Allow PreferServerCipherSuites as a TLS Option

pkg/provider/kubernetes/crd/fixtures/tcp/with_tls_options.yml

@@ -35,7 +35,7 @@ spec:
       - secretCA1
       - secretCA2
     clientAuthType: VerifyClientCertIfGiven
-
+  preferServerCipherSuites: true
 ---
 apiVersion: v1
 kind: Secret

pkg/provider/kubernetes/crd/fixtures/with_tls_options.yml

@@ -35,6 +35,7 @@ spec:
       - secretCA1
       - secretCA2
     clientAuthType: VerifyClientCertIfGiven
+  preferServerCipherSuites: true
 
 ---
 apiVersion: traefik.containo.us/v1alpha1

pkg/provider/kubernetes/crd/kubernetes.go

@@ -501,7 +501,8 @@ func buildTLSOptions(ctx context.Context, client Client) map[string]tls.Options
 				CAFiles:        clientCAs,
 				ClientAuthType: tlsOption.Spec.ClientAuth.ClientAuthType,
 			},
-			SniStrict: tlsOption.Spec.SniStrict,
+			SniStrict:                tlsOption.Spec.SniStrict,
+			PreferServerCipherSuites: tlsOption.Spec.PreferServerCipherSuites,
 		}
 	}
 	return tlsOptions

pkg/provider/kubernetes/crd/kubernetes_test.go

@@ -423,7 +423,8 @@ func TestLoadIngressRouteTCPs(t *testing.T) {
 								},
 								ClientAuthType: "VerifyClientCertIfGiven",
 							},
-							SniStrict: true,
+							SniStrict:                true,
+							PreferServerCipherSuites: true,
 						},
 					},
 				},
@@ -1896,7 +1897,8 @@ func TestLoadIngressRoutes(t *testing.T) {
 								},
 								ClientAuthType: "VerifyClientCertIfGiven",
 							},
-							SniStrict: true,
+							SniStrict:                true,
+							PreferServerCipherSuites: true,
 						},
 					},
 				},

pkg/provider/kubernetes/crd/traefik/v1alpha1/tlsoption.go

@@ -19,12 +19,13 @@ type TLSOption struct {
 
 // TLSOptionSpec configures TLS for an entry point
 type TLSOptionSpec struct {
-	MinVersion       string     `json:"minVersion,omitempty"`
-	MaxVersion       string     `json:"maxVersion,omitempty"`
-	CipherSuites     []string   `json:"cipherSuites,omitempty"`
-	CurvePreferences []string   `json:"curvePreferences,omitempty"`
-	ClientAuth       ClientAuth `json:"clientAuth,omitempty"`
-	SniStrict        bool       `json:"sniStrict,omitempty"`
+	MinVersion               string     `json:"minVersion,omitempty"`
+	MaxVersion               string     `json:"maxVersion,omitempty"`
+	CipherSuites             []string   `json:"cipherSuites,omitempty"`
+	CurvePreferences         []string   `json:"curvePreferences,omitempty"`
+	ClientAuth               ClientAuth `json:"clientAuth,omitempty"`
+	SniStrict                bool       `json:"sniStrict,omitempty"`
+	PreferServerCipherSuites bool       `json:"preferServerCipherSuites,omitempty"`
 }
 
 // +k8s:deepcopy-gen=true