 3dfdc1367..eadfd1773 100644
--- a/docs/content/reference/routing-configuration/kubernetes/crd/udp/ingressrouteudp.md
+++ b/docs/content/reference/routing-configuration/kubernetes/crd/udp/ingressrouteudp.md
@@ -3,7 +3,7 @@ title: "IngressRouteUDP"
description: "Understand the routing configuration for the Kubernetes IngressRouteUDP & Traefik CRD"
---
-`IngressRouteUDP` is the CRD implementation of a [Traefik UDP router](../../../udp/router/rules-priority.md).
+`IngressRouteUDP` is the CRD implementation of a [Traefik UDP router](../../../udp/routing/rules-priority.md).
Before creating `IngressRouteUDP` objects, you need to apply the [Traefik Kubernetes CRDs](https://doc.traefik.io/traefik/reference/dynamic-configuration/kubernetes-crd/#definitions) to your Kubernetes cluster.
@@ -32,14 +32,14 @@ spec:
| Field | Description | Default | Required |
|------------------------------------|-----------------------------|-------------------------------------------|-----------------------|
-| `entryPoints` | List of entrypoints names. | | No |
-| ` routes ` | List of routes. | | Yes |
-| `routes[n].services` | List of [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) definitions. See [here](#externalname-service) for `ExternalName Service` setup. | | No |
-| `services[n].name` | Defines the name of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). | | Yes |
-| `routes[n].services[n].port` | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). This can be a reference to a named port.| | Yes |
-| `routes[n].services[n].weight` | Defines the weight to apply to the server load balancing. | 1 | No |
-| `routes[n].services[n].nativeLB` | Controls, when creating the load-balancer, whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. | false | No |
-| `routes[n].services[n].nodePortLB` | Controls, when creating the load-balancer, whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. See [here](#nativelb) for more information. | false | No |
+| `entryPoints` | List of entrypoints names. | | No |
+| ` routes ` | List of routes. | | Yes |
+| `routes[n].services` | List of [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) definitions. See [here](#externalname-service) for `ExternalName Service` setup. | | No |
+| `services[n].name` | Defines the name of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). | | Yes |
+| `routes[n].services[n].port` | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). This can be a reference to a named port.| | Yes |
+| `routes[n].services[n].weight` | Defines the weight to apply to the server load balancing. | 1 | No |
+| `routes[n].services[n].nativeLB` | Controls, when creating the load-balancer, whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. | false | No |
+| `routes[n].services[n].nodePortLB` | Controls, when creating the load-balancer, whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. See [here](#nativelb) for more information. | false | No |
### ExternalName Service
diff --git a/docs/content/reference/routing-configuration/kubernetes/gateway-api.md b/docs/content/reference/routing-configuration/kubernetes/gateway-api.md
index 19128303c..a25e147c4 100644
--- a/docs/content/reference/routing-configuration/kubernetes/gateway-api.md
+++ b/docs/content/reference/routing-configuration/kubernetes/gateway-api.md
@@ -748,7 +748,6 @@ By default, NativeLB is `false`.
Note that it is possible to override the default value by using the option [`nativeLBByDefault`](../../install-configuration/providers/kubernetes/kubernetes-gateway.md) at the provider level.
```yaml
----
apiVersion: v1
kind: Service
metadata:
@@ -757,7 +756,10 @@ metadata:
annotations:
traefik.io/service.nativelb: "true"
spec:
-[...]
+ ports:
+ - name: web
+ port: 80
+
```
{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md b/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md
new file mode 100644
index 000000000..af98d1b2b
--- /dev/null
+++ b/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md
@@ -0,0 +1,402 @@
+---
+title: "Traefik Kubernetes Ingress NGINX Routing Configuration"
+description: "Understand the routing configuration for the Kubernetes Ingress NGINX Controller and Traefik Proxy. Read the technical documentation."
+---
+
+# Traefik & Ingresses with NGINX Annotations
+
+The experimental Kubernetes Controller for Ingresses with NGINX annotations.
+{: .subtitle }
+
+!!! warning "Ingress Discovery"
+
+ The Kubernetes Ingress NGINX provider is discovering by default all Ingresses in the cluster,
+ which may lead to duplicated routers if you are also using the Kubernetes Ingress provider.
+ We recommend to use IngressClass for the Ingresses you want to be handled by this provider,
+ or to use the `watchNamespace` or `watchNamespaceSelector` options to limit the discovery of Ingresses to a specific namespace or set of namespaces.
+
+## Routing Configuration
+
+The Kubernetes Ingress NGINX provider watches for incoming ingresses events, such as the example below,
+and derives the corresponding dynamic configuration from it,
+which in turn will create the resulting routers, services, handlers, etc.
+
+## Configuration Example
+
+??? example "Configuring Kubernetes Ingress NGINX Controller"
+
+ ```yaml tab="RBAC"
+ ---
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+ name: traefik-ingress-controller
+ rules:
+ - apiGroups:
+ - ""
+ resources:
+ - namespaces
+ verbs:
+ - get
+ - apiGroups:
+ - ""
+ resources:
+ - configmaps
+ - pods
+ - secrets
+ - endpoints
+ verbs:
+ - get
+ - list
+ - watch
+ - apiGroups:
+ - ""
+ resources:
+ - services
+ verbs:
+ - get
+ - list
+ - watch
+ - apiGroups:
+ - networking.k8s.io
+ resources:
+ - ingresses
+ verbs:
+ - get
+ - list
+ - watch
+ - apiGroups:
+ - networking.k8s.io
+ resources:
+ - ingresses/status
+ verbs:
+ - update
+ - apiGroups:
+ - networking.k8s.io
+ resources:
+ - ingressclasses
+ verbs:
+ - get
+ - list
+ - watch
+ - apiGroups:
+ - ""
+ resources:
+ - events
+ verbs:
+ - create
+ - patch
+ - apiGroups:
+ - discovery.k8s.io
+ resources:
+ - endpointslices
+ verbs:
+ - list
+ - watch
+ - get
+
+ ---
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRoleBinding
+ metadata:
+ name: traefik-ingress-controller
+ roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: traefik-ingress-controller
+ subjects:
+ - kind: ServiceAccount
+ name: traefik-ingress-controller
+ namespace: default
+ ```
+
+ ```yaml tab="Traefik"
+ ---
+ apiVersion: v1
+ kind: ServiceAccount
+ metadata:
+ name: traefik-ingress-controller
+
+ ---
+ apiVersion: apps/v1
+ kind: Deployment
+ metadata:
+ name: traefik
+ labels:
+ app: traefik
+
+ spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: traefik
+ template:
+ metadata:
+ labels:
+ app: traefik
+ spec:
+ serviceAccountName: traefik-ingress-controller
+ containers:
+ - name: traefik
+ image: traefik:v3.5
+ args:
+ - --entryPoints.web.address=:80
+ - --providers.kubernetesingressnginx
+ ports:
+ - name: web
+ containerPort: 80
+
+ ---
+ apiVersion: v1
+ kind: Service
+ metadata:
+ name: traefik
+ spec:
+ type: LoadBalancer
+ selector:
+ app: traefik
+ ports:
+ - name: web
+ port: 80
+ targetPort: 80
+ ```
+
+ ```yaml tab="Whoami"
+ ---
+ apiVersion: apps/v1
+ kind: Deployment
+ metadata:
+ name: whoami
+ labels:
+ app: whoami
+
+ spec:
+ replicas: 2
+ selector:
+ matchLabels:
+ app: whoami
+ template:
+ metadata:
+ labels:
+ app: whoami
+ spec:
+ containers:
+ - name: whoami
+ image: traefik/whoami
+ ports:
+ - containerPort: 80
+
+ ---
+ apiVersion: v1
+ kind: Service
+ metadata:
+ name: whoami
+
+ spec:
+ selector:
+ app: whoami
+ ports:
+ - name: http
+ port: 80
+ ```
+
+ ```yaml tab="Ingress"
+ ---
+ apiVersion: networking.k8s.io/v1
+ kind: IngressClass
+ metadata:
+ name: nginx
+ spec:
+ controller: k8s.io/ingress-nginx
+
+ ---
+ apiVersion: networking.k8s.io/v1
+ kind: Ingress
+ metadata:
+ name: myingress
+
+ spec:
+ ingressClassName: nginx
+ rules:
+ - host: whoami.localhost
+ http:
+ paths:
+ - path: /bar
+ pathType: Exact
+ backend:
+ service:
+ name: whoami
+ port:
+ number: 80
+ - path: /foo
+ pathType: Exact
+ backend:
+ service:
+ name: whoami
+ port:
+ number: 80
+ ```
+
+## Annotations Support
+
+This section lists all known NGINX Ingress annotations, split between those currently implemented (with limitations if any) and those not implemented.
+Limitations or behavioral differences are indicated where relevant.
+
+!!! warning "Global configuration"
+
+ Traefik does not expose all global configuration options to control default behaviors for ingresses.
+
+ Some behaviors that are globally configurable in NGINX (such as default SSL redirect, rate limiting, or affinity) are currently not supported and cannot be overridden per-ingress as in NGINX.
+
+### Caveats and Key Behavioral Differences
+
+- **Authentication**: Forward auth behaves differently and session caching is not supported. NGINX supports sub-request based auth, while Traefik forwards the original request.
+- **Session Affinity**: Only persistent mode is supported.
+- **Leader Election**: Not supported; no cluster mode with leader election.
+- **Default Backend**: Only `defaultBackend` in Ingress spec is supported; the annotation is ignored.
+- **Load Balancing**: Only round_robin is supported; EWMA and IP hash are not supported.
+- **CORS**: NGINX responds with all configured headers unconditionally; Traefik handles headers differently between pre-flight and regular requests.
+- **TLS/Backend Protocols**: AUTO_HTTP, FCGI and some TLS options are not supported in Traefik.
+- **Path Handling**: Traefik preserves trailing slashes by default; NGINX removes them unless configured otherwise.
+
+### Supported NGINX Annotations
+
+| Annotation | Limitations / Notes |
+|-------------------------------------------------------|--------------------------------------------------------------------------------------------|
+| `nginx.ingress.kubernetes.io/affinity` | |
+| `nginx.ingress.kubernetes.io/affinity-mode` | Only persistent mode supported; balanced/canary not supported. |
+| `nginx.ingress.kubernetes.io/auth-type` | |
+| `nginx.ingress.kubernetes.io/auth-secret` | |
+| `nginx.ingress.kubernetes.io/auth-secret-type` | |
+| `nginx.ingress.kubernetes.io/auth-realm` | |
+| `nginx.ingress.kubernetes.io/auth-url` | Only URL and response headers copy supported. Forward auth behaves differently than NGINX. |
+| `nginx.ingress.kubernetes.io/auth-method` | |
+| | |
+| `nginx.ingress.kubernetes.io/ssl-redirect` | Cannot opt-out per route if enabled globally. |
+| `nginx.ingress.kubernetes.io/force-ssl-redirect` | Cannot opt-out per route if enabled globally. |
+| `nginx.ingress.kubernetes.io/ssl-passthrough` | Some differences in SNI/default backend handling. |
+| `nginx.ingress.kubernetes.io/use-regex` | |
+| `nginx.ingress.kubernetes.io/session-cookie-name` | |
+| `nginx.ingress.kubernetes.io/session-cookie-path` | |
+| `nginx.ingress.kubernetes.io/session-cookie-domain` | |
+| `nginx.ingress.kubernetes.io/session-cookie-samesite` | |
+| `nginx.ingress.kubernetes.io/load-balance` | Only round_robin supported; ewma and IP hash not supported. |
+| `nginx.ingress.kubernetes.io/backend-protocol` | FCGI and AUTO_HTTP not supported. |
+| `nginx.ingress.kubernetes.io/enable-cors` | Partial support. |
+| `nginx.ingress.kubernetes.io/cors-allow-credentials` | |
+| | |
+| `nginx.ingress.kubernetes.io/cors-allow-methods` | |
+| `nginx.ingress.kubernetes.io/cors-allow-origin` | |
+| `nginx.ingress.kubernetes.io/cors-max-age` | |
+| `nginx.ingress.kubernetes.io/proxy-ssl-server-name` | |
+| `nginx.ingress.kubernetes.io/proxy-ssl-name` | |
+| `nginx.ingress.kubernetes.io/proxy-ssl-verify` | |
+| `nginx.ingress.kubernetes.io/proxy-ssl-secret` | |
+| `nginx.ingress.kubernetes.io/service-upstream` | |
+
+### Unsupported NGINX Annotations
+
+!!! question "Want to Add Support for More Annotations?"
+
+ You can help extend support in two ways:
+
+ - [**Open a PR**](../../../contributing/submitting-pull-requests.md) with the new annotation support.
+ - **Reach out** to the [Traefik Labs support team](https://info.traefik.io/request-commercial-support?cta=doc).
+
+ All contributions and suggestions are welcome — let's build this together!
+
+
+| Annotation | Notes |
+|-----------------------------------------------------------------------------|------------------------------------------------------|
+| `nginx.ingress.kubernetes.io/app-root` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/affinity-canary-behavior` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/auth-tls-secret` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/auth-tls-verify-depth` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/auth-tls-verify-client` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/auth-tls-error-page` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/auth-tls-match-cn` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/auth-cache-key` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/auth-cache-duration` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/auth-keepalive` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/auth-keepalive-share-vars` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/auth-keepalive-requests` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/auth-keepalive-timeout` | Not supported yet. |
+| | Not supported yet. |
+| `nginx.ingress.kubernetes.io/auth-snippet` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/enable-global-auth` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/canary` | Not supported yet. |
+| | Not supported yet. |
+| | Not supported yet. |
+| | Not supported yet. |
+| `nginx.ingress.kubernetes.io/canary-by-cookie` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/canary-weight` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/canary-weight-total` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/client-body-buffer-size` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/configuration-snippet` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/custom-http-errors` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/disable-proxy-intercept-errors` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/default-backend` | Not supported yet; use `defaultBackend` in Ingress spec. |
+| `nginx.ingress.kubernetes.io/limit-rate-after` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/limit-rate` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/limit-whitelist` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/limit-rps` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/limit-rpm` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/limit-burst-multiplier` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/limit-connections` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/global-rate-limit` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/global-rate-limit-window` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/global-rate-limit-key` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/global-rate-limit-ignored-cidrs` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/permanent-redirect` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/permanent-redirect-code` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/temporal-redirect` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/preserve-trailing-slash` | Not supported yet; Traefik preserves by default. |
+| `nginx.ingress.kubernetes.io/proxy-cookie-domain` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-cookie-path` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-connect-timeout` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-send-timeout` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-read-timeout` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-next-upstream` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-next-upstream-timeout` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-next-upstream-tries` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-request-buffering` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-redirect-from` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-redirect-to` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-http-version` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-ssl-ciphers` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-ssl-verify-depth` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-ssl-protocols` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/enable-rewrite-log` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/rewrite-target` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/satisfy` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/server-alias` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/server-snippet` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/session-cookie-conditional-samesite-none` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/session-cookie-expires` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/session-cookie-change-on-failure` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/ssl-ciphers` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/ssl-prefer-server-ciphers` | Not supported yet. |
+| | Not supported yet. |
+| `nginx.ingress.kubernetes.io/enable-access-log` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/enable-opentracing` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/opentracing-trust-incoming-span` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/enable-opentelemetry` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/opentelemetry-trust-incoming-span` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/enable-modsecurity` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/enable-owasp-core-rules` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/modsecurity-transaction-id` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/modsecurity-snippet` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/mirror-request-body` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/mirror-target` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/mirror-host` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/x-forwarded-prefix` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/upstream-hash-by` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/upstream-vhost` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/denylist-source-range` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/whitelist-source-range` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-buffering` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-buffers-number` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-buffer-size` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/proxy-max-temp-file-size` | Not supported yet. |
+| `nginx.ingress.kubernetes.io/stream-snippet` | Not supported yet. |
diff --git a/docs/content/reference/routing-configuration/kubernetes/ingress.md b/docs/content/reference/routing-configuration/kubernetes/ingress.md
index f0dba8651..a9b0aab71 100644
--- a/docs/content/reference/routing-configuration/kubernetes/ingress.md
+++ b/docs/content/reference/routing-configuration/kubernetes/ingress.md
@@ -69,7 +69,7 @@ spec:
??? info "`traefik.ingress.kubernetes.io/router.priority`"
- See [priority](../http/router/rules-and-priority.md#priority-calculation) for more information.
+ See [priority](../http/routing/rules-and-priority.md#priority-calculation) for more information.
```yaml
traefik.ingress.kubernetes.io/router.priority: "42"
@@ -82,7 +82,7 @@ spec:
RuleSyntax option is deprecated and will be removed in the next major version.
Please do not use this field and rewrite the router rules to use the v3 syntax.
- See [rule syntax](../http/router/rules-and-priority.md#rulesyntax) for more information.
+ See [rule syntax](../http/routing/rules-and-priority.md#rulesyntax) for more information.
```yaml
traefik.ingress.kubernetes.io/router.rulesyntax: "v2"
@@ -133,7 +133,7 @@ spec:
??? info "`traefik.ingress.kubernetes.io/router.tls.options`"
- See [options](../kubernetes/crd/http/tlsoption.md) for more information.
+ See [options](../kubernetes/crd/tls/tlsoption.md) for more information.
```yaml
traefik.ingress.kubernetes.io/router.tls.options: foobar@file
@@ -141,7 +141,7 @@ spec:
??? info "`traefik.ingress.kubernetes.io/router.observability.accesslogs`"
- See [here](../http/router/observability.md) for more information.
+ See [here](../http/routing/observability.md) for more information.
```yaml
traefik.ingress.kubernetes.io/router.observability.accesslogs: true
@@ -149,7 +149,7 @@ spec:
??? info "`traefik.ingress.kubernetes.io/router.observability.metrics`"
- See [here](../http/router/observability.md) for more information.
+ See [here](../http/routing/observability.md) for more information.
```yaml
traefik.ingress.kubernetes.io/router.observability.metrics: true
@@ -157,7 +157,7 @@ spec:
??? info "`traefik.ingress.kubernetes.io/router.observability.tracing`"
- See [here](../http/router/observability.md) for more information.
+ See [here](../http/routing/observability.md) for more information.
```yaml
traefik.ingress.kubernetes.io/router.observability.tracing: true
@@ -402,7 +402,7 @@ This way, any Ingress attached to this Entrypoint will have TLS termination by d
serviceAccountName: traefik-ingress-controller
containers:
- name: traefik
- image: traefik:v3.4
+ image: traefik:v3.5
args:
- --entryPoints.websecure.address=:443
- --entryPoints.websecure.http.tls
@@ -589,7 +589,7 @@ and will connect via TLS automatically.
Please note that by enabling TLS communication between traefik and your pods,
you will have to have trusted certificates that have the proper trust chain and IP subject name.
If this is not an option, you may need to skip TLS certificate verification.
- See the [`insecureSkipVerify` TLSOption](../kubernetes/crd/http/tlsoption.md) setting for more details.
+ See the [`insecureSkipVerify` TLSOption](../kubernetes/crd/tls/tlsoption.md) setting for more details.
## Global Default Backend Ingresses
diff --git a/docs/content/reference/routing-configuration/other-providers/consul-catalog.md b/docs/content/reference/routing-configuration/other-providers/consul-catalog.md
index 534891cf3..7958a4c01 100644
--- a/docs/content/reference/routing-configuration/other-providers/consul-catalog.md
+++ b/docs/content/reference/routing-configuration/other-providers/consul-catalog.md
@@ -25,7 +25,7 @@ With Consul Catalog, Traefik can leverage tags attached to a service to generate
### General
-Traefik creates, for each consul Catalog service, a corresponding [service](../http/load-balancing/service.md) and [router](../http/router/rules-and-priority.md).
+Traefik creates, for each consul Catalog service, a corresponding [service](../http/load-balancing/service.md) and [router](../http/routing/rules-and-priority.md).
The Service automatically gets a server per instance in this consul Catalog service, and the router gets a default rule attached to it, based on the service name.
@@ -37,7 +37,7 @@ For example, to change the rule, you could add the tag ```traefik.http.routers.m
??? info "`traefik.http.routers..rule`"
- See [rule](../http/router/rules-and-priority.md) for more information.
+ See [rule](../http/routing/rules-and-priority.md) for more information.
```yaml
traefik.http.routers.myrouter.rule=Host(`example.com`)
@@ -50,7 +50,7 @@ For example, to change the rule, you could add the tag ```traefik.http.routers.m
RuleSyntax option is deprecated and will be removed in the next major version.
Please do not use this field and rewrite the router rules to use the v3 syntax.
- See [ruleSyntax](../http/router/rules-and-priority.md#rulesyntax) for more information.
+ See [ruleSyntax](../http/routing/rules-and-priority.md#rulesyntax) for more information.
```yaml
traefik.http.routers.myrouter.ruleSyntax=v3
@@ -58,7 +58,7 @@ For example, to change the rule, you could add the tag ```traefik.http.routers.m
??? info "`traefik.http.routers..priority`"
- See [priority](../http/router/rules-and-priority.md#priority-calculation) for more information.
+ See [priority](../http/routing/rules-and-priority.md#priority-calculation) for more information.
```yaml
- "traefik.tcp.routers.mytcprouter.priority=42"
@@ -222,6 +222,14 @@ you'd add the tag `traefik.http.services.{name-of-your-choice}.loadbalancer.pass
traefik.http.services.myservice.loadbalancer.healthcheck.interval=10
```
+??? info "`traefik.http.services..loadbalancer.healthcheck.unhealthyinterval`"
+
+ See [health check](../http/load-balancing/service.md#health-check) for more information.
+
+ ```yaml
+ traefik.http.services.myservice.loadbalancer.healthcheck.unhealthyinterval=10
+ ```
+
??? info "`traefik.http.services..loadbalancer.healthcheck.path`"
See [health check](../http/load-balancing/service.md#health-check) for more information.
@@ -377,7 +385,7 @@ You can declare TCP Routers, Middlewares and/or Services using tags.
??? info "`traefik.tcp.routers..rule`"
- See [rule](../tcp/router/rules-and-priority.md#rules) for more information.
+ See [rule](../tcp/routing/rules-and-priority.md#rules) for more information.
```yaml
traefik.tcp.routers.mytcprouter.rule=HostSNI(`example.com`)
@@ -397,7 +405,7 @@ You can declare TCP Routers, Middlewares and/or Services using tags.
```
??? info "`traefik.tcp.routers..priority`"
- See [priority](../tcp/router/rules-and-priority.md#priority) for more information.
+ See [priority](../tcp/routing/rules-and-priority.md#priority-calculation) for more information.
```yaml
- "traefik.tcp.routers.mytcprouter.priority=42"
```
@@ -452,7 +460,7 @@ You can declare TCP Routers, Middlewares and/or Services using tags.
??? info "`traefik.tcp.routers..tls.passthrough`"
- See [Passthrough](../tcp/tls.md#passthrough) for more information.
+ See [Passthrough](../tcp/tls.md#opt-passthrough) for more information.
```yaml
traefik.tcp.routers.mytcprouter.tls.passthrough=true
@@ -477,14 +485,6 @@ You can declare TCP Routers, Middlewares and/or Services using tags.
traefik.tcp.services.mytcpservice.loadbalancer.server.tls=true
```
-??? info "`traefik.tcp.services..loadbalancer.proxyprotocol.version`"
-
- See [PROXY protocol](../tcp/service.md#proxy-protocol) for more information.
-
- ```yaml
- traefik.tcp.services.mytcpservice.loadbalancer.proxyprotocol.version=1
- ```
-
??? info "`traefik.tcp.services..loadbalancer.serverstransport`"
Allows to reference a ServersTransport resource that is defined either with the File provider or the Kubernetes CRD one.
diff --git a/docs/content/reference/routing-configuration/other-providers/docker.md b/docs/content/reference/routing-configuration/other-providers/docker.md
index e17c9fc91..a6773b190 100644
--- a/docs/content/reference/routing-configuration/other-providers/docker.md
+++ b/docs/content/reference/routing-configuration/other-providers/docker.md
@@ -35,7 +35,6 @@ With Docker, Traefik can leverage labels attached to a container to generate rou
Attaching labels to containers (in your docker compose file)
```yaml
- version: "3"
services:
my-container:
# ...
@@ -48,7 +47,6 @@ With Docker, Traefik can leverage labels attached to a container to generate rou
Forward requests for `http://example.com` to `http://:12345`:
```yaml
- version: "3"
services:
my-container:
# ...
@@ -71,7 +69,6 @@ With Docker, Traefik can leverage labels attached to a container to generate rou
In this example, requests are forwarded for `http://example-a.com` to `http://:8000` in addition to `http://example-b.com` forwarding to `http://:9000`:
```yaml
- version: "3"
services:
my-container:
# ...
@@ -96,7 +93,7 @@ With Docker, Traefik can leverage labels attached to a container to generate rou
### General
-Traefik creates, for each container, a corresponding [service](../http/load-balancing/service.md) and [router](../http/router/rules-and-priority.md).
+Traefik creates, for each container, a corresponding [service](../http/load-balancing/service.md) and [router](../http/routing/rules-and-priority.md).
The Service automatically gets a server per instance of the container,
and the router automatically gets a rule defined by `defaultRule` (if no rule for it was defined in labels).
@@ -150,7 +147,7 @@ For example, to change the rule, you could add the label ```traefik.http.routers
??? info "`traefik.http.routers..rule`"
- See [rule](../http/router/rules-and-priority.md) for more information.
+ See [rule](../http/routing/rules-and-priority.md) for more information.
```yaml
"traefik.http.routers.myrouter.rule=Host(`example.com`)"
@@ -163,7 +160,7 @@ For example, to change the rule, you could add the label ```traefik.http.routers
RuleSyntax option is deprecated and will be removed in the next major version.
Please do not use this field and rewrite the router rules to use the v3 syntax.
- See [ruleSyntax](../http/router/rules-and-priority.md#rulesyntax) for more information.
+ See [ruleSyntax](../http/routing/rules-and-priority.md#rulesyntax) for more information.
```yaml
traefik.http.routers.myrouter.ruleSyntax=v3
@@ -255,7 +252,7 @@ For example, to change the rule, you could add the label ```traefik.http.routers
??? info "`traefik.http.routers..priority`"
- See [priority](../http/router/rules-and-priority.md#priority-calculation) for more information.
+ See [priority](../http/routing/rules-and-priority.md#priority-calculation) for more information.
```yaml
"traefik.http.routers.myrouter.priority=42"
@@ -327,6 +324,14 @@ you'd add the label `traefik.http.services..loadbalancer.pa
"traefik.http.services.myservice.loadbalancer.healthcheck.interval=10s"
```
+??? info "`traefik.http.services..loadbalancer.healthcheck.unhealthyinterval`"
+
+ See [health check](../http/load-balancing/service.md#health-check) for more information.
+
+ ```yaml
+ "traefik.http.services.myservice.loadbalancer.healthcheck.unhealthyinterval=10s"
+ ```
+
??? info "`traefik.http.services..loadbalancer.healthcheck.path`"
See [health check](../http/load-balancing/service.md#health-check) for more information.
@@ -493,7 +498,7 @@ You can declare TCP Routers and/or Services using labels.
??? info "`traefik.tcp.routers..rule`"
- See [rule](../tcp/router/rules-and-priority.md#rules) for more information.
+ See [rule](../tcp/routing/rules-and-priority.md#rules) for more information.
```yaml
"traefik.tcp.routers.mytcprouter.rule=HostSNI(`example.com`)"
@@ -560,7 +565,7 @@ You can declare TCP Routers and/or Services using labels.
??? info "`traefik.tcp.routers..tls.passthrough`"
- See [TLS](../tcp/tls.md#passthrough) for more information.
+ See [TLS](../tcp/tls.md#opt-passthrough) for more information.
```yaml
"traefik.tcp.routers.mytcprouter.tls.passthrough=true"
@@ -568,7 +573,7 @@ You can declare TCP Routers and/or Services using labels.
??? info "`traefik.tcp.routers..priority`"
- See [priority](../tcp/router/rules-and-priority.md) for more information.
+ See [priority](../tcp/routing/rules-and-priority.md) for more information.
```yaml
"traefik.tcp.routers.mytcprouter.priority=42"
@@ -592,14 +597,6 @@ You can declare TCP Routers and/or Services using labels.
"traefik.tcp.services.mytcpservice.loadbalancer.server.tls=true"
```
-??? info "`traefik.tcp.services..loadbalancer.proxyprotocol.version`"
-
- See [PROXY protocol](../tcp/service.md#proxy-protocol) for more information.
-
- ```yaml
- "traefik.tcp.services.mytcpservice.loadbalancer.proxyprotocol.version=1"
- ```
-
??? info "`traefik.tcp.services..loadbalancer.serverstransport`"
Allows to reference a ServersTransport resource that is defined either with the File provider or the Kubernetes CRD one.
diff --git a/docs/content/reference/routing-configuration/other-providers/ecs.md b/docs/content/reference/routing-configuration/other-providers/ecs.md
index b17d9330a..03b4f4d45 100644
--- a/docs/content/reference/routing-configuration/other-providers/ecs.md
+++ b/docs/content/reference/routing-configuration/other-providers/ecs.md
@@ -25,7 +25,7 @@ With ECS, Traefik can leverage labels attached to a container to generate routin
### General
-Traefik creates, for each elastic service, a corresponding [service](../http/load-balancing/service.md) and [router](../http/router/rules-and-priority.md).
+Traefik creates, for each elastic service, a corresponding [service](../http/load-balancing/service.md) and [router](../http/routing/rules-and-priority.md).
The Service automatically gets a server per elastic container, and the router gets a default rule attached to it, based on the service name.
@@ -39,7 +39,7 @@ For example, to change the rule, you could add the label ```traefik.http.routers
??? info "`traefik.http.routers..rule`"
- See [rule](../http/router/rules-and-priority.md#rules) for more information.
+ See [rule](../http/routing/rules-and-priority.md#rules) for more information.
```yaml
traefik.http.routers.myrouter.rule=Host(`example.com`)
@@ -52,7 +52,7 @@ For example, to change the rule, you could add the label ```traefik.http.routers
RuleSyntax option is deprecated and will be removed in the next major version.
Please do not use this field and rewrite the router rules to use the v3 syntax.
- See [ruleSyntax](../http/router/rules-and-priority.md#rulesyntax) for more information.
+ See [ruleSyntax](../http/routing/rules-and-priority.md#rulesyntax) for more information.
```yaml
traefik.http.routers.myrouter.ruleSyntax=v3
@@ -146,7 +146,7 @@ For example, to change the rule, you could add the label ```traefik.http.routers
??? info "`traefik.http.routers..priority`"
- See [priority](../http/router/rules-and-priority.md#priority-calculation) for more information.
+ See [priority](../http/routing/rules-and-priority.md#priority-calculation) for more information.
```yaml
traefik.http.routers.myrouter.priority=42
@@ -218,6 +218,14 @@ you'd add the label `traefik.http.services.{name-of-your-choice}.loadbalancer.pa
traefik.http.services.myservice.loadbalancer.healthcheck.interval=10
```
+??? info "`traefik.http.services..loadbalancer.healthcheck.unhealthyinterval`"
+
+ See [health check](../http/load-balancing/service.md#health-check) for more information.
+
+ ```yaml
+ traefik.http.services.myservice.loadbalancer.healthcheck.unhealthyinterval=10
+ ```
+
??? info "`traefik.http.services..loadbalancer.healthcheck.path`"
See [health check](../http/load-balancing/service.md#health-check) for more information.
@@ -446,7 +454,7 @@ You can declare TCP Routers and/or Services using labels.
??? info "`traefik.tcp.routers..tls.passthrough`"
- See [Passthrough](../tcp/tls.md#passthrough) for more information.
+ See [Passthrough](../tcp/tls.md#opt-passthrough) for more information.
```yaml
traefik.tcp.routers.mytcprouter.tls.passthrough=true
@@ -454,7 +462,7 @@ You can declare TCP Routers and/or Services using labels.
??? info "`traefik.tcp.routers..priority`"
- See [priority](../tcp/router/rules-and-priority.md#priority) for more information.
+ See [priority](../tcp/routing/rules-and-priority.md#priority-calculation) for more information.
```yaml
traefik.tcp.routers.mytcprouter.priority=42
@@ -486,14 +494,6 @@ You can declare TCP Routers and/or Services using labels.
traefik.http.services.myservice.loadbalancer.server.weight=42
```
-??? info "`traefik.tcp.services..loadbalancer.proxyprotocol.version`"
-
- See [PROXY protocol](../tcp/service.md#proxy-protocol) for more information.
-
- ```yaml
- traefik.tcp.services.mytcpservice.loadbalancer.proxyprotocol.version=1
- ```
-
??? info "`traefik.tcp.services..loadbalancer.serverstransport`"
Allows to reference a ServersTransport resource that is defined either with the File provider or the Kubernetes CRD one.
diff --git a/docs/content/reference/routing-configuration/other-providers/file.md b/docs/content/reference/routing-configuration/other-providers/file.md
new file mode 100644
index 000000000..58dd5b2fc
--- /dev/null
+++ b/docs/content/reference/routing-configuration/other-providers/file.md
@@ -0,0 +1,120 @@
+---
+title: "Traefik File Dynamic Configuration"
+description: "This guide will provide you with the YAML and TOML files for dynamic configuration in Traefik Proxy. Read the technical documentation."
+---
+
+
+# Traefik and Configuration Files
+
+!!! warning "Work In Progress"
+
+ This page is still work in progress to provide a better documention of the routing options.
+
+ It has been created to provide a centralized page with all the option in YAML and TOML format.
+
+## Configuration Options
+
+```yml tab="YAML"
+--8<-- "content/reference/routing-configuration/other-providers/file.yaml"
+```
+
+```toml tab="TOML"
+--8<-- "content/reference/routing-configuration/other-providers/file.toml"
+```
+
+## Go Templating
+
+!!! warning
+
+ Go Templating only works with dedicated dynamic configuration files.
+ Templating does not work in the Traefik main static configuration file.
+
+Traefik supports using Go templating to automatically generate repetitive sections of configuration files.
+These sections must be a valid [Go template](https://pkg.go.dev/text/template/), and can use
+[sprig template functions](https://masterminds.github.io/sprig/).
+
+To illustrate, it is possible to easily define multiple routers, services, and TLS certificates as described in the following examples:
+
+??? example "Configuring Using Templating"
+
+ ```yaml tab="YAML"
+ http:
+ routers:
+ {{range $i, $e := until 100 }}
+ router{{ $e }}-{{ env "MY_ENV_VAR" }}:
+ # ...
+ {{end}}
+
+ services:
+ {{range $i, $e := until 100 }}
+ application{{ $e }}:
+ # ...
+ {{end}}
+
+ tcp:
+ routers:
+ {{range $i, $e := until 100 }}
+ router{{ $e }}:
+ # ...
+ {{end}}
+
+ services:
+ {{range $i, $e := until 100 }}
+ service{{ $e }}:
+ # ...
+ {{end}}
+
+ tls:
+ certificates:
+ {{ range $i, $e := until 10 }}
+ - certFile: "/etc/traefik/cert-{{ $e }}.pem"
+ keyFile: "/etc/traefik/cert-{{ $e }}.key"
+ store:
+ - "my-store-foo-{{ $e }}"
+ - "my-store-bar-{{ $e }}"
+ {{end}}
+ ```
+
+ ```toml tab="TOML"
+ # template-rules.toml
+ [http]
+
+ [http.routers]
+ {{ range $i, $e := until 100 }}
+ [http.routers.router{{ $e }}-{{ env "MY_ENV_VAR" }}]
+ # ...
+ {{ end }}
+
+ [http.services]
+ {{ range $i, $e := until 100 }}
+ [http.services.service{{ $e }}]
+ # ...
+ {{ end }}
+
+ [tcp]
+
+ [tcp.routers]
+ {{ range $i, $e := until 100 }}
+ [tcp.routers.router{{ $e }}]
+ # ...
+ {{ end }}
+
+ [tcp.services]
+ {{ range $i, $e := until 100 }}
+ [http.services.service{{ $e }}]
+ # ...
+ {{ end }}
+
+ {{ range $i, $e := until 10 }}
+ [[tls.certificates]]
+ certFile = "/etc/traefik/cert-{{ $e }}.pem"
+ keyFile = "/etc/traefik/cert-{{ $e }}.key"
+ stores = ["my-store-foo-{{ $e }}", "my-store-bar-{{ $e }}"]
+ {{ end }}
+
+ [tls.config]
+ {{ range $i, $e := until 10 }}
+ [tls.config.TLS{{ $e }}]
+ # ...
+ {{ end }}
+ ```
diff --git a/docs/content/reference/routing-configuration/other-providers/file.toml b/docs/content/reference/routing-configuration/other-providers/file.toml
new file mode 100644
index 000000000..985f96e21
--- /dev/null
+++ b/docs/content/reference/routing-configuration/other-providers/file.toml
@@ -0,0 +1,615 @@
+## CODE GENERATED AUTOMATICALLY
+## THIS FILE MUST NOT BE EDITED BY HAND
+[http]
+ [http.routers]
+ [http.routers.Router0]
+ entryPoints = ["foobar", "foobar"]
+ middlewares = ["foobar", "foobar"]
+ service = "foobar"
+ rule = "foobar"
+ ruleSyntax = "foobar"
+ priority = 42
+ [http.routers.Router0.tls]
+ options = "foobar"
+ certResolver = "foobar"
+
+ [[http.routers.Router0.tls.domains]]
+ main = "foobar"
+ sans = ["foobar", "foobar"]
+
+ [[http.routers.Router0.tls.domains]]
+ main = "foobar"
+ sans = ["foobar", "foobar"]
+ [http.routers.Router0.observability]
+ accessLogs = true
+ metrics = true
+ tracing = true
+ traceVerbosity = "foobar"
+ [http.routers.Router1]
+ entryPoints = ["foobar", "foobar"]
+ middlewares = ["foobar", "foobar"]
+ service = "foobar"
+ rule = "foobar"
+ ruleSyntax = "foobar"
+ priority = 42
+ [http.routers.Router1.tls]
+ options = "foobar"
+ certResolver = "foobar"
+
+ [[http.routers.Router1.tls.domains]]
+ main = "foobar"
+ sans = ["foobar", "foobar"]
+
+ [[http.routers.Router1.tls.domains]]
+ main = "foobar"
+ sans = ["foobar", "foobar"]
+ [http.routers.Router1.observability]
+ accessLogs = true
+ metrics = true
+ tracing = true
+ traceVerbosity = "foobar"
+ [http.services]
+ [http.services.Service01]
+ [http.services.Service01.failover]
+ service = "foobar"
+ fallback = "foobar"
+ [http.services.Service01.failover.healthCheck]
+ [http.services.Service02]
+ [http.services.Service02.loadBalancer]
+ strategy = "foobar"
+ passHostHeader = true
+ serversTransport = "foobar"
+ [http.services.Service02.loadBalancer.sticky]
+ [http.services.Service02.loadBalancer.sticky.cookie]
+ name = "foobar"
+ secure = true
+ httpOnly = true
+ sameSite = "foobar"
+ maxAge = 42
+ path = "foobar"
+ domain = "foobar"
+
+ [[http.services.Service02.loadBalancer.servers]]
+ url = "foobar"
+ weight = 42
+ preservePath = true
+
+ [[http.services.Service02.loadBalancer.servers]]
+ url = "foobar"
+ weight = 42
+ preservePath = true
+ [http.services.Service02.loadBalancer.healthCheck]
+ scheme = "foobar"
+ mode = "foobar"
+ path = "foobar"
+ method = "foobar"
+ status = 42
+ port = 42
+ interval = "42s"
+ unhealthyInterval = "42s"
+ timeout = "42s"
+ hostname = "foobar"
+ followRedirects = true
+ [http.services.Service02.loadBalancer.healthCheck.headers]
+ name0 = "foobar"
+ name1 = "foobar"
+ [http.services.Service02.loadBalancer.responseForwarding]
+ flushInterval = "42s"
+ [http.services.Service03]
+ [http.services.Service03.mirroring]
+ service = "foobar"
+ mirrorBody = true
+ maxBodySize = 42
+
+ [[http.services.Service03.mirroring.mirrors]]
+ name = "foobar"
+ percent = 42
+
+ [[http.services.Service03.mirroring.mirrors]]
+ name = "foobar"
+ percent = 42
+ [http.services.Service03.mirroring.healthCheck]
+ [http.services.Service04]
+ [http.services.Service04.weighted]
+
+ [[http.services.Service04.weighted.services]]
+ name = "foobar"
+ weight = 42
+
+ [[http.services.Service04.weighted.services]]
+ name = "foobar"
+ weight = 42
+ [http.services.Service04.weighted.sticky]
+ [http.services.Service04.weighted.sticky.cookie]
+ name = "foobar"
+ secure = true
+ httpOnly = true
+ sameSite = "foobar"
+ maxAge = 42
+ path = "foobar"
+ domain = "foobar"
+ [http.services.Service04.weighted.healthCheck]
+ [http.middlewares]
+ [http.middlewares.Middleware01]
+ [http.middlewares.Middleware01.addPrefix]
+ prefix = "foobar"
+ [http.middlewares.Middleware02]
+ [http.middlewares.Middleware02.basicAuth]
+ users = ["foobar", "foobar"]
+ usersFile = "foobar"
+ realm = "foobar"
+ removeHeader = true
+ headerField = "foobar"
+ [http.middlewares.Middleware03]
+ [http.middlewares.Middleware03.buffering]
+ maxRequestBodyBytes = 42
+ memRequestBodyBytes = 42
+ maxResponseBodyBytes = 42
+ memResponseBodyBytes = 42
+ retryExpression = "foobar"
+ [http.middlewares.Middleware04]
+ [http.middlewares.Middleware04.chain]
+ middlewares = ["foobar", "foobar"]
+ [http.middlewares.Middleware05]
+ [http.middlewares.Middleware05.circuitBreaker]
+ expression = "foobar"
+ checkPeriod = "42s"
+ fallbackDuration = "42s"
+ recoveryDuration = "42s"
+ responseCode = 42
+ [http.middlewares.Middleware06]
+ [http.middlewares.Middleware06.compress]
+ excludedContentTypes = ["foobar", "foobar"]
+ includedContentTypes = ["foobar", "foobar"]
+ minResponseBodyBytes = 42
+ encodings = ["foobar", "foobar"]
+ defaultEncoding = "foobar"
+ [http.middlewares.Middleware07]
+ [http.middlewares.Middleware07.contentType]
+ autoDetect = true
+ [http.middlewares.Middleware08]
+ [http.middlewares.Middleware08.digestAuth]
+ users = ["foobar", "foobar"]
+ usersFile = "foobar"
+ removeHeader = true
+ realm = "foobar"
+ headerField = "foobar"
+ [http.middlewares.Middleware09]
+ [http.middlewares.Middleware09.errors]
+ status = ["foobar", "foobar"]
+ service = "foobar"
+ query = "foobar"
+ [http.middlewares.Middleware09.errors.statusRewrites]
+ name0 = 42
+ name1 = 42
+ [http.middlewares.Middleware10]
+ [http.middlewares.Middleware10.forwardAuth]
+ address = "foobar"
+ trustForwardHeader = true
+ authResponseHeaders = ["foobar", "foobar"]
+ authResponseHeadersRegex = "foobar"
+ authRequestHeaders = ["foobar", "foobar"]
+ addAuthCookiesToResponse = ["foobar", "foobar"]
+ headerField = "foobar"
+ forwardBody = true
+ maxBodySize = 42
+ preserveLocationHeader = true
+ preserveRequestMethod = true
+ [http.middlewares.Middleware10.forwardAuth.tls]
+ ca = "foobar"
+ cert = "foobar"
+ key = "foobar"
+ insecureSkipVerify = true
+ caOptional = true
+ [http.middlewares.Middleware11]
+ [http.middlewares.Middleware11.grpcWeb]
+ allowOrigins = ["foobar", "foobar"]
+ [http.middlewares.Middleware12]
+ [http.middlewares.Middleware12.headers]
+ accessControlAllowCredentials = true
+ accessControlAllowHeaders = ["foobar", "foobar"]
+ accessControlAllowMethods = ["foobar", "foobar"]
+ accessControlAllowOriginList = ["foobar", "foobar"]
+ accessControlAllowOriginListRegex = ["foobar", "foobar"]
+ accessControlExposeHeaders = ["foobar", "foobar"]
+ accessControlMaxAge = 42
+ addVaryHeader = true
+ allowedHosts = ["foobar", "foobar"]
+ hostsProxyHeaders = ["foobar", "foobar"]
+ stsSeconds = 42
+ stsIncludeSubdomains = true
+ stsPreload = true
+ forceSTSHeader = true
+ frameDeny = true
+ customFrameOptionsValue = "foobar"
+ contentTypeNosniff = true
+ browserXssFilter = true
+ customBrowserXSSValue = "foobar"
+ contentSecurityPolicy = "foobar"
+ contentSecurityPolicyReportOnly = "foobar"
+ publicKey = "foobar"
+ referrerPolicy = "foobar"
+ permissionsPolicy = "foobar"
+ isDevelopment = true
+ featurePolicy = "foobar"
+ sslRedirect = true
+ sslTemporaryRedirect = true
+ sslHost = "foobar"
+ sslForceHost = true
+ [http.middlewares.Middleware12.headers.customRequestHeaders]
+ name0 = "foobar"
+ name1 = "foobar"
+ [http.middlewares.Middleware12.headers.customResponseHeaders]
+ name0 = "foobar"
+ name1 = "foobar"
+ [http.middlewares.Middleware12.headers.sslProxyHeaders]
+ name0 = "foobar"
+ name1 = "foobar"
+ [http.middlewares.Middleware13]
+ [http.middlewares.Middleware13.ipAllowList]
+ sourceRange = ["foobar", "foobar"]
+ rejectStatusCode = 42
+ [http.middlewares.Middleware13.ipAllowList.ipStrategy]
+ depth = 42
+ excludedIPs = ["foobar", "foobar"]
+ ipv6Subnet = 42
+ [http.middlewares.Middleware14]
+ [http.middlewares.Middleware14.ipWhiteList]
+ sourceRange = ["foobar", "foobar"]
+ [http.middlewares.Middleware14.ipWhiteList.ipStrategy]
+ depth = 42
+ excludedIPs = ["foobar", "foobar"]
+ ipv6Subnet = 42
+ [http.middlewares.Middleware15]
+ [http.middlewares.Middleware15.inFlightReq]
+ amount = 42
+ [http.middlewares.Middleware15.inFlightReq.sourceCriterion]
+ requestHeaderName = "foobar"
+ requestHost = true
+ [http.middlewares.Middleware15.inFlightReq.sourceCriterion.ipStrategy]
+ depth = 42
+ excludedIPs = ["foobar", "foobar"]
+ ipv6Subnet = 42
+ [http.middlewares.Middleware16]
+ [http.middlewares.Middleware16.passTLSClientCert]
+ pem = true
+ [http.middlewares.Middleware16.passTLSClientCert.info]
+ notAfter = true
+ notBefore = true
+ sans = true
+ serialNumber = true
+ [http.middlewares.Middleware16.passTLSClientCert.info.subject]
+ country = true
+ province = true
+ locality = true
+ organization = true
+ organizationalUnit = true
+ commonName = true
+ serialNumber = true
+ domainComponent = true
+ [http.middlewares.Middleware16.passTLSClientCert.info.issuer]
+ country = true
+ province = true
+ locality = true
+ organization = true
+ commonName = true
+ serialNumber = true
+ domainComponent = true
+ [http.middlewares.Middleware17]
+ [http.middlewares.Middleware17.plugin]
+ [http.middlewares.Middleware17.plugin.PluginConf0]
+ name0 = "foobar"
+ name1 = "foobar"
+ [http.middlewares.Middleware17.plugin.PluginConf1]
+ name0 = "foobar"
+ name1 = "foobar"
+ [http.middlewares.Middleware18]
+ [http.middlewares.Middleware18.rateLimit]
+ average = 42
+ period = "42s"
+ burst = 42
+ [http.middlewares.Middleware18.rateLimit.sourceCriterion]
+ requestHeaderName = "foobar"
+ requestHost = true
+ [http.middlewares.Middleware18.rateLimit.sourceCriterion.ipStrategy]
+ depth = 42
+ excludedIPs = ["foobar", "foobar"]
+ ipv6Subnet = 42
+ [http.middlewares.Middleware18.rateLimit.redis]
+ endpoints = ["foobar", "foobar"]
+ username = "foobar"
+ password = "foobar"
+ db = 42
+ poolSize = 42
+ minIdleConns = 42
+ maxActiveConns = 42
+ readTimeout = "42s"
+ writeTimeout = "42s"
+ dialTimeout = "42s"
+ [http.middlewares.Middleware18.rateLimit.redis.tls]
+ ca = "foobar"
+ cert = "foobar"
+ key = "foobar"
+ insecureSkipVerify = true
+ [http.middlewares.Middleware19]
+ [http.middlewares.Middleware19.redirectRegex]
+ regex = "foobar"
+ replacement = "foobar"
+ permanent = true
+ [http.middlewares.Middleware20]
+ [http.middlewares.Middleware20.redirectScheme]
+ scheme = "foobar"
+ port = "foobar"
+ permanent = true
+ [http.middlewares.Middleware21]
+ [http.middlewares.Middleware21.replacePath]
+ path = "foobar"
+ [http.middlewares.Middleware22]
+ [http.middlewares.Middleware22.replacePathRegex]
+ regex = "foobar"
+ replacement = "foobar"
+ [http.middlewares.Middleware23]
+ [http.middlewares.Middleware23.retry]
+ attempts = 42
+ initialInterval = "42s"
+ [http.middlewares.Middleware24]
+ [http.middlewares.Middleware24.stripPrefix]
+ prefixes = ["foobar", "foobar"]
+ forceSlash = true
+ [http.middlewares.Middleware25]
+ [http.middlewares.Middleware25.stripPrefixRegex]
+ regex = ["foobar", "foobar"]
+ [http.serversTransports]
+ [http.serversTransports.ServersTransport0]
+ serverName = "foobar"
+ insecureSkipVerify = true
+ rootCAs = ["foobar", "foobar"]
+ maxIdleConnsPerHost = 42
+ disableHTTP2 = true
+ peerCertURI = "foobar"
+
+ [[http.serversTransports.ServersTransport0.certificates]]
+ certFile = "foobar"
+ keyFile = "foobar"
+
+ [[http.serversTransports.ServersTransport0.certificates]]
+ certFile = "foobar"
+ keyFile = "foobar"
+ [http.serversTransports.ServersTransport0.forwardingTimeouts]
+ dialTimeout = "42s"
+ responseHeaderTimeout = "42s"
+ idleConnTimeout = "42s"
+ readIdleTimeout = "42s"
+ pingTimeout = "42s"
+ [http.serversTransports.ServersTransport0.spiffe]
+ ids = ["foobar", "foobar"]
+ trustDomain = "foobar"
+ [http.serversTransports.ServersTransport1]
+ serverName = "foobar"
+ insecureSkipVerify = true
+ rootCAs = ["foobar", "foobar"]
+ maxIdleConnsPerHost = 42
+ disableHTTP2 = true
+ peerCertURI = "foobar"
+
+ [[http.serversTransports.ServersTransport1.certificates]]
+ certFile = "foobar"
+ keyFile = "foobar"
+
+ [[http.serversTransports.ServersTransport1.certificates]]
+ certFile = "foobar"
+ keyFile = "foobar"
+ [http.serversTransports.ServersTransport1.forwardingTimeouts]
+ dialTimeout = "42s"
+ responseHeaderTimeout = "42s"
+ idleConnTimeout = "42s"
+ readIdleTimeout = "42s"
+ pingTimeout = "42s"
+ [http.serversTransports.ServersTransport1.spiffe]
+ ids = ["foobar", "foobar"]
+ trustDomain = "foobar"
+
+[tcp]
+ [tcp.routers]
+ [tcp.routers.TCPRouter0]
+ entryPoints = ["foobar", "foobar"]
+ middlewares = ["foobar", "foobar"]
+ service = "foobar"
+ rule = "foobar"
+ ruleSyntax = "foobar"
+ priority = 42
+ [tcp.routers.TCPRouter0.tls]
+ passthrough = true
+ options = "foobar"
+ certResolver = "foobar"
+
+ [[tcp.routers.TCPRouter0.tls.domains]]
+ main = "foobar"
+ sans = ["foobar", "foobar"]
+
+ [[tcp.routers.TCPRouter0.tls.domains]]
+ main = "foobar"
+ sans = ["foobar", "foobar"]
+ [tcp.routers.TCPRouter1]
+ entryPoints = ["foobar", "foobar"]
+ middlewares = ["foobar", "foobar"]
+ service = "foobar"
+ rule = "foobar"
+ ruleSyntax = "foobar"
+ priority = 42
+ [tcp.routers.TCPRouter1.tls]
+ passthrough = true
+ options = "foobar"
+ certResolver = "foobar"
+
+ [[tcp.routers.TCPRouter1.tls.domains]]
+ main = "foobar"
+ sans = ["foobar", "foobar"]
+
+ [[tcp.routers.TCPRouter1.tls.domains]]
+ main = "foobar"
+ sans = ["foobar", "foobar"]
+ [tcp.services]
+ [tcp.services.TCPService01]
+ [tcp.services.TCPService01.loadBalancer]
+ serversTransport = "foobar"
+ terminationDelay = 42
+
+ [[tcp.services.TCPService01.loadBalancer.servers]]
+ address = "foobar"
+ tls = true
+
+ [[tcp.services.TCPService01.loadBalancer.servers]]
+ address = "foobar"
+ tls = true
+ [tcp.services.TCPService01.loadBalancer.proxyProtocol]
+ version = 42
+ [tcp.services.TCPService02]
+ [tcp.services.TCPService02.weighted]
+
+ [[tcp.services.TCPService02.weighted.services]]
+ name = "foobar"
+ weight = 42
+
+ [[tcp.services.TCPService02.weighted.services]]
+ name = "foobar"
+ weight = 42
+ [tcp.middlewares]
+ [tcp.middlewares.TCPMiddleware01]
+ [tcp.middlewares.TCPMiddleware01.ipAllowList]
+ sourceRange = ["foobar", "foobar"]
+ [tcp.middlewares.TCPMiddleware02]
+ [tcp.middlewares.TCPMiddleware02.ipWhiteList]
+ sourceRange = ["foobar", "foobar"]
+ [tcp.middlewares.TCPMiddleware03]
+ [tcp.middlewares.TCPMiddleware03.inFlightConn]
+ amount = 42
+ [tcp.serversTransports]
+ [tcp.serversTransports.TCPServersTransport0]
+ dialKeepAlive = "42s"
+ dialTimeout = "42s"
+ terminationDelay = "42s"
+ [tcp.serversTransports.TCPServersTransport0.proxyProtocol]
+ version = 42
+ [tcp.serversTransports.TCPServersTransport0.tls]
+ serverName = "foobar"
+ insecureSkipVerify = true
+ rootCAs = ["foobar", "foobar"]
+ peerCertURI = "foobar"
+
+ [[tcp.serversTransports.TCPServersTransport0.tls.certificates]]
+ certFile = "foobar"
+ keyFile = "foobar"
+
+ [[tcp.serversTransports.TCPServersTransport0.tls.certificates]]
+ certFile = "foobar"
+ keyFile = "foobar"
+ [tcp.serversTransports.TCPServersTransport0.tls.spiffe]
+ ids = ["foobar", "foobar"]
+ trustDomain = "foobar"
+ [tcp.serversTransports.TCPServersTransport1]
+ dialKeepAlive = "42s"
+ dialTimeout = "42s"
+ terminationDelay = "42s"
+ [tcp.serversTransports.TCPServersTransport1.proxyProtocol]
+ version = 42
+ [tcp.serversTransports.TCPServersTransport1.tls]
+ serverName = "foobar"
+ insecureSkipVerify = true
+ rootCAs = ["foobar", "foobar"]
+ peerCertURI = "foobar"
+
+ [[tcp.serversTransports.TCPServersTransport1.tls.certificates]]
+ certFile = "foobar"
+ keyFile = "foobar"
+
+ [[tcp.serversTransports.TCPServersTransport1.tls.certificates]]
+ certFile = "foobar"
+ keyFile = "foobar"
+ [tcp.serversTransports.TCPServersTransport1.tls.spiffe]
+ ids = ["foobar", "foobar"]
+ trustDomain = "foobar"
+
+[udp]
+ [udp.routers]
+ [udp.routers.UDPRouter0]
+ entryPoints = ["foobar", "foobar"]
+ service = "foobar"
+ [udp.routers.UDPRouter1]
+ entryPoints = ["foobar", "foobar"]
+ service = "foobar"
+ [udp.services]
+ [udp.services.UDPService01]
+ [udp.services.UDPService01.loadBalancer]
+
+ [[udp.services.UDPService01.loadBalancer.servers]]
+ address = "foobar"
+
+ [[udp.services.UDPService01.loadBalancer.servers]]
+ address = "foobar"
+ [udp.services.UDPService02]
+ [udp.services.UDPService02.weighted]
+
+ [[udp.services.UDPService02.weighted.services]]
+ name = "foobar"
+ weight = 42
+
+ [[udp.services.UDPService02.weighted.services]]
+ name = "foobar"
+ weight = 42
+
+[tls]
+
+ [[tls.certificates]]
+ certFile = "foobar"
+ keyFile = "foobar"
+ stores = ["foobar", "foobar"]
+
+ [[tls.certificates]]
+ certFile = "foobar"
+ keyFile = "foobar"
+ stores = ["foobar", "foobar"]
+ [tls.options]
+ [tls.options.Options0]
+ minVersion = "foobar"
+ maxVersion = "foobar"
+ cipherSuites = ["foobar", "foobar"]
+ curvePreferences = ["foobar", "foobar"]
+ sniStrict = true
+ alpnProtocols = ["foobar", "foobar"]
+ disableSessionTickets = true
+ preferServerCipherSuites = true
+ [tls.options.Options0.clientAuth]
+ caFiles = ["foobar", "foobar"]
+ clientAuthType = "foobar"
+ [tls.options.Options1]
+ minVersion = "foobar"
+ maxVersion = "foobar"
+ cipherSuites = ["foobar", "foobar"]
+ curvePreferences = ["foobar", "foobar"]
+ sniStrict = true
+ alpnProtocols = ["foobar", "foobar"]
+ disableSessionTickets = true
+ preferServerCipherSuites = true
+ [tls.options.Options1.clientAuth]
+ caFiles = ["foobar", "foobar"]
+ clientAuthType = "foobar"
+ [tls.stores]
+ [tls.stores.Store0]
+ [tls.stores.Store0.defaultCertificate]
+ certFile = "foobar"
+ keyFile = "foobar"
+ [tls.stores.Store0.defaultGeneratedCert]
+ resolver = "foobar"
+ [tls.stores.Store0.defaultGeneratedCert.domain]
+ main = "foobar"
+ sans = ["foobar", "foobar"]
+ [tls.stores.Store1]
+ [tls.stores.Store1.defaultCertificate]
+ certFile = "foobar"
+ keyFile = "foobar"
+ [tls.stores.Store1.defaultGeneratedCert]
+ resolver = "foobar"
+ [tls.stores.Store1.defaultGeneratedCert.domain]
+ main = "foobar"
+ sans = ["foobar", "foobar"]
diff --git a/docs/content/reference/routing-configuration/other-providers/file.yaml b/docs/content/reference/routing-configuration/other-providers/file.yaml
new file mode 100644
index 000000000..29822fddb
--- /dev/null
+++ b/docs/content/reference/routing-configuration/other-providers/file.yaml
@@ -0,0 +1,698 @@
+## CODE GENERATED AUTOMATICALLY
+## THIS FILE MUST NOT BE EDITED BY HAND
+http:
+ routers:
+ Router0:
+ entryPoints:
+ - foobar
+ - foobar
+ middlewares:
+ - foobar
+ - foobar
+ service: foobar
+ rule: foobar
+ ruleSyntax: foobar
+ priority: 42
+ tls:
+ options: foobar
+ certResolver: foobar
+ domains:
+ - main: foobar
+ sans:
+ - foobar
+ - foobar
+ - main: foobar
+ sans:
+ - foobar
+ - foobar
+ observability:
+ accessLogs: true
+ metrics: true
+ tracing: true
+ traceVerbosity: foobar
+ Router1:
+ entryPoints:
+ - foobar
+ - foobar
+ middlewares:
+ - foobar
+ - foobar
+ service: foobar
+ rule: foobar
+ ruleSyntax: foobar
+ priority: 42
+ tls:
+ options: foobar
+ certResolver: foobar
+ domains:
+ - main: foobar
+ sans:
+ - foobar
+ - foobar
+ - main: foobar
+ sans:
+ - foobar
+ - foobar
+ observability:
+ accessLogs: true
+ metrics: true
+ tracing: true
+ traceVerbosity: foobar
+ services:
+ Service01:
+ failover:
+ service: foobar
+ fallback: foobar
+ healthCheck: {}
+ Service02:
+ loadBalancer:
+ sticky:
+ cookie:
+ name: foobar
+ secure: true
+ httpOnly: true
+ sameSite: foobar
+ maxAge: 42
+ path: foobar
+ domain: foobar
+ servers:
+ - url: foobar
+ weight: 42
+ preservePath: true
+ - url: foobar
+ weight: 42
+ preservePath: true
+ strategy: foobar
+ healthCheck:
+ scheme: foobar
+ mode: foobar
+ path: foobar
+ method: foobar
+ status: 42
+ port: 42
+ interval: 42s
+ unhealthyInterval: 42s
+ timeout: 42s
+ hostname: foobar
+ followRedirects: true
+ headers:
+ name0: foobar
+ name1: foobar
+ passHostHeader: true
+ responseForwarding:
+ flushInterval: 42s
+ serversTransport: foobar
+ Service03:
+ mirroring:
+ service: foobar
+ mirrorBody: true
+ maxBodySize: 42
+ mirrors:
+ - name: foobar
+ percent: 42
+ - name: foobar
+ percent: 42
+ healthCheck: {}
+ Service04:
+ weighted:
+ services:
+ - name: foobar
+ weight: 42
+ - name: foobar
+ weight: 42
+ sticky:
+ cookie:
+ name: foobar
+ secure: true
+ httpOnly: true
+ sameSite: foobar
+ maxAge: 42
+ path: foobar
+ domain: foobar
+ healthCheck: {}
+ middlewares:
+ Middleware01:
+ addPrefix:
+ prefix: foobar
+ Middleware02:
+ basicAuth:
+ users:
+ - foobar
+ - foobar
+ usersFile: foobar
+ realm: foobar
+ removeHeader: true
+ headerField: foobar
+ Middleware03:
+ buffering:
+ maxRequestBodyBytes: 42
+ memRequestBodyBytes: 42
+ maxResponseBodyBytes: 42
+ memResponseBodyBytes: 42
+ retryExpression: foobar
+ Middleware04:
+ chain:
+ middlewares:
+ - foobar
+ - foobar
+ Middleware05:
+ circuitBreaker:
+ expression: foobar
+ checkPeriod: 42s
+ fallbackDuration: 42s
+ recoveryDuration: 42s
+ responseCode: 42
+ Middleware06:
+ compress:
+ excludedContentTypes:
+ - foobar
+ - foobar
+ includedContentTypes:
+ - foobar
+ - foobar
+ minResponseBodyBytes: 42
+ encodings:
+ - foobar
+ - foobar
+ defaultEncoding: foobar
+ Middleware07:
+ contentType:
+ autoDetect: true
+ Middleware08:
+ digestAuth:
+ users:
+ - foobar
+ - foobar
+ usersFile: foobar
+ removeHeader: true
+ realm: foobar
+ headerField: foobar
+ Middleware09:
+ errors:
+ status:
+ - foobar
+ - foobar
+ statusRewrites:
+ name0: 42
+ name1: 42
+ service: foobar
+ query: foobar
+ Middleware10:
+ forwardAuth:
+ address: foobar
+ tls:
+ ca: foobar
+ cert: foobar
+ key: foobar
+ insecureSkipVerify: true
+ caOptional: true
+ trustForwardHeader: true
+ authResponseHeaders:
+ - foobar
+ - foobar
+ authResponseHeadersRegex: foobar
+ authRequestHeaders:
+ - foobar
+ - foobar
+ addAuthCookiesToResponse:
+ - foobar
+ - foobar
+ headerField: foobar
+ forwardBody: true
+ maxBodySize: 42
+ preserveLocationHeader: true
+ preserveRequestMethod: true
+ Middleware11:
+ grpcWeb:
+ allowOrigins:
+ - foobar
+ - foobar
+ Middleware12:
+ headers:
+ customRequestHeaders:
+ name0: foobar
+ name1: foobar
+ customResponseHeaders:
+ name0: foobar
+ name1: foobar
+ accessControlAllowCredentials: true
+ accessControlAllowHeaders:
+ - foobar
+ - foobar
+ accessControlAllowMethods:
+ - foobar
+ - foobar
+ accessControlAllowOriginList:
+ - foobar
+ - foobar
+ accessControlAllowOriginListRegex:
+ - foobar
+ - foobar
+ accessControlExposeHeaders:
+ - foobar
+ - foobar
+ accessControlMaxAge: 42
+ addVaryHeader: true
+ allowedHosts:
+ - foobar
+ - foobar
+ hostsProxyHeaders:
+ - foobar
+ - foobar
+ sslProxyHeaders:
+ name0: foobar
+ name1: foobar
+ stsSeconds: 42
+ stsIncludeSubdomains: true
+ stsPreload: true
+ forceSTSHeader: true
+ frameDeny: true
+ customFrameOptionsValue: foobar
+ contentTypeNosniff: true
+ browserXssFilter: true
+ customBrowserXSSValue: foobar
+ contentSecurityPolicy: foobar
+ contentSecurityPolicyReportOnly: foobar
+ publicKey: foobar
+ referrerPolicy: foobar
+ permissionsPolicy: foobar
+ isDevelopment: true
+ featurePolicy: foobar
+ sslRedirect: true
+ sslTemporaryRedirect: true
+ sslHost: foobar
+ sslForceHost: true
+ Middleware13:
+ ipAllowList:
+ sourceRange:
+ - foobar
+ - foobar
+ ipStrategy:
+ depth: 42
+ excludedIPs:
+ - foobar
+ - foobar
+ ipv6Subnet: 42
+ rejectStatusCode: 42
+ Middleware14:
+ ipWhiteList:
+ sourceRange:
+ - foobar
+ - foobar
+ ipStrategy:
+ depth: 42
+ excludedIPs:
+ - foobar
+ - foobar
+ ipv6Subnet: 42
+ Middleware15:
+ inFlightReq:
+ amount: 42
+ sourceCriterion:
+ ipStrategy:
+ depth: 42
+ excludedIPs:
+ - foobar
+ - foobar
+ ipv6Subnet: 42
+ requestHeaderName: foobar
+ requestHost: true
+ Middleware16:
+ passTLSClientCert:
+ pem: true
+ info:
+ notAfter: true
+ notBefore: true
+ sans: true
+ serialNumber: true
+ subject:
+ country: true
+ province: true
+ locality: true
+ organization: true
+ organizationalUnit: true
+ commonName: true
+ serialNumber: true
+ domainComponent: true
+ issuer:
+ country: true
+ province: true
+ locality: true
+ organization: true
+ commonName: true
+ serialNumber: true
+ domainComponent: true
+ Middleware17:
+ plugin:
+ PluginConf0:
+ name0: foobar
+ name1: foobar
+ PluginConf1:
+ name0: foobar
+ name1: foobar
+ Middleware18:
+ rateLimit:
+ average: 42
+ period: 42s
+ burst: 42
+ sourceCriterion:
+ ipStrategy:
+ depth: 42
+ excludedIPs:
+ - foobar
+ - foobar
+ ipv6Subnet: 42
+ requestHeaderName: foobar
+ requestHost: true
+ redis:
+ endpoints:
+ - foobar
+ - foobar
+ tls:
+ ca: foobar
+ cert: foobar
+ key: foobar
+ insecureSkipVerify: true
+ username: foobar
+ password: foobar
+ db: 42
+ poolSize: 42
+ minIdleConns: 42
+ maxActiveConns: 42
+ readTimeout: 42s
+ writeTimeout: 42s
+ dialTimeout: 42s
+ Middleware19:
+ redirectRegex:
+ regex: foobar
+ replacement: foobar
+ permanent: true
+ Middleware20:
+ redirectScheme:
+ scheme: foobar
+ port: foobar
+ permanent: true
+ Middleware21:
+ replacePath:
+ path: foobar
+ Middleware22:
+ replacePathRegex:
+ regex: foobar
+ replacement: foobar
+ Middleware23:
+ retry:
+ attempts: 42
+ initialInterval: 42s
+ Middleware24:
+ stripPrefix:
+ prefixes:
+ - foobar
+ - foobar
+ forceSlash: true
+ Middleware25:
+ stripPrefixRegex:
+ regex:
+ - foobar
+ - foobar
+ serversTransports:
+ ServersTransport0:
+ serverName: foobar
+ insecureSkipVerify: true
+ rootCAs:
+ - foobar
+ - foobar
+ certificates:
+ - certFile: foobar
+ keyFile: foobar
+ - certFile: foobar
+ keyFile: foobar
+ maxIdleConnsPerHost: 42
+ forwardingTimeouts:
+ dialTimeout: 42s
+ responseHeaderTimeout: 42s
+ idleConnTimeout: 42s
+ readIdleTimeout: 42s
+ pingTimeout: 42s
+ disableHTTP2: true
+ peerCertURI: foobar
+ spiffe:
+ ids:
+ - foobar
+ - foobar
+ trustDomain: foobar
+ ServersTransport1:
+ serverName: foobar
+ insecureSkipVerify: true
+ rootCAs:
+ - foobar
+ - foobar
+ certificates:
+ - certFile: foobar
+ keyFile: foobar
+ - certFile: foobar
+ keyFile: foobar
+ maxIdleConnsPerHost: 42
+ forwardingTimeouts:
+ dialTimeout: 42s
+ responseHeaderTimeout: 42s
+ idleConnTimeout: 42s
+ readIdleTimeout: 42s
+ pingTimeout: 42s
+ disableHTTP2: true
+ peerCertURI: foobar
+ spiffe:
+ ids:
+ - foobar
+ - foobar
+ trustDomain: foobar
+tcp:
+ routers:
+ TCPRouter0:
+ entryPoints:
+ - foobar
+ - foobar
+ middlewares:
+ - foobar
+ - foobar
+ service: foobar
+ rule: foobar
+ ruleSyntax: foobar
+ priority: 42
+ tls:
+ passthrough: true
+ options: foobar
+ certResolver: foobar
+ domains:
+ - main: foobar
+ sans:
+ - foobar
+ - foobar
+ - main: foobar
+ sans:
+ - foobar
+ - foobar
+ TCPRouter1:
+ entryPoints:
+ - foobar
+ - foobar
+ middlewares:
+ - foobar
+ - foobar
+ service: foobar
+ rule: foobar
+ ruleSyntax: foobar
+ priority: 42
+ tls:
+ passthrough: true
+ options: foobar
+ certResolver: foobar
+ domains:
+ - main: foobar
+ sans:
+ - foobar
+ - foobar
+ - main: foobar
+ sans:
+ - foobar
+ - foobar
+ services:
+ TCPService01:
+ loadBalancer:
+ servers:
+ - address: foobar
+ tls: true
+ - address: foobar
+ tls: true
+ serversTransport: foobar
+ proxyProtocol:
+ version: 42
+ terminationDelay: 42
+ TCPService02:
+ weighted:
+ services:
+ - name: foobar
+ weight: 42
+ - name: foobar
+ weight: 42
+ middlewares:
+ TCPMiddleware01:
+ ipAllowList:
+ sourceRange:
+ - foobar
+ - foobar
+ TCPMiddleware02:
+ ipWhiteList:
+ sourceRange:
+ - foobar
+ - foobar
+ TCPMiddleware03:
+ inFlightConn:
+ amount: 42
+ serversTransports:
+ TCPServersTransport0:
+ dialKeepAlive: 42s
+ dialTimeout: 42s
+ proxyProtocol:
+ version: 42
+ terminationDelay: 42s
+ tls:
+ serverName: foobar
+ insecureSkipVerify: true
+ rootCAs:
+ - foobar
+ - foobar
+ certificates:
+ - certFile: foobar
+ keyFile: foobar
+ - certFile: foobar
+ keyFile: foobar
+ peerCertURI: foobar
+ spiffe:
+ ids:
+ - foobar
+ - foobar
+ trustDomain: foobar
+ TCPServersTransport1:
+ dialKeepAlive: 42s
+ dialTimeout: 42s
+ proxyProtocol:
+ version: 42
+ terminationDelay: 42s
+ tls:
+ serverName: foobar
+ insecureSkipVerify: true
+ rootCAs:
+ - foobar
+ - foobar
+ certificates:
+ - certFile: foobar
+ keyFile: foobar
+ - certFile: foobar
+ keyFile: foobar
+ peerCertURI: foobar
+ spiffe:
+ ids:
+ - foobar
+ - foobar
+ trustDomain: foobar
+udp:
+ routers:
+ UDPRouter0:
+ entryPoints:
+ - foobar
+ - foobar
+ service: foobar
+ UDPRouter1:
+ entryPoints:
+ - foobar
+ - foobar
+ service: foobar
+ services:
+ UDPService01:
+ loadBalancer:
+ servers:
+ - address: foobar
+ - address: foobar
+ UDPService02:
+ weighted:
+ services:
+ - name: foobar
+ weight: 42
+ - name: foobar
+ weight: 42
+tls:
+ certificates:
+ - certFile: foobar
+ keyFile: foobar
+ stores:
+ - foobar
+ - foobar
+ - certFile: foobar
+ keyFile: foobar
+ stores:
+ - foobar
+ - foobar
+ options:
+ Options0:
+ minVersion: foobar
+ maxVersion: foobar
+ cipherSuites:
+ - foobar
+ - foobar
+ curvePreferences:
+ - foobar
+ - foobar
+ clientAuth:
+ caFiles:
+ - foobar
+ - foobar
+ clientAuthType: foobar
+ sniStrict: true
+ alpnProtocols:
+ - foobar
+ - foobar
+ disableSessionTickets: true
+ preferServerCipherSuites: true
+ Options1:
+ minVersion: foobar
+ maxVersion: foobar
+ cipherSuites:
+ - foobar
+ - foobar
+ curvePreferences:
+ - foobar
+ - foobar
+ clientAuth:
+ caFiles:
+ - foobar
+ - foobar
+ clientAuthType: foobar
+ sniStrict: true
+ alpnProtocols:
+ - foobar
+ - foobar
+ disableSessionTickets: true
+ preferServerCipherSuites: true
+ stores:
+ Store0:
+ defaultCertificate:
+ certFile: foobar
+ keyFile: foobar
+ defaultGeneratedCert:
+ resolver: foobar
+ domain:
+ main: foobar
+ sans:
+ - foobar
+ - foobar
+ Store1:
+ defaultCertificate:
+ certFile: foobar
+ keyFile: foobar
+ defaultGeneratedCert:
+ resolver: foobar
+ domain:
+ main: foobar
+ sans:
+ - foobar
+ - foobar
diff --git a/docs/content/reference/routing-configuration/other-providers/kv.md b/docs/content/reference/routing-configuration/other-providers/kv.md
index 963d83cb0..8f11d50ba 100644
--- a/docs/content/reference/routing-configuration/other-providers/kv.md
+++ b/docs/content/reference/routing-configuration/other-providers/kv.md
@@ -5,387 +5,87 @@ description: "Read the technical documentation to learn the Traefik Routing Conf
# Traefik & KV Stores
-## Routing Configuration
+## Configuration Options
!!! info "Keys"
Keys are case-insensitive.
-### Routers
+### HTTP
+
+#### Routers
!!! warning "The character `@` is not authorized in the router name ``."
-??? info "`traefik/http/routers//rule`"
+| Key (Path) | Description | Value |
+|--------------------------------------|--------------------------------------|----------------------------|
+| `traefik/http/routers//rule` | See [rule](../http/routing/rules-and-priority.md#rules) for more information. | ```Host(`example.com`)``` |
+| `traefik/http/routers//ruleSyntax` | See [rule](../http/routing/rules-and-priority.md#rulesyntax) for more information.
RuleSyntax option is deprecated and will be removed in the next major version.
Please do not use this field and rewrite the router rules to use the v3 syntax. | `v3` |
+| `traefik/http/routers//entrypoints/0` | See [entry points](../../install-configuration/entrypoints.md) for more information. | `web` |
+| `traefik/http/routers//entrypoints/1` | See [entry points](../../install-configuration/entrypoints.md) for more information. | `websecure` |
+| `traefik/http/routers//middlewares/0` | See [middlewares overview](../http/middlewares/overview.md) for more information. | `auth` |
+| `traefik/http/routers//middlewares/1` | | `prefix` |
+| `traefik/http/routers//service` | See [service](../http/load-balancing/service.md) for more information. | `myservice` |
+| `traefik/http/routers//tls` | See [tls](../http/tls/overview.md) for more information. | `true` |
+| `traefik/http/routers//tls/certresolver` | See [certResolver](../../install-configuration/tls/certificate-resolvers/overview.md) for more information. | `myresolver` |
+| `traefik/http/routers//tls/domains/0/main` | See [domains](../../install-configuration/tls/certificate-resolvers/acme.md#domain-definition) for more information. | `example.org` |
+| `traefik/http/routers//tls/domains/0/sans/0` | See [domains](../../install-configuration/tls/certificate-resolvers/acme.md#domain-definition) for more information. | `test.example.org` |
+| `traefik/http/routers//tls/domains/0/sans/1` | See [domains](../../install-configuration/tls/certificate-resolvers/acme.md#domain-definition) for more information. | `dev.example.org` |
+| `traefik/http/routers//tls/options` | See [TLS Options](../http/tls/tls-options.md) for more information. | `foobar` |
+| `traefik/http/routers//observability/accesslogs` | The accessLogs option controls whether the router will produce access-logs. | `true` |
+| `traefik/http/routers//observability/metrics` | The metrics option controls whether the router will produce metrics. | `true` |
+| `traefik/http/routers//observability/tracing` | The tracing option controls whether the router will produce traces. | `true` |
+| `traefik/http/routers//priority` | See [priority](../http/routing/rules-and-priority.md#priority-calculation) for more information. | `42` |
- See [rule](../http/router/rules-and-priority.md#rules) for more information.
-
- | Key (Path) | Value |
- |--------------------------------------|----------------------------|
- | `traefik/http/routers/myrouter/rule` | ```Host(`example.com`)``` |
-
-??? info "`traefik/http/routers//ruleSyntax`"
-
- !!! warning
-
- RuleSyntax option is deprecated and will be removed in the next major version.
- Please do not use this field and rewrite the router rules to use the v3 syntax.
-
- See [rule](../http/router/rules-and-priority.md#rulesyntax) for more information.
-
- | Key (Path) | Value |
- |--------------------------------------|----------------------------|
- | `traefik/http/routers/myrouter/ruleSyntax` | `v3` |
-
-??? info "`traefik/http/routers//entrypoints`"
-
- See [entry points](../../install-configuration/entrypoints.md) for more information.
-
- | Key (Path) | Value |
- |-----------------------------------------------|-------------|
- | `traefik/http/routers/myrouter/entrypoints/0` | `web` |
- | `traefik/http/routers/myrouter/entrypoints/1` | `websecure` |
-
-??? info "`traefik/http/routers//middlewares`"
-
- See [middlewares overview](../http/middlewares/overview.md) for more information.
-
- | Key (Path) | Value |
- |-----------------------------------------------|-------------|
- | `traefik/http/routers/myrouter/middlewares/0` | `auth` |
- | `traefik/http/routers/myrouter/middlewares/1` | `prefix` |
- | `traefik/http/routers/myrouter/middlewares/2` | `cb` |
-
-??? info "`traefik/http/routers//service`"
-
- See [service](../http/load-balancing/service.md) for more information.
-
- | Key (Path) | Value |
- |-----------------------------------------|-------------|
- | `traefik/http/routers/myrouter/service` | `myservice` |
-
-??? info "`traefik/http/routers//tls`"
-
- See [tls](../http/tls/overview.md) for more information.
-
- | Key (Path) | Value |
- |-------------------------------------|--------|
- | `traefik/http/routers/myrouter/tls` | `true` |
-
-??? info "`traefik/http/routers//tls/certresolver`"
-
- See [certResolver](../../install-configuration/tls/certificate-resolvers/overview.md) for more information.
-
- | Key (Path) | Value |
- |--------------------------------------------------|--------------|
- | `traefik/http/routers/myrouter/tls/certresolver` | `myresolver` |
-
-??? info "`traefik/http/routers//tls/domains//main`"
-
- See [domains](../../install-configuration/tls/certificate-resolvers/acme.md#domain-definition) for more information.
-
- | Key (Path) | Value |
- |----------------------------------------------------|---------------|
- | `traefik/http/routers/myrouter/tls/domains/0/main` | `example.org` |
-
-??? info "`traefik/http/routers//tls/domains//sans/`"
-
- See [domains](../../install-configuration/tls/certificate-resolvers/acme.md#domain-definition) for more information.
-
- | Key (Path) | Value |
- |------------------------------------------------------|--------------------|
- | `traefik/http/routers/myrouter/tls/domains/0/sans/0` | `test.example.org` |
- | `traefik/http/routers/myrouter/tls/domains/0/sans/1` | `dev.example.org` |
-
-??? info "`traefik/http/routers//tls/options`"
-
- See [TLS](../http/tls/overview.md) for more information.
-
- | Key (Path) | Value |
- |---------------------------------------------|----------|
- | `traefik/http/routers/myrouter/tls/options` | `foobar` |
-
-??? info "`traefik/http/routers//observability/accesslogs`"
-
- The accessLogs option controls whether the router will produce access-logs.
-
- | Key (Path) | Value |
- |----------------------------------------------------------|--------|
- | `traefik/http/routers/myrouter/observability/accesslogs` | `true` |
-
-??? info "`traefik/http/routers//observability/metrics`"
-
- The metrics option controls whether the router will produce metrics.
-
- | Key (Path) | Value |
- |-------------------------------------------------------|--------|
- | `traefik/http/routers/myrouter/observability/metrics` | `true` |
-
-??? info "`traefik/http/routers//observability/tracing`"
-
- The tracing option controls whether the router will produce traces.
-
- | Key (Path) | Value |
- |-------------------------------------------------------|--------|
- | `traefik/http/routers/myrouter/observability/tracing` | `true` |
-
-??? info "`traefik/http/routers//priority`"
-
- See [domains](../../install-configuration/tls/certificate-resolvers/acme.md#domain-definition) for more information.
-
- | Key (Path) | Value |
- |------------------------------------------|-------|
- | `traefik/http/routers/myrouter/priority` | `42` |
-
-### Services
+#### Services
!!! warning "The character `@` is not authorized in the service name ``."
-??? info "`traefik/http/services//loadbalancer/servers//url`"
-
- See [servers](../http/load-balancing/service.md#servers) for more information.
-
- | Key (Path) | Value |
- |-----------------------------------------------------------------|-----------------------------------------|
- | `traefik/http/services/myservice/loadbalancer/servers/0/url` | `http://:/` |
-
-??? info "`traefik/http/services//loadbalancer/servers//preservePath`"
-
- See [servers](../http/load-balancing/service.md#servers) for more information.
-
- | Key (Path) | Value |
- |-----------------------------------------------------------------|-----------------------------------------|
- | `traefik/http/services/myservice/loadbalancer/servers/0/preservePath` | `true` |
-
-??? info "`traefik/http/services//loadbalancer/servers//weight`"
-
- See [servers](../http/load-balancing/service.md#servers) for more information.
-
- | Key (Path) | Value |
- |-----------------------------------------------------------------|-----------------------------------------|
- | `traefik/http/services/myservice/loadbalancer/servers/0/weight` | `1` |
-
-??? info "`traefik/http/services//loadbalancer/serverstransport`"
-
- Allows to reference a ServersTransport resource that is defined either with the File provider or the Kubernetes CRD one.
- See [serverstransport](../http/load-balancing/serverstransport.md) for more information.
-
- | Key (Path) | Value |
- |-----------------------------------------------------------------|---------------|
- | `traefik/http/services/myservice/loadbalancer/serverstransport` | `foobar@file` |
-
-??? info "`traefik/http/services//loadbalancer/passhostheader`"
-
- | Key (Path) | Value |
- |-----------------------------------------------------------------|--------|
- | `traefik/http/services/myservice/loadbalancer/passhostheader` | `true` |
-
-??? info "`traefik/http/services//loadbalancer/healthcheck/headers/`"
-
- See [health check](../http/load-balancing/service.md#health-check) for more information.
-
- | Key (Path) | Value |
- |--------------------------------------------------------------------------|----------|
- | `traefik/http/services/myservice/loadbalancer/healthcheck/headers/X-Foo` | `foobar` |
-
-??? info "`traefik/http/services//loadbalancer/healthcheck/hostname`"
-
- See [health check](../http/load-balancing/service.md#health-check) for more information.
-
- | Key (Path) | Value |
- |---------------------------------------------------------------------|---------------|
- | `traefik/http/services/myservice/loadbalancer/healthcheck/hostname` | `example.org` |
-
-??? info "`traefik/http/services//loadbalancer/healthcheck/interval`"
-
- See [health check](../http/load-balancing/service.md#health-check) for more information.
-
- | Key (Path) | Value |
- |---------------------------------------------------------------------|-------|
- | `traefik/http/services/myservice/loadbalancer/healthcheck/interval` | `10` |
-
-??? info "`traefik/http/services//loadbalancer/healthcheck/path`"
-
- See [health check](../http/load-balancing/service.md#health-check) for more information.
-
- | Key (Path) | Value |
- |-----------------------------------------------------------------|--------|
- | `traefik/http/services/myservice/loadbalancer/healthcheck/path` | `/foo` |
-
-??? info "`traefik/http/services//loadbalancer/healthcheck/method`"
-
- See [health check](../http/load-balancing/service.md#health-check) for more information.
-
- | Key (Path) | Value |
- |-------------------------------------------------------------------|----------|
- | `traefik/http/services/myservice/loadbalancer/healthcheck/method` | `foobar` |
-
-??? info "`traefik/http/services//loadbalancer/healthcheck/status`"
-
- See [health check](../http/load-balancing/service.md#health-check) for more information.
-
- | Key (Path) | Value |
- |-------------------------------------------------------------------|-------|
- | `traefik/http/services/myservice/loadbalancer/healthcheck/status` | `42` |
-
-??? info "`traefik/http/services//loadbalancer/healthcheck/port`"
-
- See [health check](../http/load-balancing/service.md#health-check) for more information.
-
- | Key (Path) | Value |
- |-----------------------------------------------------------------|-------|
- | `traefik/http/services/myservice/loadbalancer/healthcheck/port` | `42` |
-
-??? info "`traefik/http/services//loadbalancer/healthcheck/scheme`"
-
- See [health check](../http/load-balancing/service.md#health-check) for more information.
-
- | Key (Path) | Value |
- |-------------------------------------------------------------------|--------|
- | `traefik/http/services/myservice/loadbalancer/healthcheck/scheme` | `http` |
-
-??? info "`traefik/http/services//loadbalancer/healthcheck/timeout`"
-
- See [health check](../http/load-balancing/service.md#health-check) for more information.
-
- | Key (Path) | Value |
- |--------------------------------------------------------------------|-------|
- | `traefik/http/services/myservice/loadbalancer/healthcheck/timeout` | `10` |
-
-??? info "`traefik/http/services//loadbalancer/sticky`"
-
- | Key (Path) | Value |
- |-------------------------------------------------------|--------|
- | `traefik/http/services/myservice/loadbalancer/sticky` | `true` |
-
-??? info "`traefik/http/services//loadbalancer/sticky/cookie/httponly`"
-
- | Key (Path) | Value |
- |-----------------------------------------------------------------------|--------|
- | `traefik/http/services/myservice/loadbalancer/sticky/cookie/httponly` | `true` |
-
-??? info "`traefik/http/services//loadbalancer/sticky/cookie/name`"
-
- | Key (Path) | Value |
- |-------------------------------------------------------------------|----------|
- | `traefik/http/services/myservice/loadbalancer/sticky/cookie/name` | `foobar` |
-
-??? info "`traefik/http/services//loadbalancer/sticky/cookie/path`"
-
- | Key (Path) | Value |
- |-------------------------------------------------------------------|-----------|
- | `traefik/http/services/myservice/loadbalancer/sticky/cookie/path` | `/foobar` |
-
-??? info "`traefik/http/services//loadbalancer/sticky/cookie/secure`"
-
- | Key (Path) | Value |
- |---------------------------------------------------------------------|--------|
- | `traefik/http/services/myservice/loadbalancer/sticky/cookie/secure` | `true` |
-
-??? info "`traefik/http/services//loadbalancer/sticky/cookie/samesite`"
-
- | Key (Path) | Value |
- |-----------------------------------------------------------------------|--------|
- | `traefik/http/services/myservice/loadbalancer/sticky/cookie/samesite` | `none` |
-
-??? info "`traefik/http/services//loadbalancer/sticky/cookie/maxage`"
-
- | Key (Path) | Value |
- |---------------------------------------------------------------------|-------|
- | `traefik/http/services/myservice/loadbalancer/sticky/cookie/maxage` | `42` |
-
-??? info "`traefik/http/services//loadbalancer/responseforwarding/flushinterval`"
-
- | Key (Path) | Value |
- |---------------------------------------------------------------------------------|-------|
- | `traefik/http/services/myservice/loadbalancer/responseforwarding/flushinterval` | `10` |
-
-??? info "`traefik/http/services//mirroring/service`"
-
- | Key (Path) | Value |
- |----------------------------------------------------------|----------|
- | `traefik/http/services//mirroring/service` | `foobar` |
-
-??? info "`traefik/http/services//mirroring/mirrors//name`"
-
- | Key (Path) | Value |
- |-------------------------------------------------------------------|----------|
- | `traefik/http/services//mirroring/mirrors//name` | `foobar` |
-
-??? info "`traefik/http/services//mirroring/mirrors//percent`"
-
- | Key (Path) | Value |
- |----------------------------------------------------------------------|-------|
- | `traefik/http/services//mirroring/mirrors//percent` | `42` |
-
-??? info "`traefik/http/services//weighted/services//name`"
-
- | Key (Path) | Value |
- |-------------------------------------------------------------------|----------|
- | `traefik/http/services//weighted/services//name` | `foobar` |
-
-??? info "`traefik/http/services//weighted/services//weight`"
-
- | Key (Path) | Value |
- |---------------------------------------------------------------------|-------|
- | `traefik/http/services//weighted/services//weight` | `42` |
-
-??? info "`traefik/http/services//weighted/sticky/cookie/name`"
-
- | Key (Path) | Value |
- |--------------------------------------------------------------------|----------|
- | `traefik/http/services//weighted/sticky/cookie/name` | `foobar` |
-
-??? info "`traefik/http/services//weighted/sticky/cookie/secure`"
-
- | Key (Path) | Value |
- |----------------------------------------------------------------------|--------|
- | `traefik/http/services//weighted/sticky/cookie/secure` | `true` |
-
-??? info "`traefik/http/services//weighted/sticky/cookie/samesite`"
-
- | Key (Path) | Value |
- |------------------------------------------------------------------------|--------|
- | `traefik/http/services//weighted/sticky/cookie/samesite` | `none` |
-
-??? info "`traefik/http/services//weighted/sticky/cookie/httpOnly`"
-
- | Key (Path) | Value |
- |------------------------------------------------------------------------|--------|
- | `traefik/http/services//weighted/sticky/cookie/httpOnly` | `true` |
-
-??? info "`traefik/http/services//weighted/sticky/cookie/maxage`"
-
- | Key (Path) | Value |
- |----------------------------------------------------------------------|-------|
- | `traefik/http/services//weighted/sticky/cookie/maxage` | `42` |
-
-??? info "`traefik/http/services//failover/fallback`"
-
- See [Failover](../http/load-balancing/service.md#failover) for more information
-
- | Key (Path) | Value |
- |----------------------------------------------------------------------|-------|
- | `traefik/http/services//failover/fallback` | `backup` |
-
-??? info "`traefik/http/services//failover/healthcheck`"
-
- See [Failover](../http/load-balancing/service.md#failover) for more information
-
- | Key (Path) | Value |
- |----------------------------------------------------------------------|-------|
- | `traefik/http/services//failover/healthcheck` | `{}` |
-
-??? info "`traefik/http/services//failover/service`"
-
- See [Failover](../http/load-balancing/service.md#failover) for more information
-
- | Key (Path) | Value |
- |----------------------------------------------------------------------|-------|
- | `traefik/http/services//failover/service` | `main` |
-
-### Middleware
-
-More information about available middlewares in the dedicated [middlewares section](../http/middlewares/overview.md).
+| Key (Path) | Description | Value |
+|-----------------------------------------------------------------|-----------------------------------------------------------------|-----------------------------------------|
+| `traefik/http/services/myservice/loadbalancer/servers/0/url` | See [servers](../http/load-balancing/service.md#servers) for more information. | `http://:/` |
+| `traefik/http/services/myservice/loadbalancer/servers/0/preservePath` | See [servers](../http/load-balancing/service.md#servers) for more information. | `true` |
+| `traefik/http/services/myservice/loadbalancer/servers/0/weight` | See [servers](../http/load-balancing/service.md#servers) for more information. | `1` |
+| `traefik/http/services/myservice/loadbalancer/serverstransport` | Allows to reference a ServersTransport resource that is defined either with the File provider or the Kubernetes CRD one.
See [serverstransport](../http/load-balancing/serverstransport.md) for more information. | `foobar@file` |
+| | See [Service](../http/load-balancing/service.md) for more information. | `true` |
+| | See [health check](../http/load-balancing/service.md#health-check) for more information. | `foobar` |
+| `traefik/http/services/myservice/loadbalancer/healthcheck/hostname` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `example.org` |
+| `traefik/http/services/myservice/loadbalancer/healthcheck/interval` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `10` |
+| `traefik/http/services/myservice/loadbalancer/healthcheck/path` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `/foo` |
+| `traefik/http/services/myservice/loadbalancer/healthcheck/method` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `foobar` |
+| `traefik/http/services/myservice/loadbalancer/healthcheck/status` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `42` |
+| `traefik/http/services/myservice/loadbalancer/healthcheck/port` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `42` |
+| `traefik/http/services/myservice/loadbalancer/healthcheck/scheme` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `http` |
+| `traefik/http/services/myservice/loadbalancer/healthcheck/timeout` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `10` |
+| `traefik/http/services/myservice/loadbalancer/sticky` | See [Service](../http/load-balancing/service.md#sticky-sessions) for more information. | `true` |
+| `traefik/http/services/myservice/loadbalancer/sticky/cookie/httponly` | See [Service](../http/load-balancing/service.md#sticky-sessions) for more information. | `true` |
+| `traefik/http/services/myservice/loadbalancer/sticky/cookie/name` | See [Service](../http/load-balancing/service.md#sticky-sessions) for more information. | `foobar` |
+| `traefik/http/services/myservice/loadbalancer/sticky/cookie/path` | See [Service](../http/load-balancing/service.md#sticky-sessions) for more information. | `/foobar` |
+| `traefik/http/services/myservice/loadbalancer/sticky/cookie/secure` | See [Service](../http/load-balancing/service.md#sticky-sessions) for more information. | `true` |
+| `traefik/http/services/myservice/loadbalancer/sticky/cookie/samesite` | See [Service](../http/load-balancing/service.md#sticky-sessions) for more information. | `none` |
+| `traefik/http/services/myservice/loadbalancer/sticky/cookie/maxage` | See [Service](../http/load-balancing/service.md#sticky-sessions) for more information. | `42` |
+| `traefik/http/services/myservice/loadbalancer/responseforwarding/flushinterval` | See [Service](../http/load-balancing/service.md) for more information. | `10` |
+| `traefik/http/services//mirroring/service` | See [Service](../http/load-balancing/service.md#mirroring) for more information. | `foobar` |
+| `traefik/http/services//mirroring/mirrors//name` | See [Service](../http/load-balancing/service.md#mirroring) for more information. | `foobar` |
+| `traefik/http/services//mirroring/mirrors//percent` | See [Service](../http/load-balancing/service.md#mirroring)for more information. | `42` |
+| `traefik/http/services//weighted/services//name` | See [Service](../http/load-balancing/service.md#weighted-round-robin-wrr) for more information. | `foobar` |
+| `traefik/http/services//weighted/services//weight` | See [Service](../http/load-balancing/service.md#weighted-round-robin-wrr) for more information. | `42` |
+| `traefik/http/services//weighted/sticky/cookie/name` | See [Service](../http/load-balancing/service.md#weighted-round-robin-wrr) for more information. | `foobar` |
+| `traefik/http/services//weighted/sticky/cookie/secure` | See [Service](../http/load-balancing/service.md#weighted-round-robin-wrr) for more information. | `true` |
+| `traefik/http/services//weighted/sticky/cookie/samesite` | See [Service](../http/load-balancing/service.md#weighted-round-robin-wrr) for more information. | `none` |
+| `traefik/http/services//weighted/sticky/cookie/httpOnly` | See [Service](../http/load-balancing/service.md#weighted-round-robin-wrr) for more information. | `true` |
+| `traefik/http/services//weighted/sticky/cookie/maxage` | See [Service](../http/load-balancing/service.md#weighted-round-robin-wrr) for more information. | `42` |
+| `traefik/http/services//failover/fallback` | See [Failover](../http/load-balancing/service.md#failover) for more information. | `backup` |
+| `traefik/http/services//failover/healthcheck` | See [Failover](../http/load-balancing/service.md#failover) for more information. | `{}` |
+| `traefik/http/services//failover/service` | See [Failover](../http/load-balancing/service.md#failover) for more information. | `main` |
+
+#### Middleware
+
+##### Configuration Options
+
+| Key (Path) | Description | Value |
+|-----------------------------------------------------------------|-----------------------------------------------------------------|-----------------------------------------|
+| `traefik/http/middlewares/mymiddleware/middleware_type/middleware_option` | With `middleware_type` the type of middleware (ex: `forwardAuth`, `headers`, etc)
and `middleware_option` the middleware option to set (ex for the middleware `addPrefix`: `prefix`).
More information about available middlewares in the dedicated [middlewares section](../http/middlewares/overview.md). | `foobar` |
!!! warning "The character `@` is not authorized in the middleware name."
@@ -393,142 +93,68 @@ More information about available middlewares in the dedicated [middlewares secti
If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared.
+##### Configuration Example
+
+```bash
+# Declaring a middleware
+traefik/http/middlewares/myAddPrefix/addPrefix/prefix=/foobar
+# Referencing a middleware
+traefik/http/routers//middlewares/0=myAddPrefix
+```
+
+#### ServerTransport
+
+##### Configuration Options
+
+| Key (Path) | Description | Value |
+|-----------------------------------------------------------------|-----------------------------------------------------------------|-----------------------------------------|
+| `traefik/http/serversTransports//st_option` | With `st_option` the ServerTransport option to set (ex `maxIdleConnsPerHost`).
More information about available options in the dedicated [ServerTransport section](../http/load-balancing/serverstransport.md). | ServerTransport Options |
+
+##### Configuration Example
+
+```bash
+# Declaring a ServerTransport
+traefik/http/serversTransports/myServerTransport/maxIdleConnsPerHost=-1
+traefik/http/serversTransports/myServerTransport/certificates/0/certFile=mypath/cert.pem
+traefik/http/serversTransports/myServerTransport/certificates/0/keyFile=mypath/key.pem
+# Referencing a middleware
+traefik/http/services/myService/serversTransports/0=myServerTransport
+```
+
### TCP
You can declare TCP Routers and/or Services using KV.
-#### TCP Routers
+#### Routers
-??? info "`traefik/tcp/routers//entrypoints`"
+| Key (Path) | Description | Value |
+|-------------------------------------------------|-------------------------------------------------|-------|
+| `traefik/tcp/routers/mytcprouter/entrypoints/0` | See [entry points](../../install-configuration/entrypoints.md) for more information. | `ep1` |
+| `traefik/tcp/routers/mytcprouter/entrypoints/1` | See [entry points](../../install-configuration/entrypoints.md) for more information. | `ep2` |
+| `traefik/tcp/routers/my-router/rule` | See [entry points](../../install-configuration/entrypoints.md) for more information. | ```HostSNI(`example.com`)``` |
+| `traefik/tcp/routers/mytcprouter/service` | See [service](../tcp/service.md) for more information. | `myservice` |
+| `traefik/tcp/routers/mytcprouter/tls` | See [TLS](../tcp/tls.md) for more information. | `true` |
+| `traefik/tcp/routers/mytcprouter/tls/certresolver` | See [certResolver](../tcp/tls.md#configuration-options) for more information. | `myresolver` |
+| `traefik/tcp/routers/mytcprouter/tls/domains/0/main` | See [TLS](../tcp/tls.md) for more information. | `example.org` |
+| `traefik/tcp/routers/mytcprouter/tls/domains/0/sans/0` | See [TLS](../tcp/tls.md) for more information. | `test.example.org` |
+| `traefik/tcp/routers/mytcprouter/tls/domains/0/sans/1` | See [TLS](../tcp/tls.md) for more information. | `dev.example.org` |
+| `traefik/tcp/routers/mytcprouter/tls/options` | See [TLS](../tcp/tls.md) for more information. | `foobar` |
+| `traefik/tcp/routers/mytcprouter/tls/passthrough` | See [TLS](../tcp/tls.md) for more information. | `true` |
+| `traefik/tcp/routers/mytcprouter/priority` | See [priority](../tcp/routing/rules-and-priority.md#priority-calculation) for more information. | `42` |
- See [entry points](../../install-configuration/entrypoints.md) for more information.
+#### Services
- | Key (Path) | Value |
- |-------------------------------------------------|-------|
- | `traefik/tcp/routers/mytcprouter/entrypoints/0` | `ep1` |
- | `traefik/tcp/routers/mytcprouter/entrypoints/1` | `ep2` |
-
-??? info "`traefik/tcp/routers//rule`"
+| Key (Path) | Description | Value |
+|--------------------------------------------------------------------|--------------------------------------------------------------------|------------------|
+| `traefik/tcp/services/mytcpservice/loadbalancer/servers/0/address` | See [servers](../tcp/service.md#servers-load-balancer) for more information. | `xx.xx.xx.xx:xx` |
+| `traefik/tcp/services/mytcpservice/loadbalancer/servers/0/tls` | See [servers](../tcp/service.md#servers-load-balancer) for more information. | `true` |
+| `traefik/tcp/services/myservice/loadbalancer/serverstransport` | Allows to reference a ServersTransport resource that is defined either with the File provider or the Kubernetes CRD one.
See [serverstransport](../tcp/serverstransport.md) for more information. | `foobar@file` |
+| `traefik/tcp/services//weighted/services/0/name` | See [Service](../tcp/service.md#weighted-round-robin) for more information. | `foobar` |
+| `traefik/tcp/services//weighted/services/0/weight` | See [Service](../tcp/service.md#weighted-round-robin) for more information. | `42` |
- See [entry points](../../install-configuration/entrypoints.md) for more information.
+#### Middleware
- | Key (Path) | Value |
- |--------------------------------------|------------------------------|
- | `traefik/tcp/routers/my-router/rule` | ```HostSNI(`example.com`)``` |
-
-??? info "`traefik/tcp/routers//service`"
-
- See [service](../tcp/service.md) for more information.
-
- | Key (Path) | Value |
- |-------------------------------------------|-------------|
- | `traefik/tcp/routers/mytcprouter/service` | `myservice` |
-
-??? info "`traefik/tcp/routers//tls`"
-
- See [TLS](../tcp/tls.md) for more information.
-
- | Key (Path) | Value |
- |---------------------------------------|--------|
- | `traefik/tcp/routers/mytcprouter/tls` | `true` |
-
-??? info "`traefik/tcp/routers//tls/certresolver`"
-
- See [certResolver](../tcp/tls.md#configuration-options) for more information.
-
- | Key (Path) | Value |
- |----------------------------------------------------|--------------|
- | `traefik/tcp/routers/mytcprouter/tls/certresolver` | `myresolver` |
-
-??? info "`traefik/tcp/routers//tls/domains//main`"
-
- See [TLS](../tcp/tls.md) for more information.
-
- | Key (Path) | Value |
- |------------------------------------------------------|---------------|
- | `traefik/tcp/routers/mytcprouter/tls/domains/0/main` | `example.org` |
-
-??? info "`traefik/tcp/routers//tls/domains//sans`"
-
- See [TLS](../tcp/tls.md) for more information.
-
- | Key (Path) | Value |
- |--------------------------------------------------------|--------------------|
- | `traefik/tcp/routers/mytcprouter/tls/domains/0/sans/0` | `test.example.org` |
- | `traefik/tcp/routers/mytcprouter/tls/domains/0/sans/1` | `dev.example.org` |
-
-??? info "`traefik/tcp/routers//tls/options`"
-
- See [TLS](../tcp/tls.md) for more information.
-
- | Key (Path) | Value |
- |-----------------------------------------------|----------|
- | `traefik/tcp/routers/mytcprouter/tls/options` | `foobar` |
-
-??? info "`traefik/tcp/routers//tls/passthrough`"
-
- See [TLS](../tcp/tls.md) for more information.
-
- | Key (Path) | Value |
- |---------------------------------------------------|--------|
- | `traefik/tcp/routers/mytcprouter/tls/passthrough` | `true` |
-
-??? info "`traefik/tcp/routers//priority`"
-
- See [priority](../tcp/router/rules-and-priority.md#priority) for more information.
-
- | Key (Path) | Value |
- |------------------------------------------|-------|
- | `traefik/tcp/routers/mytcprouter/priority` | `42` |
-
-#### TCP Services
-
-??? info "`traefik/tcp/services//loadbalancer/servers//address`"
-
- See [servers](../tcp/service.md#servers-load-balancer) for more information.
-
- | Key (Path) | Value |
- |--------------------------------------------------------------------|------------------|
- | `traefik/tcp/services/mytcpservice/loadbalancer/servers/0/address` | `xx.xx.xx.xx:xx` |
-
-??? info "`traefik/tcp/services//loadbalancer/servers//tls`"
-
- See [servers](../tcp/service.md#servers-load-balancer) for more information.
-
- | Key (Path) | Value |
- |--------------------------------------------------------------------|------------------|
- | `traefik/tcp/services/mytcpservice/loadbalancer/servers/0/tls` | `true` |
-
-??? info "`traefik/tcp/services//loadbalancer/proxyprotocol/version`"
-
- See [PROXY protocol](../tcp/service.md#proxy-protocol) for more information.
-
- | Key (Path) | Value |
- |------------------------------------------------------------------------|-------|
- | `traefik/tcp/services/mytcpservice/loadbalancer/proxyprotocol/version` | `1` |
-
-??? info "`traefik/tcp/services//loadbalancer/serverstransport`"
-
- Allows to reference a ServersTransport resource that is defined either with the File provider or the Kubernetes CRD one.
- See [serverstransport](../tcp/serverstransport.md) for more information.
-
- | Key (Path) | Value |
- |-----------------------------------------------------------------|---------------|
- | `traefik/tcp/services/myservice/loadbalancer/serverstransport` | `foobar@file` |
-
-??? info "`traefik/tcp/services//weighted/services//name`"
-
- | Key (Path) | Value |
- |---------------------------------------------------------------------|----------|
- | `traefik/tcp/services//weighted/services/0/name` | `foobar` |
-
-??? info "`traefik/tcp/services//weighted/services//weight`"
-
- | Key (Path) | Value |
- |------------------------------------------------------------------|-------|
- | `traefik/tcp/services//weighted/services/0/weight` | `42` |
-
-#### TCP Middleware
+##### Configuration Options
You can declare pieces of middleware using tags starting with `traefik/tcp/middlewares/{name-of-your-choice}.`, followed by the middleware type/options.
@@ -536,80 +162,83 @@ For example, to declare a middleware [`InFlightConn`](../tcp/middlewares/infligh
More information about available middlewares in the dedicated [middlewares section](../tcp/middlewares/overview.md).
-??? example "Declaring and Referencing a Middleware"
-
- ```bash
- # ...
- # Declaring a middleware
- traefik/tcp/middlewares/test-inflightconn/amount=10
- # Referencing a middleware
- traefik/tcp/routers.my-service/middlewares=test-inflightconn
- ```
+| Key (Path) | Description | Value |
+|-----------------------------------------------------------------|-----------------------------------------------------------------|-----------------------------------------|
+| `traefik/tcp/middlewares/mymiddleware/middleware_type/middleware_option` | With `middleware_type` the type of middleware (ex: `inflightconn`)
and `middleware_option` the middleware option to set (ex for the middleware `inflightconn`: `amount`).
More information about available middlewares in the dedicated [middlewares section](../tcp/middlewares/overview.md). | `foobar` |
!!! warning "Conflicts in Declaration"
If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared.
+##### Configuration Example
+
+```bash
+# Declaring a middleware
+traefik/tcp/middlewares/test-inflightconn/amount=10
+# Referencing a middleware
+traefik/tcp/routers//middlewares/0=test-inflightconn
+```
+
+#### ServerTransport
+
+##### Configuration Options
+
+| Key (Path) | Description | Value |
+|-----------------------------------------------------------------|-----------------------------------------------------------------|-----------------------------------------|
+| `traefik/tcp/serversTransports//st_option` | With `st_option` the ServerTransport option to set (ex `maxIdleConnsPerHost`).
More information about available options in the dedicated [ServerTransport section](../tcp/serverstransport.md). | ServerTransport Options |
+
+##### Configuration Example
+
+```bash
+# Declaring a ServerTransport
+traefik/tcp/serversTransports/myServerTransport/maxIdleConnsPerHost=-1
+# Referencing a middleware
+traefik/tcp/services/myService/serversTransports/0=myServerTransport
+```
+
### UDP
You can declare UDP Routers and/or Services using KV.
-#### UDP Routers
+#### Routers
-??? info "`traefik/udp/routers//entrypoints/`"
+| Key (Path) | Description | Value |
+|------------------------------------------------------------------|------------------------------------------------------------------|-------|
+| `traefik/udp/routers/myudprouter/entrypoints/0` | See [UDP Router](../udp/routing/rules-priority.md#entrypoints) for more information. | `foobar` |
+| `traefik/udp/routers/myudprouter/service` | See [UDP Router](../udp/routing/rules-priority.md#configuration-example) for more information. | `foobar` |
- | Key (Path) | Value |
- |------------------------------------------------------------------|-------|
- | `traefik/udp/routers/myudprouter/entrypoints/0` | `foobar` |
+#### Services
-??? info "`traefik/udp/routers//service`"
-
- | Key (Path) | Value |
- |------------------------------------------------------------------|-------|
- | `traefik/udp/routers/myudprouter/service` | `foobar` |
-
-#### UDP Services
-
-??? info "`traefik/udp/services/loadBalancer/servers//address`"
-
- | Key (Path) | Value |
- |------------------------------------------------------------------|-------|
- | `traefik/udp/services/loadBalancer/servers//address` | `foobar` |
-
-??? info "`traefik/udp/services/weighted/services//name`"
-
- | Key (Path) | Value |
- |------------------------------------------------------------------|-------|
- | `traefik/udp/services/weighted/services/0/name` | `foobar` |
-
-??? info "`traefik/udp/services/weighted/services//name`"
-
- | Key (Path) | Value |
- |------------------------------------------------------------------|-------|
- | `traefik/udp/services/weighted/servers/0/weight` | `42` |
+| Key (Path) | Description | Value |
+|------------------------------------------------------------------|------------------------------------------------------------------|-------|
+| `traefik/udp/services/loadBalancer/servers//address` | See [UDP Service](../udp/service.md) for more information. | `foobar` |
+| `traefik/udp/services/weighted/services/0/name` | See [UDP Service](../udp/service.md) for more information. | `foobar` |
+| `traefik/udp/services/weighted/servers/0/weight` |See [UDP Service](../udp/service.md) for more information. | `42` |
## TLS
### TLS Options
-With the KV provider, you configure some parameters of the TLS connection using the `tls/options` key. For example, you can define a basic setup like this:
+With the KV provider, you configure some parameters of the TLS connection using the `tls/options` key.
-| Key (Path) | Value |
-|------------------------------------------------------|----------|
-| `traefik/tls/options/Options0/alpnProtocols/0` | `foobar` |
-| `traefik/tls/options/Options0/cipherSuites/0` | `foobar` |
-| `traefik/tls/options/Options0/clientAuth/caFiles/0` | `foobar` |
-| `traefik/tls/options/Options0/disableSessiontickets` | `true` |
+For example, you can define a basic setup like this:
-For more information on the available TLS options that can be configured, please refer to the [TLS Options](../http/tls/tls-options.md) page.
+| Key (Path) | Description | Value |
+|------------------------------------------------------|------------------------------------------------------|----------|
+| `traefik/tls/options/Options0/alpnProtocols/0` | See [TLS Options](../http/tls/tls-options.md) for more information. | `foobar` |
+| `traefik/tls/options/Options0/cipherSuites/0` | See [TLS Options](../http/tls/tls-options.md) for more information. | `foobar` |
+| `traefik/tls/options/Options0/clientAuth/caFiles/0` | See [TLS Options](../http/tls/tls-options.md) for more information. | `foobar` |
+| `traefik/tls/options/Options0/disableSessiontickets` | See [TLS Options](../http/tls/tls-options.md) for more information. | `true` |
### TLS Default Generated Certificates
-You can configure Traefik to use an ACME provider (like Let's Encrypt) to generate the default certificate. The configuration to resolve the default certificate should be defined in a TLS store:
+You can configure Traefik to use an ACME provider (like Let's Encrypt) to generate the default certificate.
-| Key (Path) | Value |
-|----------------------------------------------------------------|----------|
-| `traefik/tls/stores/Store0/defaultGeneratedCert/domain/main` | `foobar` |
-| `traefik/tls/stores/Store0/defaultGeneratedCert/domain/sans/0` | `foobar` |
-| `traefik/tls/stores/Store0/defaultGeneratedCert/domain/sans/1` | `foobar` |
-| `traefik/tls/stores/Store0/defaultGeneratedCert/resolver` | `foobar` |
+The configuration to resolve the default certificate should be defined in a TLS store.
+
+| Key (Path) | Description | Value |
+|----------------------------------------------------------------|----------------------------------------------------------------|----------|
+| `traefik/tls/stores/Store0/defaultGeneratedCert/domain/main` | See [TLS](../http/tls/tls-certificates.md#certificates-stores) for more information. | `foobar` |
+| `traefik/tls/stores/Store0/defaultGeneratedCert/domain/sans/0` | See [TLS](../http/tls/tls-certificates.md#certificates-stores) for more information| `foobar` |
+| `traefik/tls/stores/Store0/defaultGeneratedCert/domain/sans/1` | See [TLS](../http/tls/tls-certificates.md#certificates-stores) for more information| `foobar` |
+| `traefik/tls/stores/Store0/defaultGeneratedCert/resolver` | See [TLS](../http/tls/tls-certificates.md#certificates-stores) for more information| `foobar` |
diff --git a/docs/content/reference/routing-configuration/other-providers/nomad.md b/docs/content/reference/routing-configuration/other-providers/nomad.md
index b8cc400c9..18c962ed7 100644
--- a/docs/content/reference/routing-configuration/other-providers/nomad.md
+++ b/docs/content/reference/routing-configuration/other-providers/nomad.md
@@ -25,7 +25,7 @@ With Nomad, Traefik can leverage tags attached to a service to generate routing
### General
-Traefik creates, for each Nomad service, a corresponding Traefik [service](../http/load-balancing/service.md) and [router](../http/router/rules-and-priority.md).
+Traefik creates, for each Nomad service, a corresponding Traefik [service](../http/load-balancing/service.md) and [router](../http/routing/rules-and-priority.md).
The Traefik service automatically gets a server per instance in this Nomad service, and the router gets a default rule attached to it, based on the Nomad service name.
@@ -37,7 +37,7 @@ For example, to change the rule, you could add the tag ```traefik.http.routers.m
??? info "`traefik.http.routers..rule`"
- See [rule](../http/router/rules-and-priority.md) for more information.
+ See [rule](../http/routing/rules-and-priority.md) for more information.
```yaml
traefik.http.routers.myrouter.rule=Host(`example.com`)
@@ -50,7 +50,7 @@ For example, to change the rule, you could add the tag ```traefik.http.routers.m
RuleSyntax option is deprecated and will be removed in the next major version.
Please do not use this field and rewrite the router rules to use the v3 syntax.
- See [ruleSyntax](../http/router/rules-and-priority.md#rulesyntax) for more information.
+ See [ruleSyntax](../http/routing/rules-and-priority.md#rulesyntax) for more information.
```yaml
traefik.http.routers.myrouter.ruleSyntax=v3
@@ -120,7 +120,7 @@ For example, to change the rule, you could add the tag ```traefik.http.routers.m
??? info "`traefik.http.routers..priority`"
- See [priority](../http/router/rules-and-priority.md#priority-calculation) for more information.
+ See [priority](../http/routing/rules-and-priority.md#priority-calculation) for more information.
```yaml
traefik.http.routers.myrouter.priority=42
@@ -222,6 +222,14 @@ you'd add the tag `traefik.http.services.{name-of-your-choice}.loadbalancer.pass
traefik.http.services.myservice.loadbalancer.healthcheck.interval=10
```
+??? info "`traefik.http.services..loadbalancer.healthcheck.unhealthyinterval`"
+
+ See [health check](../http/load-balancing/service.md#health-check) for more information.
+
+ ```yaml
+ traefik.http.services.myservice.loadbalancer.healthcheck.unhealthyinterval=10
+ ```
+
??? info "`traefik.http.services..loadbalancer.healthcheck.path`"
See [health check](../http/load-balancing/service.md#health-check) for more information.
@@ -369,7 +377,7 @@ You can declare TCP Routers and/or Services using tags.
??? info "`traefik.tcp.routers..rule`"
- See [rule](../tcp/router/rules-and-priority.md#rules) for more information.
+ See [rule](../tcp/routing/rules-and-priority.md#rules) for more information.
```yaml
traefik.tcp.routers.mytcprouter.rule=HostSNI(`example.com`)
@@ -390,7 +398,7 @@ You can declare TCP Routers and/or Services using tags.
??? info "`traefik.tcp.routers..priority`"
- See [priority](../tcp/router/rules-and-priority.md#priority) for more information.
+ See [priority](../tcp/routing/rules-and-priority.md#priority-calculation) for more information.
```yaml
traefik.tcp.routers.myrouter.priority=42
@@ -446,7 +454,7 @@ You can declare TCP Routers and/or Services using tags.
??? info "`traefik.tcp.routers..tls.passthrough`"
- See [Passthrough](../tcp/tls.md#passthrough) for more information.
+ See [Passthrough](../tcp/tls.md#opt-passthrough) for more information.
```yaml
traefik.tcp.routers.mytcprouter.tls.passthrough=true
@@ -470,14 +478,6 @@ You can declare TCP Routers and/or Services using tags.
traefik.tcp.services.mytcpservice.loadbalancer.server.tls=true
```
-??? info "`traefik.tcp.services..loadbalancer.proxyprotocol.version`"
-
- See [PROXY protocol](../tcp/service.md#proxy-protocol) for more information.
-
- ```yaml
- traefik.tcp.services.mytcpservice.loadbalancer.proxyprotocol.version=1
- ```
-
??? info "`traefik.tcp.services..loadbalancer.serverstransport`"
Allows to reference a ServersTransport resource that is defined either with the File provider or the Kubernetes CRD one.
diff --git a/docs/content/reference/routing-configuration/other-providers/swarm.md b/docs/content/reference/routing-configuration/other-providers/swarm.md
index 51b2371c0..427484d8d 100644
--- a/docs/content/reference/routing-configuration/other-providers/swarm.md
+++ b/docs/content/reference/routing-configuration/other-providers/swarm.md
@@ -48,7 +48,6 @@ With Docker Swarm, Traefik can leverage labels attached to a service to generate
then that service is automatically assigned to the router.
```yaml
- version: "3"
services:
my-container:
deploy:
@@ -67,7 +66,6 @@ With Docker Swarm, Traefik can leverage labels attached to a service to generate
Forward requests for `http://example.com` to `http://:12345`:
```yaml
- version: "3"
services:
my-container:
# ...
@@ -93,7 +91,6 @@ With Docker Swarm, Traefik can leverage labels attached to a service to generate
In this example, requests are forwarded for `http://example-a.com` to `http://:8000` in addition to `http://example-b.com` forwarding to `http://:9000`:
```yaml
- version: "3"
services:
my-container:
# ...
@@ -119,7 +116,7 @@ With Docker Swarm, Traefik can leverage labels attached to a service to generate
### General
-Traefik creates, for each container, a corresponding [service](../http/load-balancing/service.md) and [router](../http/router/rules-and-priority.md).
+Traefik creates, for each container, a corresponding [service](../http/load-balancing/service.md) and [router](../http/routing/rules-and-priority.md).
The Service automatically gets a server per instance of the container,
and the router automatically gets a rule defined by `defaultRule` (if no rule for it was defined in labels).
@@ -161,7 +158,7 @@ For example, to change the rule, you could add the label ```traefik.http.routers
??? info "`traefik.http.routers..rule`"
- See [rule](../http/router/rules-and-priority.md) for more information.
+ See [rule](../http/routing/rules-and-priority.md) for more information.
```yaml
- "traefik.http.routers.myrouter.rule=Host(`example.com`)"
@@ -174,7 +171,7 @@ For example, to change the rule, you could add the label ```traefik.http.routers
RuleSyntax option is deprecated and will be removed in the next major version.
Please do not use this field and rewrite the router rules to use the v3 syntax.
- See [ruleSyntax](../http/router/rules-and-priority.md#rulesyntax) for more information.
+ See [ruleSyntax](../http/routing/rules-and-priority.md#rulesyntax) for more information.
```yaml
traefik.http.routers.myrouter.ruleSyntax=v3
@@ -268,7 +265,7 @@ For example, to change the rule, you could add the label ```traefik.http.routers
??? info "`traefik.http.routers..priority`"
- See [priority](../http/router/rules-and-priority.md#priority-calculation) for more information.
+ See [priority](../http/routing/rules-and-priority.md#priority-calculation) for more information.
```yaml
- "traefik.http.routers.myrouter.priority=42"
@@ -351,6 +348,14 @@ you'd add the label `traefik.http.services..loadbalancer.pa
- "traefik.http.services.myservice.loadbalancer.healthcheck.interval=10s"
```
+??? info "`traefik.http.services..loadbalancer.healthcheck.unhealthyinterval`"
+
+ See [health check](../http/load-balancing/service.md#health-check) for more information.
+
+ ```yaml
+ - "traefik.http.services.myservice.loadbalancer.healthcheck.unhealthyinterval=10s"
+ ```
+
??? info "`traefik.http.services..loadbalancer.healthcheck.path`"
See [health check](../http/load-balancing/service.md#health-check) for more information.
@@ -515,7 +520,7 @@ You can declare TCP Routers and/or Services using labels.
??? info "`traefik.tcp.routers..rule`"
- See [rule](../tcp/router/rules-and-priority.md#rules) for more information.
+ See [rule](../tcp/routing/rules-and-priority.md#rules) for more information.
```yaml
- "traefik.tcp.routers.mytcprouter.rule=HostSNI(`example.com`)"
@@ -584,7 +589,7 @@ You can declare TCP Routers and/or Services using labels.
??? info "`traefik.tcp.routers..tls.passthrough`"
- See [Passthrough](../tcp/tls.md#passthrough) for more information.
+ See [Passthrough](../tcp/tls.md#opt-passthrough) for more information.
```yaml
- "traefik.tcp.routers.mytcprouter.tls.passthrough=true"
@@ -592,7 +597,7 @@ You can declare TCP Routers and/or Services using labels.
??? info "`traefik.tcp.routers..priority`"
- See [priority](../tcp/router/rules-and-priority.md) for more information.
+ See [priority](../tcp/routing/rules-and-priority.md) for more information.
```yaml
- "traefik.tcp.routers.myrouter.priority=42"
@@ -616,14 +621,6 @@ You can declare TCP Routers and/or Services using labels.
- "traefik.tcp.services.mytcpservice.loadbalancer.server.tls=true"
```
-??? info "`traefik.tcp.services..loadbalancer.proxyprotocol.version`"
-
- See [PROXY protocol](../tcp/service.md#proxy-protocol) for more information.
-
- ```yaml
- - "traefik.tcp.services.mytcpservice.loadbalancer.proxyprotocol.version=1"
- ```
-
??? info "`traefik.tcp.services..loadbalancer.serverstransport`"
Allows to reference a ServersTransport resource that is defined either with the File provider or the Kubernetes CRD one.
@@ -733,7 +730,7 @@ otherwise it will randomly pick one (depending on how docker is returning them).
#### `traefik.swarm.lbswarm`
```yaml
-- "traefik.docker.lbswarm=true"
+- "traefik.swarm.lbswarm=true"
```
Enables Swarm's inbuilt load balancer (only relevant in Swarm Mode).
diff --git a/docs/content/reference/routing-configuration/tcp/middlewares/inflightconn.md b/docs/content/reference/routing-configuration/tcp/middlewares/inflightconn.md
index 3c12074d8..17cd4cb75 100644
--- a/docs/content/reference/routing-configuration/tcp/middlewares/inflightconn.md
+++ b/docs/content/reference/routing-configuration/tcp/middlewares/inflightconn.md
@@ -52,4 +52,4 @@ spec:
| Field | Description | Default | Required |
|:------|:------------|------------------|-------|
-| `amount` | The `amount` option defines the maximum amount of allowed simultaneous connections.
The middleware closes the connection if there are already `amount` connections opened. | "" | Yes |
+| `amount` | The `amount` option defines the maximum amount of allowed simultaneous connections.
The middleware closes the connection if there are already `amount` connections opened. | "" | Yes |
diff --git a/docs/content/reference/routing-configuration/tcp/middlewares/ipallowlist.md b/docs/content/reference/routing-configuration/tcp/middlewares/ipallowlist.md
index fc9e3ace4..6f8916fa4 100644
--- a/docs/content/reference/routing-configuration/tcp/middlewares/ipallowlist.md
+++ b/docs/content/reference/routing-configuration/tcp/middlewares/ipallowlist.md
@@ -57,4 +57,4 @@ spec:
| Field | Description | Default | Required |
|:------|:------------|------------------|-------|
-| `sourceRange` | The `sourceRange` option sets the allowed IPs (or ranges of allowed IPs by using CIDR notation).| | Yes |
+| `sourceRange` | The `sourceRange` option sets the allowed IPs (or ranges of allowed IPs by using CIDR notation).| | Yes |
diff --git a/docs/content/reference/routing-configuration/tcp/middlewares/overview.md b/docs/content/reference/routing-configuration/tcp/middlewares/overview.md
index 6c1066b0d..8cc6269fd 100644
--- a/docs/content/reference/routing-configuration/tcp/middlewares/overview.md
+++ b/docs/content/reference/routing-configuration/tcp/middlewares/overview.md
@@ -108,5 +108,5 @@ spec:
| Middleware | Purpose | Area |
|-------------------------------------------|---------------------------------------------------|-----------------------------|
-| [InFlightConn](inflightconn.md) | Limits the number of simultaneous connections. | Security, Request lifecycle |
-| [IPAllowList](ipallowlist.md) | Limit the allowed client IPs. | Security, Request lifecycle |
+| [InFlightConn](inflightconn.md) | Limits the number of simultaneous connections. | Security, Request lifecycle |
+| [IPAllowList](ipallowlist.md) | Limit the allowed client IPs. | Security, Request lifecycle |
diff --git a/docs/content/reference/routing-configuration/tcp/routing/router.md b/docs/content/reference/routing-configuration/tcp/routing/router.md
new file mode 100644
index 000000000..4761ebf5c
--- /dev/null
+++ b/docs/content/reference/routing-configuration/tcp/routing/router.md
@@ -0,0 +1,104 @@
+---
+title: "Traefik TCP Routers Documentation"
+description: "TCP routers are responsible for connecting incoming TCP connections to the services that can handle them. Read the technical documentation."
+---
+
+## TCP Router
+
+A TCP router is in charge of connecting incoming TCP connections to the services that can handle them. TCP routers analyze incoming connections based on rules, and when a match is found, forward the connection through any configured middlewares to the appropriate service.
+
+!!! note "TCP vs HTTP Routing"
+ If both HTTP routers and TCP routers listen to the same EntryPoint, the TCP routers will apply before the HTTP routers. If no matching route is found for the TCP routers, then the HTTP routers will take over.
+
+## Configuration Example
+
+```yaml tab="Structured (YAML)"
+tcp:
+ routers:
+ my-tcp-router:
+ entryPoints:
+ - "tcp-ep"
+ - "websecure"
+ rule: "HostSNI(`example.com`)"
+ priority: 10
+ middlewares:
+ - "tcp-ipallowlist"
+ tls:
+ passthrough: false
+ certResolver: "letsencrypt"
+ options: "modern-tls"
+ domains:
+ - main: "example.com"
+ sans:
+ - "www.example.com"
+ service: my-tcp-service
+```
+
+```toml tab="Structured (TOML)"
+[tcp.routers]
+ [tcp.routers.my-tcp-router]
+ entryPoints = ["tcp-ep", "websecure"]
+ rule = "HostSNI(`example.com`)"
+ priority = 10
+ middlewares = ["tcp-ipallowlist"]
+ service = "my-tcp-service"
+
+ [tcp.routers.my-tcp-router.tls]
+ passthrough = false
+ certResolver = "letsencrypt"
+ options = "modern-tls"
+
+ [[tcp.routers.my-tcp-router.tls.domains]]
+ main = "example.com"
+ sans = ["www.example.com"]
+```
+
+```yaml tab="Labels"
+labels:
+ - "traefik.tcp.routers.my-tcp-router.entrypoints=tcp-ep,websecure"
+ - "traefik.tcp.routers.my-tcp-router.rule=HostSNI(`example.com`)"
+ - "traefik.tcp.routers.my-tcp-router.priority=10"
+ - "traefik.tcp.routers.my-tcp-router.middlewares=tcp-ipallowlist"
+ - "traefik.tcp.routers.my-tcp-router.tls.certresolver=letsencrypt"
+ - "traefik.tcp.routers.my-tcp-router.tls.passthrough=false"
+ - "traefik.tcp.routers.my-tcp-router.tls.options=modern-tls"
+ - "traefik.tcp.routers.my-tcp-router.tls.domains[0].main=example.com"
+ - "traefik.tcp.routers.my-tcp-router.tls.domains[0].sans=www.example.com"
+ - "traefik.tcp.routers.my-tcp-router.service=my-tcp-service"
+```
+
+```json tab="Tags"
+{
+ "Tags": [
+ "traefik.tcp.routers.my-tcp-router.entrypoints=tcp-ep,websecure",
+ "traefik.tcp.routers.my-tcp-router.rule=HostSNI(`example.com`)",
+ "traefik.tcp.routers.my-tcp-router.priority=10",
+ "traefik.tcp.routers.my-tcp-router.middlewares=tcp-ipallowlist",
+ "traefik.tcp.routers.my-tcp-router.tls.certresolver=letsencrypt",
+ "traefik.tcp.routers.my-tcp-router.tls.passthrough=false",
+ "traefik.tcp.routers.my-tcp-router.tls.options=modern-tls",
+ "traefik.tcp.routers.my-tcp-router.tls.domains[0].main=example.com",
+ "traefik.tcp.routers.my-tcp-router.tls.domains[0].sans=www.example.com",
+ "traefik.tcp.routers.my-tcp-router.service=my-tcp-service"
+ ]
+}
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|--------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------|----------|
+| `entryPoints` | The list of entry points to which the router is attached. If not specified, TCP routers are attached to all TCP entry points. | All TCP entry points | No |
+| `rule` | Rules are a set of matchers configured with values, that determine if a particular connection matches specific criteria. If the rule is verified, the router becomes active, calls middlewares, and then forwards the connection to the service. See [Rules & Priority](./rules-and-priority.md) for details. | | Yes |
+| `priority` | To avoid rule overlap, routes are sorted, by default, in descending order using rules length. The priority is directly equal to the length of the rule, and so the longest length has the highest priority. A value of `0` for the priority is ignored. See [Rules & Priority](./rules-and-priority.md) for details. | Rule length | No |
+| `middlewares` | The list of middlewares that are applied to the router. Middlewares are applied in the order they are declared. See [TCP Middlewares overview](../middlewares/overview.md) for available TCP middlewares. | | No |
+| `tls` | TLS configuration for the router. When specified, the router will only handle TLS connections. See [TLS configuration](../tls.md) for detailed TLS options. | | No |
+| `service` | The name of the service that will handle the matched connections. Services can be load balancer services or weighted round robin services. See [TCP Service](../service.md) for details. | | Yes |
+
+## Router Naming
+
+- The character `@` is not authorized in the router name
+- Router names should be descriptive and follow your naming conventions
+- In provider-specific configurations (Docker, Kubernetes), router names are often auto-generated based on service names and rules
+
+{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/tcp/router/rules-and-priority.md b/docs/content/reference/routing-configuration/tcp/routing/rules-and-priority.md
similarity index 85%
rename from docs/content/reference/routing-configuration/tcp/router/rules-and-priority.md
rename to docs/content/reference/routing-configuration/tcp/routing/rules-and-priority.md
index f5a259775..359a17846 100644
--- a/docs/content/reference/routing-configuration/tcp/router/rules-and-priority.md
+++ b/docs/content/reference/routing-configuration/tcp/routing/rules-and-priority.md
@@ -18,10 +18,10 @@ The table below lists all the available matchers:
| Rule | Description |
|-------------------------------------------------------------|:-------------------------------------------------------------------------------------------------|
-| [```HostSNI(`domain`)```](#hostsni-and-hostsniregexp) | Checks if the connection's Server Name Indication is equal to `domain`.
More information [here](#hostsni-and-hostsniregexp). |
-| [```HostSNIRegexp(`regexp`)```](#hostsni-and-hostsniregexp) | Checks if the connection's Server Name Indication matches `regexp`.
Use a [Go](https://golang.org/pkg/regexp/) flavored syntax.
More information [here](#hostsni-and-hostsniregexp). |
-| [```ClientIP(`ip`)```](#clientip) | Checks if the connection's client IP correspond to `ip`. It accepts IPv4, IPv6 and CIDR formats.
More information [here](#clientip). |
-| [```ALPN(`protocol`)```](#alpn) | Checks if the connection's ALPN protocol equals `protocol`.
More information [here](#alpn). |
+| [```HostSNI(`domain`)```](#hostsni-and-hostsniregexp) | Checks if the connection's Server Name Indication is equal to `domain`.
More information [here](#hostsni-and-hostsniregexp). |
+| [```HostSNIRegexp(`regexp`)```](#hostsni-and-hostsniregexp) | Checks if the connection's Server Name Indication matches `regexp`.
Use a [Go](https://golang.org/pkg/regexp/) flavored syntax.
More information [here](#hostsni-and-hostsniregexp). |
+| [```ClientIP(`ip`)```](#clientip) | Checks if the connection's client IP correspond to `ip`. It accepts IPv4, IPv6 and CIDR formats.
More information [here](#clientip). |
+| [```ALPN(`protocol`)```](#alpn) | Checks if the connection's ALPN protocol equals `protocol`.
More information [here](#alpn). |
!!! tip "Backticks or Quotes?"
diff --git a/docs/content/reference/routing-configuration/tcp/serverstransport.md b/docs/content/reference/routing-configuration/tcp/serverstransport.md
index 9677be35b..b3a865f94 100644
--- a/docs/content/reference/routing-configuration/tcp/serverstransport.md
+++ b/docs/content/reference/routing-configuration/tcp/serverstransport.md
@@ -84,19 +84,22 @@ labels:
## Configuration Options
-| Field | Description | Default | Required |
-|:------|:----------------------------------------------------------|:---------------------|:---------|
-| `serverstransport.`
`dialTimeout` | Defines the timeout when dialing the backend TCP service. If zero, no timeout exists. | 30s | No |
-| `serverstransport.`
`dialKeepAlive` | Defines the interval between keep-alive probes for an active network connection. | 15s | No |
-| `serverstransport.`
`terminationDelay` | Sets the time limit for the proxy to fully terminate connections on both sides after initiating the termination sequence, with a negative value indicating no deadline. More Information [here](#terminationdelay) | 100ms | No |
-| `serverstransport.`
`tls` | Defines the TLS configuration. An empty `tls` section enables TLS. | | No |
-| `serverstransport.`
`tls`
`.serverName` | Configures the server name that will be used for SNI. | | No |
-| `serverstransport.`
`tls`
`.certificates` | Defines the list of certificates (as file paths, or data bytes) that will be set as client certificates for mTLS. | | No |
-| `serverstransport.`
`tls`
`.insecureSkipVerify` | Controls whether the server's certificate chain and host name is verified. | false | No |
-| `serverstransport.`
`tls`
`.rootcas` | Defines the root certificate authorities to use when verifying server certificates. (for mTLS connections). | | No |
-| `serverstransport.`
`tls.`
`peerCertURI` | Defines the URI used to match against SAN URIs during the server's certificate verification. | false | No |
-| `serverstransport.`
`spiffe`
`.ids` | Allow SPIFFE IDs.
This takes precedence over the SPIFFE TrustDomain. | | No |
-| `serverstransport.`
`spiffe`
`.trustDomain` | Allow SPIFFE trust domain. | "" | No |
+| Field | Description | Default | Required |
+|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
+| `serverstransport.`
`dialTimeout` | Defines the timeout when dialing the backend TCP service. If zero, no timeout exists. | 30s | No |
+| `serverstransport.`
`dialKeepAlive` | Defines the interval between keep-alive probes for an active network connection. | 15s | No |
+| `serverstransport.`
`terminationDelay` | Sets the time limit for the proxy to fully terminate connections on both sides after initiating the termination sequence, with a negative value indicating no deadline. More Information [here](#terminationdelay) | 100ms | No |
+| `serverstransport.`
`proxyProtocol` | Defines the Proxy Protocol configuration. An empty `proxyProtocol` section enables Proxy Protocol version 2. | | No |
+| `serverstransport.`
`proxyProtocol.version` | Traefik supports PROXY Protocol version 1 and 2 on TCP Services. More Information [here](#proxyprotocolversion) | 2 | No |
+| `serverstransport.`
`tls` | Defines the TLS configuration. An empty `tls` section enables TLS. | | No |
+| `serverstransport.`
`tls`
`.serverName` | Configures the server name that will be used for SNI. | | No |
+| `serverstransport.`
`tls`
`.certificates` | Defines the list of certificates (as file paths, or data bytes) that will be set as client certificates for mTLS. | | No |
+| `serverstransport.`
`tls`
`.insecureSkipVerify` | Controls whether the server's certificate chain and host name is verified. | false | No |
+| `serverstransport.`
`tls`
`.rootcas` | Defines the root certificate authorities to use when verifying server certificates. (for mTLS connections). | | No |
+| `serverstransport.`
`tls.`
`peerCertURI` | Defines the URI used to match against SAN URIs during the server's certificate verification. | false | No |
+| `serverstransport.`
`spiffe` | Defines the SPIFFE configuration. An empty `spiffe` section enables SPIFFE (that allows any SPIFFE ID). | | No |
+| `serverstransport.`
`spiffe`
`.ids` | Allow SPIFFE IDs.
This takes precedence over the SPIFFE TrustDomain. | | No |
+| `serverstransport.`
`spiffe`
`.trustDomain` | Allow SPIFFE trust domain. | "" | No |
!!! note "SPIFFE"
@@ -114,3 +117,9 @@ To that end, as soon as the proxy enters this termination sequence, it sets a de
The termination delay controls that deadline.
A negative value means an infinite deadline (i.e. the connection is never fully terminated by the proxy itself).
+
+### `proxyProtocol.version`
+
+Traefik supports [PROXY Protocol](https://www.haproxy.org/download/2.0/doc/proxy-protocol.txt) version 1 and 2 on TCP Services.
+It can be configured by setting `proxyProtocol.version` on the serversTransport.
+The option specifies the version of the protocol to be used. Either 1 or 2.
diff --git a/docs/content/reference/routing-configuration/tcp/service.md b/docs/content/reference/routing-configuration/tcp/service.md
index e89174008..d85a75102 100644
--- a/docs/content/reference/routing-configuration/tcp/service.md
+++ b/docs/content/reference/routing-configuration/tcp/service.md
@@ -38,16 +38,10 @@ tcp:
| Field | Description | Default |
|----------|------------------------------------------|--------- |
-| `servers` | Servers declare a single instance of your program. | "" |
-| `servers.address` | The address option (IP:Port) point to a specific instance. | "" |
-| `servers.tls` | The `tls` option determines whether to use TLS when dialing with the backend. | false |
-| `servers.serversTransport` | `serversTransport` allows to reference a TCP [ServersTransport](./serverstransport.md configuration for the communication between Traefik and your servers. If no serversTransport is specified, the default@internal will be used. | "" |
-| `servers.proxyProtocol.version` | Traefik supports PROXY Protocol version 1 and 2 on TCP Services. More Information [here](#serversproxyprotocolversion) | 2 |
-
-### servers.proxyProtocol.version
-
-Traefik supports [PROXY Protocol](https://www.haproxy.org/download/2.0/doc/proxy-protocol.txt) version 1 and 2 on TCP Services. It can be enabled by setting `proxyProtocol` on the load balancer.
-The option specifies the version of the protocol to be used. Either 1 or 2.
+| `servers` | Servers declare a single instance of your program. | "" |
+| `servers.address` | The address option (IP:Port) point to a specific instance. | "" |
+| `servers.tls` | The `tls` option determines whether to use TLS when dialing with the backend. | false |
+| `servers.serversTransport` | `serversTransport` allows to reference a TCP [ServersTransport](./serverstransport.md configuration for the communication between Traefik and your servers. If no serversTransport is specified, the default@internal will be used. | "" |
## Weighted Round Robin
@@ -101,4 +95,4 @@ tcp:
[[tcp.services.appv2.loadBalancer.servers]]
address = "private-ip-server-2:8080/"
```
-
\ No newline at end of file
+
diff --git a/docs/content/reference/routing-configuration/tcp/tls.md b/docs/content/reference/routing-configuration/tcp/tls.md
index 5c040b837..ccaf54dfb 100644
--- a/docs/content/reference/routing-configuration/tcp/tls.md
+++ b/docs/content/reference/routing-configuration/tcp/tls.md
@@ -5,7 +5,7 @@ description: "Learn how to configure the transport layer security (TLS) connecti
## General
-When a router is configured to handle HTTPS traffic, include a `tls` field in its definition. This field tells Traefik that the router should process only TLS requests and ignore non-TLS traffic.
+When a TCP router is configured to handle TLS traffic, include a `tls` field in its definition. This field tells Traefik that the router should process only TLS connections and ignore non-TLS traffic.
By default, a router with a TLS field will terminate the TLS connections, meaning that it will send decrypted data to the services.
@@ -94,11 +94,33 @@ labels:
## Configuration Options
-| Field | Description | Default | Required |
-|:------------------|:--------------------|:-----------------------------------------------|:---------|
-|`passthrough`| Defines whether the requests should be forwarded "as is", keeping all data encrypted. | false | No |
-|`options`| enables fine-grained control of the TLS parameters. It refers to a [TLS Options](../http/tls/tls-certificates.md#tls-options) and will be applied only if a `HostSNI` rule is defined. | "" | No |
-|`domains`| Defines a set of SANs (alternative domains) for each main domain. Every domain must have A/AAAA records pointing to Traefik. Each domain & SAN will lead to a certificate request.| [] | No |
-|`certResolver`| If defined, Traefik will try to generate certificates based on routers `Host` & `HostSNI` rules. | "" | No |
+| Field | Description | Default | Required |
+|:-----------------------------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
+| `passthrough` | Defines whether the requests should be forwarded "as is", keeping all data encrypted. | false | No |
+| `options` | enables fine-grained control of the TLS parameters. It refers to a [TLS Options](../http/tls/tls-options.md) and will be applied only if a `HostSNI` rule is defined. | "" | No |
+| `certResolver` | The name of the certificate resolver to use for automatic certificate generation via ACME providers (such as Let's Encrypt). See the [Certificate Resolver](./#certificate-resolver) section for more details. | "" | No |
+| `domains` | List of domains and Subject Alternative Names (SANs) for explicit certificate domain specification. See the [Custom Domains](./#custom-domains) section for more details. | [] | No |
+
+## Certificate Resolver
+
+The `tls.certResolver` option allows you to specify a certificate resolver for automatic certificate generation via ACME providers (such as Let's Encrypt).
+
+When a certificate resolver is configured for a router,
+Traefik will automatically obtain and manage TLS certificates for the domains specified in the router's rule (in the `HostSNI` matcher) or in the `tls.domains` configuration (with `tls.domains` taking precedence).
+
+!!! important "Prerequisites"
+
+ - Certificate resolvers must be defined in the [static configuration](../../install-configuration/tls/certificate-resolvers/acme.md)
+ - The router must have `tls` enabled
+ - An ACME challenge type must be configured for the certificate resolver
+
+## Custom Domains
+
+When using ACME certificate resolvers, domains are automatically extracted from router rules,
+but the `tls.domains` option allows you to explicitly specify the domains and Subject Alternative Names (SANs) for which certificates should be generated.
+
+This provides fine-grained control over certificate generation and takes precedence over domains automatically extracted from router rules.
+
+Every domain must have A/AAAA records pointing to Traefik.
{!traefik-for-business-applications.md!}
diff --git a/docs/content/reference/routing-configuration/udp/routing/router.md b/docs/content/reference/routing-configuration/udp/routing/router.md
new file mode 100644
index 000000000..5d4bd57e1
--- /dev/null
+++ b/docs/content/reference/routing-configuration/udp/routing/router.md
@@ -0,0 +1,69 @@
+---
+title: "Traefik UDP Routers Documentation"
+description: "UDP routers are responsible for connecting incoming UDP packets to the services that can handle them. Read the technical documentation."
+---
+
+## UDP Router
+
+A UDP router is in charge of connecting incoming UDP packets to the services that can handle them. Unlike HTTP and TCP routers, UDP routers operate at the transport layer and have unique characteristics due to the connectionless nature of UDP.
+
+!!! important "UDP Router Characteristics"
+ - UDP is connectionless, so there is no concept of a request URL path or Host SNI to match against
+ - UDP routers are essentially load-balancers that distribute packets to backend services
+ - UDP routers can only target UDP services (not HTTP or TCP services)
+ - Sessions are tracked with configurable timeouts to maintain state between client and backend
+
+## Configuration Example
+
+```yaml tab="Structured (YAML)"
+udp:
+ routers:
+ my-udp-router:
+ entryPoints:
+ - "udp-ep"
+ - "dns"
+ service: my-udp-service
+```
+
+```toml tab="Structured (TOML)"
+[udp.routers]
+ [udp.routers.my-udp-router]
+ entryPoints = ["udp-ep", "dns"]
+ service = "my-udp-service"
+```
+
+```yaml tab="Labels"
+labels:
+ - "traefik.udp.routers.my-udp-router.entrypoints=udp-ep,dns"
+ - "traefik.udp.routers.my-udp-router.service=my-udp-service"
+```
+
+```json tab="Tags"
+{
+ "Tags": [
+ "traefik.udp.routers.my-udp-router.entrypoints=udp-ep,dns",
+ "traefik.udp.routers.my-udp-router.service=my-udp-service"
+ ]
+}
+```
+
+## Configuration Options
+
+| Field | Description | Default | Required |
+|------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|----------|
+| `entryPoints` | The list of entry points to which the router is attached. If not specified, UDP routers are attached to all UDP entry points. | All UDP entry points | No |
+| `service` | The name of the service that will handle the matched UDP packets. UDP services are typically load balancer services that distribute packets to multiple backend servers. See [UDP Service](../service.md) for details. | | Yes |
+
+## Sessions and Timeout
+
+Even though UDP is connectionless, Traefik's UDP router implementation relies on sessions to maintain state about ongoing communication between clients and backends. This allows the proxy to know where to forward response packets from backends.
+
+Each session has an associated timeout that cleans up inactive sessions after a specified duration of inactivity.
+
+Session timeout can be configured using the `entryPoints.name.udp.timeout` option in the static configuration. See [EntryPoints documentation](../../../install-configuration/entrypoints.md) for details.
+
+## Router Naming
+
+- The character `@` is not authorized in the router name
+- Router names should be descriptive and follow your naming conventions
+- In provider-specific configurations (Docker, Kubernetes), router names are often auto-generated based on service names
diff --git a/docs/content/reference/routing-configuration/udp/router/rules-priority.md b/docs/content/reference/routing-configuration/udp/routing/rules-priority.md
similarity index 100%
rename from docs/content/reference/routing-configuration/udp/router/rules-priority.md
rename to docs/content/reference/routing-configuration/udp/routing/rules-priority.md
diff --git a/docs/content/reference/static-configuration/cli-ref.md b/docs/content/reference/static-configuration/cli-ref.md
index b35cbc982..b06e80721 100644
--- a/docs/content/reference/static-configuration/cli-ref.md
+++ b/docs/content/reference/static-configuration/cli-ref.md
@@ -91,7 +91,7 @@ TLS key
Defines additional resource attributes (key:value).
`--accesslog.otlp.servicename`:
-Set the name for this service. (Default: ```traefik```)
+Defines the service name resource attribute. (Default: ```traefik```)
`--api`:
Enable api/dashboard. (Default: ```false```)
@@ -129,6 +129,12 @@ Define if the certificates pool must use a copy of the system cert pool. (Defaul
`--certificatesresolvers..acme.certificatesduration`:
Certificates' duration in hours. (Default: ```2160```)
+`--certificatesresolvers..acme.clientresponseheadertimeout`:
+Timeout for receiving the response headers when communicating with the ACME server. (Default: ```30```)
+
+`--certificatesresolvers..acme.clienttimeout`:
+Timeout for a complete HTTP transaction with the ACME server. (Default: ```120```)
+
`--certificatesresolvers..acme.dnschallenge`:
Activate DNS-01 Challenge. (Default: ```false```)
@@ -174,6 +180,9 @@ CSR email addresses to use.
`--certificatesresolvers..acme.httpchallenge`:
Activate HTTP-01 Challenge. (Default: ```false```)
+`--certificatesresolvers..acme.httpchallenge.delay`:
+Delay between the creation of the challenge and the validation. (Default: ```0```)
+
`--certificatesresolvers..acme.httpchallenge.entrypoint`:
HTTP challenge EntryPoint
@@ -274,13 +283,16 @@ HTTP/3 configuration. (Default: ```false```)
UDP port to advertise, on which HTTP/3 is available. (Default: ```0```)
`--entrypoints..observability.accesslogs`:
- (Default: ```true```)
+Enables access-logs for this entryPoint. (Default: ```true```)
`--entrypoints..observability.metrics`:
- (Default: ```true```)
+Enables metrics for this entryPoint. (Default: ```true```)
+
+`--entrypoints..observability.traceverbosity`:
+Defines the tracing verbosity level for this entryPoint. (Default: ```minimal```)
`--entrypoints..observability.tracing`:
- (Default: ```true```)
+Enables tracing for this entryPoint. (Default: ```true```)
`--entrypoints..proxyprotocol`:
Proxy-Protocol configuration. (Default: ```false```)
@@ -330,6 +342,9 @@ Enable debug mode for the FastProxy implementation. (Default: ```false```)
`--experimental.kubernetesgateway`:
(Deprecated) Allow the Kubernetes gateway api provider usage. (Default: ```false```)
+`--experimental.kubernetesingressnginx`:
+Allow the Kubernetes Ingress NGINX provider usage. (Default: ```false```)
+
`--experimental.localplugins.`:
Local plugins configuration. (Default: ```false```)
@@ -345,6 +360,9 @@ Environment variables to forward to the wasm guest.
`--experimental.localplugins..settings.mounts`:
Directory to mount to the wasm guest.
+`--experimental.localplugins..settings.useunsafe`:
+Allow the plugin to use unsafe package. (Default: ```false```)
+
`--experimental.otlplogs`:
Enables the OpenTelemetry logs integration. (Default: ```false```)
@@ -360,6 +378,9 @@ Environment variables to forward to the wasm guest.
`--experimental.plugins..settings.mounts`:
Directory to mount to the wasm guest.
+`--experimental.plugins..settings.useunsafe`:
+Allow the plugin to use unsafe package. (Default: ```false```)
+
`--experimental.plugins..version`:
plugin's version.
@@ -369,6 +390,9 @@ Periodically check if a new version has been released. (Default: ```true```)
`--global.sendanonymoususage`:
Periodically send anonymous usage statistics. If the option is not specified, it will be disabled by default. (Default: ```false```)
+`--global.updatercallbacks`:
+Callback urls for updater script (example: https://localhost:8080/callback)
+
`--hostresolver`:
Enable CNAME Flattening. (Default: ```false```)
@@ -460,7 +484,7 @@ TLS key
Defines additional resource attributes (key:value).
`--log.otlp.servicename`:
-Set the name for this service. (Default: ```traefik```)
+Defines the service name resource attribute. (Default: ```traefik```)
`--metrics.addinternals`:
Enables metrics for internal services (ping, dashboard, etc...). (Default: ```false```)
@@ -579,8 +603,11 @@ TLS key
`--metrics.otlp.pushinterval`:
Period between calls to collect a checkpoint. (Default: ```10```)
+`--metrics.otlp.resourceattributes.`:
+Defines additional resource attributes (key:value).
+
`--metrics.otlp.servicename`:
-OTEL service name to use. (Default: ```traefik```)
+Defines the service name resource attribute. (Default: ```traefik```)
`--metrics.prometheus`:
Prometheus metrics exporter type. (Default: ```false```)
@@ -627,6 +654,12 @@ Prefix to use for metrics collection. (Default: ```traefik```)
`--metrics.statsd.pushinterval`:
StatsD push interval. (Default: ```10```)
+`--ocsp`:
+OCSP configuration. (Default: ```false```)
+
+`--ocsp.responderoverrides.`:
+Defines a map of OCSP responders to replace for querying OCSP servers.
+
`--ping`:
Enable ping. (Default: ```false```)
@@ -765,6 +798,18 @@ Expose containers by default. (Default: ```true```)
`--providers.docker.httpclienttimeout`:
Client timeout for HTTP connections. (Default: ```0```)
+`--providers.docker.labelmap`:
+Label shorthands.
+
+`--providers.docker.labelmap[n].from`:
+Shorthand label.
+
+`--providers.docker.labelmap[n].to`:
+Full label with templates.
+
+`--providers.docker.labelmap[n].value`:
+Optional override; used instead of user input if set.
+
`--providers.docker.network`:
Default Docker network used.
@@ -1017,12 +1062,60 @@ Kubernetes namespaces.
`--providers.kubernetesingress.nativelbbydefault`:
Defines whether to use Native Kubernetes load-balancing mode by default. (Default: ```false```)
+`--providers.kubernetesingress.strictprefixmatching`:
+Make prefix matching strictly comply with the Kubernetes Ingress specification (path-element-wise matching instead of character-by-character string matching). (Default: ```false```)
+
`--providers.kubernetesingress.throttleduration`:
Ingress refresh throttle duration (Default: ```0```)
`--providers.kubernetesingress.token`:
Kubernetes bearer token (not needed for in-cluster client). It accepts either a token value or a file path to the token.
+`--providers.kubernetesingressnginx`:
+Enable Kubernetes Ingress NGINX provider. (Default: ```false```)
+
+`--providers.kubernetesingressnginx.certauthfilepath`:
+Kubernetes certificate authority file path (not needed for in-cluster client).
+
+`--providers.kubernetesingressnginx.controllerclass`:
+Ingress Class Controller value this controller satisfies. (Default: ```k8s.io/ingress-nginx```)
+
+`--providers.kubernetesingressnginx.defaultbackendservice`:
+Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form 'namespace/name'.
+
+`--providers.kubernetesingressnginx.disablesvcexternalname`:
+Disable support for Services of type ExternalName. (Default: ```false```)
+
+`--providers.kubernetesingressnginx.endpoint`:
+Kubernetes server endpoint (required for external cluster client).
+
+`--providers.kubernetesingressnginx.ingressclass`:
+Name of the ingress class this controller satisfies. (Default: ```nginx```)
+
+`--providers.kubernetesingressnginx.ingressclassbyname`:
+Define if Ingress Controller should watch for Ingress Class by Name together with Controller Class. (Default: ```false```)
+
+`--providers.kubernetesingressnginx.publishservice`:
+Service fronting the Ingress controller. Takes the form 'namespace/name'.
+
+`--providers.kubernetesingressnginx.publishstatusaddress`:
+Customized address (or addresses, separated by comma) to set as the load-balancer status of Ingress objects this controller satisfies.
+
+`--providers.kubernetesingressnginx.throttleduration`:
+Ingress refresh throttle duration. (Default: ```0```)
+
+`--providers.kubernetesingressnginx.token`:
+Kubernetes bearer token (not needed for in-cluster client). It accepts either a token value or a file path to the token.
+
+`--providers.kubernetesingressnginx.watchingresswithoutclass`:
+Define if Ingress Controller should also watch for Ingresses without an IngressClass or the annotation specified. (Default: ```false```)
+
+`--providers.kubernetesingressnginx.watchnamespace`:
+Namespace the controller watches for updates to Kubernetes objects. All namespaces are watched if this parameter is left empty.
+
+`--providers.kubernetesingressnginx.watchnamespaceselector`:
+Selector selects namespaces the controller watches for updates to Kubernetes objects.
+
`--providers.nomad`:
Enable Nomad backend with default settings. (Default: ```false```)
@@ -1164,6 +1257,18 @@ Expose containers by default. (Default: ```true```)
`--providers.swarm.httpclienttimeout`:
Client timeout for HTTP connections. (Default: ```0```)
+`--providers.swarm.labelmap`:
+Label shorthands.
+
+`--providers.swarm.labelmap[n].from`:
+Shorthand label.
+
+`--providers.swarm.labelmap[n].to`:
+Full label with templates.
+
+`--providers.swarm.labelmap[n].value`:
+Optional override; used instead of user input if set.
+
`--providers.swarm.network`:
Default Docker network used.
@@ -1339,4 +1444,4 @@ Query params to not redact.
Sets the rate between 0.0 and 1.0 of requests to trace. (Default: ```1.000000```)
`--tracing.servicename`:
-Sets the name for this service. (Default: ```traefik```)
+Defines the service name resource attribute. (Default: ```traefik```)
diff --git a/docs/content/reference/static-configuration/cli.md b/docs/content/reference/static-configuration/cli.md
deleted file mode 100644
index 85179eade..000000000
--- a/docs/content/reference/static-configuration/cli.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-title: "Traefik CLI Flags Documentation"
-description: "Reference the CLI flags for static configuration in Traefik Proxy. Read the technical documentation."
----
-
-# Static Configuration: CLI
-
---8<-- "content/reference/static-configuration/cli-ref.md"
-
diff --git a/docs/content/reference/static-configuration/env-ref.md b/docs/content/reference/static-configuration/env-ref.md
index 8f6e25c05..65c009454 100644
--- a/docs/content/reference/static-configuration/env-ref.md
+++ b/docs/content/reference/static-configuration/env-ref.md
@@ -91,7 +91,7 @@ TLS key
Defines additional resource attributes (key:value).
`TRAEFIK_ACCESSLOG_OTLP_SERVICENAME`:
-Set the name for this service. (Default: ```traefik```)
+Defines the service name resource attribute. (Default: ```traefik```)
`TRAEFIK_API`:
Enable api/dashboard. (Default: ```false```)
@@ -129,6 +129,12 @@ Define if the certificates pool must use a copy of the system cert pool. (Defaul
`TRAEFIK_CERTIFICATESRESOLVERS__ACME_CERTIFICATESDURATION`:
Certificates' duration in hours. (Default: ```2160```)
+`TRAEFIK_CERTIFICATESRESOLVERS__ACME_CLIENTRESPONSEHEADERTIMEOUT`:
+Timeout for receiving the response headers when communicating with the ACME server. (Default: ```30```)
+
+`TRAEFIK_CERTIFICATESRESOLVERS__ACME_CLIENTTIMEOUT`:
+Timeout for a complete HTTP transaction with the ACME server. (Default: ```120```)
+
`TRAEFIK_CERTIFICATESRESOLVERS__ACME_DNSCHALLENGE`:
Activate DNS-01 Challenge. (Default: ```false```)
@@ -174,6 +180,9 @@ CSR email addresses to use.
`TRAEFIK_CERTIFICATESRESOLVERS__ACME_HTTPCHALLENGE`:
Activate HTTP-01 Challenge. (Default: ```false```)
+`TRAEFIK_CERTIFICATESRESOLVERS__ACME_HTTPCHALLENGE_DELAY`:
+Delay between the creation of the challenge and the validation. (Default: ```0```)
+
`TRAEFIK_CERTIFICATESRESOLVERS__ACME_HTTPCHALLENGE_ENTRYPOINT`:
HTTP challenge EntryPoint
@@ -274,13 +283,16 @@ Subject alternative names.
Default TLS options for the routers linked to the entry point.
`TRAEFIK_ENTRYPOINTS__OBSERVABILITY_ACCESSLOGS`:
- (Default: ```true```)
+Enables access-logs for this entryPoint. (Default: ```true```)
`TRAEFIK_ENTRYPOINTS_