Prepare release v2.4.11

Co-authored-by: Romain <rtribotte@users.noreply.github.com>
Co-authored-by: Mathieu Lonjaret <mathieu.lonjaret@gmail.com>

.gitignore

@@ -17,5 +17,4 @@
 cover.out
 vendor/
 plugins-storage/
-plugins-local/
 traefik_changelog.md

.golangci.toml

@@ -109,11 +109,6 @@
     "Error return value of .((os\\.)?std(out|err)\\..*|.*Close|.*Flush|os\\.Remove(All)?|.*printf?|os\\.(Un)?Setenv). is not checked",
     "should have a package comment, unless it's in another file for this package",
     "SA1019: http.CloseNotifier has been deprecated",  # FIXME must be fixed
-    "SA1019: cfg.SSLRedirect is deprecated",
-    "SA1019: cfg.SSLTemporaryRedirect is deprecated",
-    "SA1019: cfg.SSLHost is deprecated",
-    "SA1019: cfg.SSLForceHost is deprecated",
-    "SA1019: cfg.FeaturePolicy is deprecated",
   ]
  [[issues.exclude-rules]]
     path = "(.+)_test.go"

.semaphoreci/vars

@@ -10,7 +10,7 @@ else
   export VERSION=''
 fi
 
-export CODENAME=brie
+export CODENAME=livarot
 
 export N_MAKE_JOBS=2
 

.travis.yml

@@ -11,7 +11,7 @@ env:
   global:
     - REPO=$TRAVIS_REPO_SLUG
     - VERSION=$TRAVIS_TAG
-    - CODENAME=brie
+    - CODENAME=livarot
     - GO111MODULE=on
 
 script:

CHANGELOG.md

@@ -1,74 +1,23 @@
-## [v2.5.0-rc2](https://github.com/traefik/traefik/tree/v2.5.0-rc2) (2021-06-28)
-[All Commits](https://github.com/traefik/traefik/compare/v2.4.0-rc1...v2.5.0-rc2)
-
-**Enhancements:**
-- **[file]** Update sprig to v3.2.0 ([#7746](https://github.com/traefik/traefik/pull/7746) by [sirlatrom](https://github.com/sirlatrom))
-- **[healthcheck]** Healthcheck: add support at the load-balancers of services level ([#8057](https://github.com/traefik/traefik/pull/8057) by [mpl](https://github.com/mpl))
-- **[http3]** Upgrade github.com/lucas-clemente/quic-go ([#8076](https://github.com/traefik/traefik/pull/8076) by [sylr](https://github.com/sylr))
-- **[http3]** Add HTTP3 support (experimental) ([#7724](https://github.com/traefik/traefik/pull/7724) by [juliens](https://github.com/juliens))
-- **[k8s,k8s/crd,k8s/ingress]** Ignore empty endpoint changes ([#7646](https://github.com/traefik/traefik/pull/7646) by [hensur](https://github.com/hensur))
-- **[k8s,k8s/crd]** Improve kubernetes external name service support for UDP ([#7773](https://github.com/traefik/traefik/pull/7773) by [kevinpollet](https://github.com/kevinpollet))
-- **[k8s,k8s/crd]** Upgrade the CRD version from apiextensions.k8s.io/v1beta1 to apiextensions.k8s.io/v1 ([#7815](https://github.com/traefik/traefik/pull/7815) by [jbdoumenjou](https://github.com/jbdoumenjou))
-- **[k8s,k8s/crd]** Add named port support to Kubernetes IngressRoute CRDs ([#7668](https://github.com/traefik/traefik/pull/7668) by [Cirrith](https://github.com/Cirrith))
-- **[k8s,k8s/gatewayapi]** Add wildcard hostname rule to kubernetes gateway ([#7963](https://github.com/traefik/traefik/pull/7963) by [jberger](https://github.com/jberger))
-- **[k8s,k8s/gatewayapi]** Allow crossprovider service reference ([#7774](https://github.com/traefik/traefik/pull/7774) by [jbdoumenjou](https://github.com/jbdoumenjou))
-- **[k8s,k8s/gatewayapi]** Add support for TCPRoute and TLSRoute ([#8054](https://github.com/traefik/traefik/pull/8054) by [tomMoulard](https://github.com/tomMoulard))
-- **[k8s,k8s/ingress]** Filter ingress class resources by name ([#7915](https://github.com/traefik/traefik/pull/7915) by [tomMoulard](https://github.com/tomMoulard))
-- **[k8s,k8s/ingress]** Upgrade Ingress Handling to work with networkingv1/Ingress ([#7549](https://github.com/traefik/traefik/pull/7549) by [SantoDE](https://github.com/SantoDE))
-- **[k8s,k8s/ingress]** Upgrade IngressClass to use v1 over v1Beta on Kube 1.19+ ([#8089](https://github.com/traefik/traefik/pull/8089) by [SantoDE](https://github.com/SantoDE))
-- **[k8s,k8s/ingress]** Add k8s provider option to create services without endpoints ([#7593](https://github.com/traefik/traefik/pull/7593) by [Lucaber](https://github.com/Lucaber))
-- **[k8s,k8s/ingress]** Add ServersTransport annotation to k8s ingress provider ([#8084](https://github.com/traefik/traefik/pull/8084) by [wdullaer](https://github.com/wdullaer))
-- **[logs,middleware]** Add TLS version and cipher to the accessLog ([#7478](https://github.com/traefik/traefik/pull/7478) by [na4ma4](https://github.com/na4ma4))
-- **[metrics]** Allow to define datadogs metrics endpoint with env vars ([#7968](https://github.com/traefik/traefik/pull/7968) by [sylr](https://github.com/sylr))
-- **[metrics]** Add TLS certs expiration metric ([#6924](https://github.com/traefik/traefik/pull/6924) by [sylr](https://github.com/sylr))
-- **[middleware,metrics]** Add router metrics ([#7510](https://github.com/traefik/traefik/pull/7510) by [jorge07](https://github.com/jorge07))
-- **[middleware,tcp]** Add TCP Middlewares support ([#7813](https://github.com/traefik/traefik/pull/7813) by [rtribotte](https://github.com/rtribotte))
-- **[middleware]** Deprecates ssl redirect headers middleware options ([#8160](https://github.com/traefik/traefik/pull/8160) by [tomMoulard](https://github.com/tomMoulard))
-- **[middleware]** Headers: add `permissionsPolicy` and deprecate `featurePolicy` ([#8200](https://github.com/traefik/traefik/pull/8200) by [WLun001](https://github.com/WLun001))
-- **[middleware]** Removes  headers middleware options  ([#8161](https://github.com/traefik/traefik/pull/8161) by [tomMoulard](https://github.com/tomMoulard))
-- **[plugins,provider]** Add plugin's support for provider ([#7794](https://github.com/traefik/traefik/pull/7794) by [ldez](https://github.com/ldez))
-- **[plugins]** Local private plugins. ([#8224](https://github.com/traefik/traefik/pull/8224) by [ldez](https://github.com/ldez))
-- **[rules]** Add routing IP rule matcher ([#8169](https://github.com/traefik/traefik/pull/8169) by [tomMoulard](https://github.com/tomMoulard))
-- **[rules]** Support not in rules definition ([#8164](https://github.com/traefik/traefik/pull/8164) by [juliens](https://github.com/juliens))
-- **[server]** Improve host name resolution for TCP proxy ([#7971](https://github.com/traefik/traefik/pull/7971) by [H-M-H](https://github.com/H-M-H))
-- **[server]** Add ability to disable HTTP/2 in dynamic config ([#7645](https://github.com/traefik/traefik/pull/7645) by [jcuzzi](https://github.com/jcuzzi))
-- **[sticky-session]** Add a mechanism to format the sticky cookie value ([#8103](https://github.com/traefik/traefik/pull/8103) by [tomMoulard](https://github.com/tomMoulard))
-- **[tls]** Mutualize TLS version and cipher code ([#7779](https://github.com/traefik/traefik/pull/7779) by [rtribotte](https://github.com/rtribotte))
-- **[tls]** Do not build a default certificate for ACME challenges store ([#7833](https://github.com/traefik/traefik/pull/7833) by [rkojedzinszky](https://github.com/rkojedzinszky))
-- **[tracing]** Use Datadog tracer environment variables to setup default config ([#7721](https://github.com/traefik/traefik/pull/7721) by [GianOrtiz](https://github.com/GianOrtiz))
-- **[tracing]** Update Elastic APM from 1.7.0 to 1.11.0 ([#8187](https://github.com/traefik/traefik/pull/8187) by [afitzek](https://github.com/afitzek))
-- **[tracing]** Override jaeger configuration with env variables ([#8198](https://github.com/traefik/traefik/pull/8198) by [mmatur](https://github.com/mmatur))
-- **[udp]** Add udp timeout configuration ([#6982](https://github.com/traefik/traefik/pull/6982) by [Lindenk](https://github.com/Lindenk))
+## [v2.4.11](https://github.com/traefik/traefik/tree/v2.4.11) (2021-07-15)
+[All Commits](https://github.com/traefik/traefik/compare/v2.4.9...v2.4.11)
 
 **Bug fixes:**
-- **[k8s]** Remove logging of changed object with cast ([#8128](https://github.com/traefik/traefik/pull/8128) by [hensur](https://github.com/hensur))
+- **[k8s,k8s/crd,k8s/ingress]** Disable ExternalName Services by default on Kubernetes providers ([#8261](https://github.com/traefik/traefik/pull/8261) by [dtomcej](https://github.com/dtomcej))
+- **[k8s,k8s/crd,k8s/ingress]** Fix: malformed Kubernetes resource names and references in tests ([#8226](https://github.com/traefik/traefik/pull/8226) by [rtribotte](https://github.com/rtribotte))
+- **[k8s,k8s/crd]** Disable Cross-Namespace by default for IngressRoute provider ([#8260](https://github.com/traefik/traefik/pull/8260) by [dtomcej](https://github.com/dtomcej))
+- **[logs,middleware]** Accesslog: support multiple values for a given header ([#8258](https://github.com/traefik/traefik/pull/8258) by [ldez](https://github.com/ldez))
+- **[logs]** Ignore http 1.0 request host missing errors ([#8252](https://github.com/traefik/traefik/pull/8252) by [dtomcej](https://github.com/dtomcej))
+- **[middleware]** Headers Middleware: support http.CloseNotifier interface ([#8238](https://github.com/traefik/traefik/pull/8238) by [dtomcej](https://github.com/dtomcej))
+- **[tls]** Detect certificates content modifications ([#8243](https://github.com/traefik/traefik/pull/8243) by [jbdoumenjou](https://github.com/jbdoumenjou))
 
 **Documentation:**
-- **[k8s/crd]** Fix: regenerate crd ([#8114](https://github.com/traefik/traefik/pull/8114) by [tomMoulard](https://github.com/tomMoulard))
-- **[k8s]** Clarify doc for ingressclass name in k8s 1.18+ ([#7944](https://github.com/traefik/traefik/pull/7944) by [tomMoulard](https://github.com/tomMoulard))
-- Update documentation references ([#8202](https://github.com/traefik/traefik/pull/8202) by [rtribotte](https://github.com/rtribotte))
+- **[middleware,k8s]** Fix invalid subdomain ([#8212](https://github.com/traefik/traefik/pull/8212) by [WLun001](https://github.com/WLun001))
+- Add the list of available provider names ([#8225](https://github.com/traefik/traefik/pull/8225) by [WLun001](https://github.com/WLun001))
+- Fix maintainers-guidelines page title ([#8216](https://github.com/traefik/traefik/pull/8216) by [kubopanda](https://github.com/kubopanda))
+- Typos in contributing section ([#8215](https://github.com/traefik/traefik/pull/8215) by [kubopanda](https://github.com/kubopanda))
 
-**Misc:**
-- **[k8s,k8s/crd,tls]** Improve CA certificate loading from kubernetes secret ([#7789](https://github.com/traefik/traefik/pull/7789) by [rio](https://github.com/rio))
-- Merge current v2.4 into master ([#8221](https://github.com/traefik/traefik/pull/8221) by [rtribotte](https://github.com/rtribotte))
-- Merge current v2.4 into master ([#8105](https://github.com/traefik/traefik/pull/8105) by [tomMoulard](https://github.com/tomMoulard))
-- Merge current v2.4 into master ([#8087](https://github.com/traefik/traefik/pull/8087) by [tomMoulard](https://github.com/tomMoulard))
-- Merge current v2.4 into master ([#8068](https://github.com/traefik/traefik/pull/8068) by [jbdoumenjou](https://github.com/jbdoumenjou))
-- Merge current v2.4 into master ([#8058](https://github.com/traefik/traefik/pull/8058) by [jbdoumenjou](https://github.com/jbdoumenjou))
-- Merge current v2.4 into master ([#8024](https://github.com/traefik/traefik/pull/8024) by [jbdoumenjou](https://github.com/jbdoumenjou))
-- Merge current v2.4 into master ([#7969](https://github.com/traefik/traefik/pull/7969) by [jbdoumenjou](https://github.com/jbdoumenjou))
-- Merge current v2.4 into master ([#7921](https://github.com/traefik/traefik/pull/7921) by [rtribotte](https://github.com/rtribotte))
-- Merge current v2.4 into master ([#7901](https://github.com/traefik/traefik/pull/7901) by [rtribotte](https://github.com/rtribotte))
-- Merge current v2.4 into master ([#7859](https://github.com/traefik/traefik/pull/7859) by [jbdoumenjou](https://github.com/jbdoumenjou))
-- Merge current v2.4 into master ([#7795](https://github.com/traefik/traefik/pull/7795) by [kevinpollet](https://github.com/kevinpollet))
-- Merge current v2.4 into master ([#8210](https://github.com/traefik/traefik/pull/8210) by [rtribotte](https://github.com/rtribotte))
-- Merge current v2.4 into master ([#7781](https://github.com/traefik/traefik/pull/7781) by [kevinpollet](https://github.com/kevinpollet))
-- Merge current v2.4 into master ([#7766](https://github.com/traefik/traefik/pull/7766) by [ldez](https://github.com/ldez))
-- Merge current v2.4 into master ([#7761](https://github.com/traefik/traefik/pull/7761) by [rtribotte](https://github.com/rtribotte))
-- Merge current v2.4 into master ([#7748](https://github.com/traefik/traefik/pull/7748) by [kevinpollet](https://github.com/kevinpollet))
-- Merge current v2.4 into master ([#7728](https://github.com/traefik/traefik/pull/7728) by [mmatur](https://github.com/mmatur))
-
-## [v2.5.0-rc1](https://github.com/traefik/traefik/tree/v2.5.0-rc1) (2021-06-28)
+## [v2.4.10](https://github.com/traefik/traefik/tree/v2.4.10) (2021-07-13)
+[All Commits](https://github.com/traefik/traefik/compare/v2.4.9...v2.4.10)
 
 Release canceled.
 

Makefile

@@ -7,7 +7,7 @@ SHA := $(shell git rev-parse HEAD)
 VERSION_GIT := $(if $(TAG_NAME),$(TAG_NAME),$(SHA))
 VERSION := $(if $(VERSION),$(VERSION),$(VERSION_GIT))
 
-BIND_DIR := dist
+BIND_DIR := "dist"
 
 GIT_BRANCH := $(subst heads/,,$(shell git rev-parse --abbrev-ref HEAD 2>/dev/null))
 TRAEFIK_DEV_IMAGE := traefik-dev$(if $(GIT_BRANCH),:$(subst /,-,$(GIT_BRANCH)))
@@ -96,6 +96,15 @@ test-integration: $(PRE_TARGET)
 	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK),TEST_CONTAINER=1) ./script/make.sh generate binary test-integration
 	TEST_HOST=1 ./script/make.sh test-integration
 
+## Run the container integration tests
+test-integration-container: $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK),TEST_CONTAINER=1) ./script/make.sh generate binary test-integration
+
+## Run the host integration tests
+test-integration-host: $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK),TEST_CONTAINER=1) ./script/make.sh generate binary
+	TEST_HOST=1 ./script/make.sh test-integration
+
 ## Validate code and docs
 validate-files: $(PRE_TARGET)
 	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK)) ./script/make.sh generate validate-lint validate-misspell
@@ -135,14 +144,10 @@ docs-pull-images:
 generate-crd:
 	./script/update-generated-crd-code.sh
 
-## Generate code from dynamic configuration https://github.com/traefik/genconf
-generate-genconf:
-	go run ./cmd/internal/gen/
-
 ## Create packages for the release
 release-packages: generate-webui build-dev-image
 	rm -rf dist
-	$(DOCKER_RUN_TRAEFIK_NOTTY) goreleaser release --skip-publish --timeout="90m"
+	$(DOCKER_RUN_TRAEFIK_NOTTY) goreleaser release --skip-publish --timeout="60m"
 	$(DOCKER_RUN_TRAEFIK_NOTTY) tar cfz dist/traefik-${VERSION}.src.tar.gz \
 		--exclude-vcs \
 		--exclude .idea \

cmd/internal/gen/centrifuge.go

@@ -1,343 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"fmt"
-	"go/format"
-	"go/importer"
-	"go/token"
-	"go/types"
-	"io"
-	"log"
-	"os"
-	"path"
-	"path/filepath"
-	"sort"
-	"strings"
-
-	"golang.org/x/tools/imports"
-)
-
-// File a kind of AST element that represents a file.
-type File struct {
-	Package  string
-	Imports  []string
-	Elements []Element
-}
-
-// Element is a simplified version of a symbol.
-type Element struct {
-	Name  string
-	Value string
-}
-
-// Centrifuge a centrifuge.
-// Generate Go Structures from Go structures.
-type Centrifuge struct {
-	IncludedImports []string
-	ExcludedTypes   []string
-	ExcludedFiles   []string
-
-	TypeCleaner    func(types.Type, string) string
-	PackageCleaner func(string) string
-
-	rootPkg string
-	fileSet *token.FileSet
-	pkg     *types.Package
-}
-
-// NewCentrifuge creates a new Centrifuge.
-func NewCentrifuge(rootPkg string) (*Centrifuge, error) {
-	fileSet := token.NewFileSet()
-
-	pkg, err := importer.ForCompiler(fileSet, "source", nil).Import(rootPkg)
-	if err != nil {
-		return nil, err
-	}
-
-	return &Centrifuge{
-		fileSet: fileSet,
-		pkg:     pkg,
-		rootPkg: rootPkg,
-
-		TypeCleaner: func(typ types.Type, _ string) string {
-			return typ.String()
-		},
-		PackageCleaner: func(s string) string {
-			return s
-		},
-	}, nil
-}
-
-// Run runs the code extraction and the code generation.
-func (c Centrifuge) Run(dest string, pkgName string) error {
-	files, err := c.run(c.pkg.Scope(), c.rootPkg, pkgName)
-	if err != nil {
-		return err
-	}
-
-	err = fileWriter{baseDir: dest}.Write(files)
-	if err != nil {
-		return err
-	}
-
-	for _, p := range c.pkg.Imports() {
-		if contains(c.IncludedImports, p.Path()) {
-			fls, err := c.run(p.Scope(), p.Path(), p.Name())
-			if err != nil {
-				return err
-			}
-
-			err = fileWriter{baseDir: filepath.Join(dest, p.Name())}.Write(fls)
-			if err != nil {
-				return err
-			}
-		}
-	}
-
-	return err
-}
-
-func (c Centrifuge) run(sc *types.Scope, rootPkg string, pkgName string) (map[string]*File, error) {
-	files := map[string]*File{}
-
-	for _, name := range sc.Names() {
-		if contains(c.ExcludedTypes, name) {
-			continue
-		}
-
-		o := sc.Lookup(name)
-		if !o.Exported() {
-			continue
-		}
-
-		filename := filepath.Base(c.fileSet.File(o.Pos()).Name())
-		if contains(c.ExcludedFiles, path.Join(rootPkg, filename)) {
-			continue
-		}
-
-		fl, ok := files[filename]
-		if !ok {
-			files[filename] = &File{Package: pkgName}
-			fl = files[filename]
-		}
-
-		elt := Element{
-			Name: name,
-		}
-
-		switch ob := o.(type) {
-		case *types.TypeName:
-
-			switch obj := ob.Type().(*types.Named).Underlying().(type) {
-			case *types.Struct:
-				elt.Value = c.writeStruct(name, obj, rootPkg, fl)
-
-			case *types.Map:
-				elt.Value = fmt.Sprintf("type %s map[%s]%s\n", name, obj.Key().String(), c.TypeCleaner(obj.Elem(), rootPkg))
-
-			case *types.Slice:
-				elt.Value = fmt.Sprintf("type %s []%v\n", name, c.TypeCleaner(obj.Elem(), rootPkg))
-
-			case *types.Basic:
-				elt.Value = fmt.Sprintf("type %s %v\n", name, obj.Name())
-
-			default:
-				log.Printf("OTHER TYPE::: %s %T\n", name, o.Type().(*types.Named).Underlying())
-				continue
-			}
-
-		default:
-			log.Printf("OTHER::: %s %T\n", name, o)
-			continue
-		}
-
-		if len(elt.Value) > 0 {
-			fl.Elements = append(fl.Elements, elt)
-		}
-	}
-
-	return files, nil
-}
-
-func (c Centrifuge) writeStruct(name string, obj *types.Struct, rootPkg string, elt *File) string {
-	b := strings.Builder{}
-	b.WriteString(fmt.Sprintf("type %s struct {\n", name))
-
-	for i := 0; i < obj.NumFields(); i++ {
-		field := obj.Field(i)
-
-		if !field.Exported() {
-			continue
-		}
-
-		fPkg := c.PackageCleaner(extractPackage(field.Type()))
-		if fPkg != "" && fPkg != rootPkg {
-			elt.Imports = append(elt.Imports, fPkg)
-		}
-
-		fType := c.TypeCleaner(field.Type(), rootPkg)
-
-		if field.Embedded() {
-			b.WriteString(fmt.Sprintf("\t%s\n", fType))
-			continue
-		}
-
-		b.WriteString(fmt.Sprintf("\t%s %s", field.Name(), fType))
-
-		tags := obj.Tag(i)
-		if tags != "" {
-			tg := extractJSONTag(tags)
-
-			if tg != `json:"-"` {
-				b.WriteString(fmt.Sprintf(" `%s`", tg))
-			}
-		}
-
-		b.WriteString("\n")
-	}
-
-	b.WriteString("}\n")
-
-	return b.String()
-}
-
-func extractJSONTag(value string) string {
-	fields := strings.Fields(value)
-
-	for _, field := range fields {
-		if strings.HasPrefix(field, `json:"`) {
-			return field
-		}
-	}
-
-	return ""
-}
-
-func extractPackage(t types.Type) string {
-	switch tu := t.(type) {
-	case *types.Named:
-		return tu.Obj().Pkg().Path()
-
-	case *types.Slice:
-		if v, ok := tu.Elem().(*types.Named); ok {
-			return v.Obj().Pkg().Path()
-		}
-		return ""
-
-	case *types.Map:
-		if v, ok := tu.Elem().(*types.Named); ok {
-			return v.Obj().Pkg().Path()
-		}
-		return ""
-
-	case *types.Pointer:
-		return extractPackage(tu.Elem())
-
-	default:
-		return ""
-	}
-}
-
-func contains(values []string, value string) bool {
-	for _, val := range values {
-		if val == value {
-			return true
-		}
-	}
-
-	return false
-}
-
-type fileWriter struct {
-	baseDir string
-}
-
-func (f fileWriter) Write(files map[string]*File) error {
-	err := os.MkdirAll(f.baseDir, 0755)
-	if err != nil {
-		return err
-	}
-
-	for name, file := range files {
-		err = f.writeFile(name, file)
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (f fileWriter) writeFile(name string, desc *File) error {
-	if len(desc.Elements) == 0 {
-		return nil
-	}
-
-	filename := filepath.Join(f.baseDir, name)
-
-	file, err := os.Create(filename)
-	if err != nil {
-		return fmt.Errorf("failed to create file: %w", err)
-	}
-
-	defer func() { _ = file.Close() }()
-
-	b := bytes.NewBufferString("package ")
-	b.WriteString(desc.Package)
-	b.WriteString("\n")
-	b.WriteString("// Code generated by centrifuge. DO NOT EDIT.\n")
-
-	b.WriteString("\n")
-	f.writeImports(b, desc.Imports)
-	b.WriteString("\n")
-
-	for _, elt := range desc.Elements {
-		b.WriteString(elt.Value)
-		b.WriteString("\n")
-	}
-
-	// gofmt
-	source, err := format.Source(b.Bytes())
-	if err != nil {
-		log.Println(b.String())
-		return fmt.Errorf("failed to format sources: %w", err)
-	}
-
-	// goimports
-	process, err := imports.Process(filename, source, nil)
-	if err != nil {
-		log.Println(string(source))
-		return fmt.Errorf("failed to format imports: %w", err)
-	}
-
-	_, err = file.Write(process)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (f fileWriter) writeImports(b io.StringWriter, imports []string) {
-	if len(imports) == 0 {
-		return
-	}
-
-	uniq := map[string]struct{}{}
-
-	sort.Strings(imports)
-
-	_, _ = b.WriteString("import (\n")
-	for _, s := range imports {
-		if _, exist := uniq[s]; exist {
-			continue
-		}
-
-		uniq[s] = struct{}{}
-
-		_, _ = b.WriteString(fmt.Sprintf(`	"%s"`+"\n", s))
-	}
-
-	_, _ = b.WriteString(")\n")
-}

cmd/internal/gen/main.go

@@ -1,124 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"go/build"
-	"go/types"
-	"io/ioutil"
-	"log"
-	"path"
-	"path/filepath"
-	"strings"
-)
-
-const rootPkg = "github.com/traefik/traefik/v2/pkg/config/dynamic"
-
-const (
-	destModuleName = "github.com/traefik/genconf"
-	destPkg        = "dynamic"
-)
-
-const marsh = `package %s
-
-import "encoding/json"
-
-type JSONPayload struct {
-	*Configuration
-}
-
-func (c JSONPayload) MarshalJSON() ([]byte, error) {
-	if c.Configuration == nil {
-		return nil, nil
-	}
-
-	return json.Marshal(c.Configuration)
-}
-`
-
-// main generate Go Structures from Go structures.
-// Allows to create an external module (destModuleName) used by the plugin's providers
-// that contains Go structs of the dynamic configuration and nothing else.
-// These Go structs do not have any non-exported fields and do not rely on any external dependencies.
-func main() {
-	dest := filepath.Join(path.Join(build.Default.GOPATH, "src"), destModuleName, destPkg)
-
-	log.Println("Output:", dest)
-
-	err := run(dest)
-	if err != nil {
-		log.Fatal(err)
-	}
-}
-
-func run(dest string) error {
-	centrifuge, err := NewCentrifuge(rootPkg)
-	if err != nil {
-		return err
-	}
-
-	centrifuge.IncludedImports = []string{
-		"github.com/traefik/traefik/v2/pkg/tls",
-		"github.com/traefik/traefik/v2/pkg/types",
-	}
-
-	centrifuge.ExcludedTypes = []string{
-		// tls
-		"CertificateStore", "Manager",
-		// dynamic
-		"Message", "Configurations",
-		// types
-		"HTTPCodeRanges", "HostResolverConfig",
-	}
-
-	centrifuge.ExcludedFiles = []string{
-		"github.com/traefik/traefik/v2/pkg/types/logs.go",
-		"github.com/traefik/traefik/v2/pkg/types/metrics.go",
-	}
-
-	centrifuge.TypeCleaner = cleanType
-	centrifuge.PackageCleaner = cleanPackage
-
-	err = centrifuge.Run(dest, destPkg)
-	if err != nil {
-		return err
-	}
-
-	return ioutil.WriteFile(filepath.Join(dest, "marshaler.go"), []byte(fmt.Sprintf(marsh, destPkg)), 0666)
-}
-
-func cleanType(typ types.Type, base string) string {
-	if typ.String() == "github.com/traefik/traefik/v2/pkg/tls.FileOrContent" {
-		return "string"
-	}
-
-	if typ.String() == "[]github.com/traefik/traefik/v2/pkg/tls.FileOrContent" {
-		return "[]string"
-	}
-
-	if typ.String() == "github.com/traefik/paerser/types.Duration" {
-		return "string"
-	}
-
-	if strings.Contains(typ.String(), base) {
-		return strings.ReplaceAll(typ.String(), base+".", "")
-	}
-
-	if strings.Contains(typ.String(), "github.com/traefik/traefik/v2/pkg/") {
-		return strings.ReplaceAll(typ.String(), "github.com/traefik/traefik/v2/pkg/", "")
-	}
-
-	return typ.String()
-}
-
-func cleanPackage(src string) string {
-	switch src {
-	case "github.com/traefik/paerser/types":
-		return ""
-	case "github.com/traefik/traefik/v2/pkg/tls":
-		return path.Join(destModuleName, destPkg, "tls")
-	case "github.com/traefik/traefik/v2/pkg/types":
-		return path.Join(destModuleName, destPkg, "types")
-	default:
-		return src
-	}
-}

cmd/traefik/plugins.go

@@ -1,8 +1,6 @@
 package main
 
 import (
-	"fmt"
-
 	"github.com/traefik/traefik/v2/pkg/config/static"
 	"github.com/traefik/traefik/v2/pkg/plugins"
 )
@@ -10,69 +8,35 @@ import (
 const outputDir = "./plugins-storage/"
 
 func createPluginBuilder(staticConfiguration *static.Configuration) (*plugins.Builder, error) {
-	client, plgs, localPlgs, err := initPlugins(staticConfiguration)
+	client, plgs, devPlugin, err := initPlugins(staticConfiguration)
 	if err != nil {
 		return nil, err
 	}
 
-	return plugins.NewBuilder(client, plgs, localPlgs)
+	return plugins.NewBuilder(client, plgs, devPlugin)
 }
 
-func initPlugins(staticCfg *static.Configuration) (*plugins.Client, map[string]plugins.Descriptor, map[string]plugins.LocalDescriptor, error) {
-	err := checkUniquePluginNames(staticCfg.Experimental)
+func initPlugins(staticCfg *static.Configuration) (*plugins.Client, map[string]plugins.Descriptor, *plugins.DevPlugin, error) {
+	if !isPilotEnabled(staticCfg) || !hasPlugins(staticCfg) {
+		return nil, map[string]plugins.Descriptor{}, nil, nil
+	}
+
+	opts := plugins.ClientOptions{
+		Output: outputDir,
+		Token:  staticCfg.Pilot.Token,
+	}
+
+	client, err := plugins.NewClient(opts)
 	if err != nil {
 		return nil, nil, nil, err
 	}
 
-	var client *plugins.Client
-	plgs := map[string]plugins.Descriptor{}
-
-	if isPilotEnabled(staticCfg) && hasPlugins(staticCfg) {
-		opts := plugins.ClientOptions{
-			Output: outputDir,
-			Token:  staticCfg.Pilot.Token,
-		}
-
-		var err error
-		client, err = plugins.NewClient(opts)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-
-		err = plugins.SetupRemotePlugins(client, staticCfg.Experimental.Plugins)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-
-		plgs = staticCfg.Experimental.Plugins
+	err = plugins.Setup(client, staticCfg.Experimental.Plugins, staticCfg.Experimental.DevPlugin)
+	if err != nil {
+		return nil, nil, nil, err
 	}
 
-	localPlgs := map[string]plugins.LocalDescriptor{}
-
-	if hasLocalPlugins(staticCfg) {
-		err := plugins.SetupLocalPlugins(staticCfg.Experimental.LocalPlugins)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-
-		localPlgs = staticCfg.Experimental.LocalPlugins
-	}
-
-	return client, plgs, localPlgs, nil
-}
-
-func checkUniquePluginNames(e *static.Experimental) error {
-	if e == nil {
-		return nil
-	}
-
-	for s := range e.LocalPlugins {
-		if _, ok := e.Plugins[s]; ok {
-			return fmt.Errorf("the plugin's name %q must be unique", s)
-		}
-	}
-
-	return nil
+	return client, staticCfg.Experimental.Plugins, staticCfg.Experimental.DevPlugin, nil
 }
 
 func isPilotEnabled(staticCfg *static.Configuration) bool {
@@ -80,9 +44,6 @@ func isPilotEnabled(staticCfg *static.Configuration) bool {
 }
 
 func hasPlugins(staticCfg *static.Configuration) bool {
-	return staticCfg.Experimental != nil && len(staticCfg.Experimental.Plugins) > 0
-}
-
-func hasLocalPlugins(staticCfg *static.Configuration) bool {
-	return staticCfg.Experimental != nil && len(staticCfg.Experimental.LocalPlugins) > 0
+	return staticCfg.Experimental != nil &&
+		(len(staticCfg.Experimental.Plugins) > 0 || staticCfg.Experimental.DevPlugin != nil)
 }

cmd/traefik/traefik.go

@@ -2,9 +2,7 @@ package main
 
 import (
 	"context"
-	"crypto/x509"
 	"encoding/json"
-	"fmt"
 	stdlog "log"
 	"net/http"
 	"os"
@@ -18,7 +16,6 @@ import (
 	"github.com/coreos/go-systemd/daemon"
 	assetfs "github.com/elazarl/go-bindata-assetfs"
 	"github.com/go-acme/lego/v4/challenge"
-	gokitmetrics "github.com/go-kit/kit/metrics"
 	"github.com/sirupsen/logrus"
 	"github.com/traefik/paerser/cli"
 	"github.com/traefik/traefik/v2/autogen/genstatic"
@@ -126,6 +123,12 @@ func runCmd(staticConfiguration *static.Configuration) error {
 
 	ctx, _ := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 
+	if staticConfiguration.Experimental != nil && staticConfiguration.Experimental.DevPlugin != nil {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, 30*time.Minute)
+		defer cancel()
+	}
+
 	if staticConfiguration.Ping != nil {
 		staticConfiguration.Ping.WithContext(ctx)
 	}
@@ -232,20 +235,6 @@ func setupServer(staticConfiguration *static.Configuration) (*server.Server, err
 		return nil, err
 	}
 
-	// Providers plugins
-
-	for name, conf := range staticConfiguration.Providers.Plugin {
-		p, err := pluginBuilder.BuildProvider(name, conf)
-		if err != nil {
-			return nil, fmt.Errorf("plugin: failed to build provider: %w", err)
-		}
-
-		err = providerAggregator.AddProvider(p)
-		if err != nil {
-			return nil, fmt.Errorf("plugin: failed to add provider: %w", err)
-		}
-	}
-
 	// Metrics
 
 	metricRegistries := registerMetricClients(staticConfiguration.Metrics)
@@ -264,7 +253,7 @@ func setupServer(staticConfiguration *static.Configuration) (*server.Server, err
 
 	accessLog := setupAccessLog(staticConfiguration.AccessLog)
 	chainBuilder := middleware.NewChainBuilder(*staticConfiguration, metricsRegistry, accessLog)
-	routerFactory := server.NewRouterFactory(*staticConfiguration, managerFactory, tlsManager, chainBuilder, pluginBuilder, metricsRegistry)
+	routerFactory := server.NewRouterFactory(*staticConfiguration, managerFactory, tlsManager, chainBuilder, pluginBuilder)
 
 	// Watcher
 
@@ -280,11 +269,6 @@ func setupServer(staticConfiguration *static.Configuration) (*server.Server, err
 	watcher.AddListener(func(conf dynamic.Configuration) {
 		ctx := context.Background()
 		tlsManager.UpdateConfigs(ctx, conf.TLS.Stores, conf.TLS.Options, conf.TLS.Certificates)
-
-		gauge := metricsRegistry.TLSCertsNotAfterTimestampGauge()
-		for _, certificate := range tlsManager.GetCertificates() {
-			appendCertMetric(gauge, certificate)
-		}
 	})
 
 	// Metrics
@@ -459,20 +443,6 @@ func registerMetricClients(metricsConfig *types.Metrics) []metrics.Registry {
 	return registries
 }
 
-func appendCertMetric(gauge gokitmetrics.Gauge, certificate *x509.Certificate) {
-	sort.Strings(certificate.DNSNames)
-
-	labels := []string{
-		"cn", certificate.Subject.CommonName,
-		"serial", certificate.SerialNumber.String(),
-		"sans", strings.Join(certificate.DNSNames, ","),
-	}
-
-	notAfter := float64(certificate.NotAfter.Unix())
-
-	gauge.With(labels...).Set(notAfter)
-}
-
 func setupAccessLog(conf *types.AccessLog) *accesslog.Handler {
 	if conf == nil {
 		return nil

cmd/traefik/traefik_test.go

@@ -1,116 +0,0 @@
-package main
-
-import (
-	"crypto/x509"
-	"encoding/pem"
-	"strings"
-	"testing"
-
-	"github.com/go-kit/kit/metrics"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// FooCert is a PEM-encoded TLS cert.
-// generated from src/crypto/tls:
-// go run generate_cert.go  --rsa-bits 1024 --host foo.org,foo.com  --ca --start-date "Jan 1 00:00:00 1970" --duration=1000000h
-const fooCert = `-----BEGIN CERTIFICATE-----
-MIICHzCCAYigAwIBAgIQXQFLeYRwc5X21t457t2xADANBgkqhkiG9w0BAQsFADAS
-MRAwDgYDVQQKEwdBY21lIENvMCAXDTcwMDEwMTAwMDAwMFoYDzIwODQwMTI5MTYw
-MDAwWjASMRAwDgYDVQQKEwdBY21lIENvMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
-iQKBgQDCjn67GSs/khuGC4GNN+tVo1S+/eSHwr/hWzhfMqO7nYiXkFzmxi+u14CU
-Pda6WOeps7T2/oQEFMxKKg7zYOqkLSbjbE0ZfosopaTvEsZm/AZHAAvoOrAsIJOn
-SEiwy8h0tLA4z1SNR6rmIVQWyqBZEPAhBTQM1z7tFp48FakCFwIDAQABo3QwcjAO
-BgNVHQ8BAf8EBAMCAqQwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUw
-AwEB/zAdBgNVHQ4EFgQUDHG3ASzeUezElup9zbPpBn/vjogwGwYDVR0RBBQwEoIH
-Zm9vLm9yZ4IHZm9vLmNvbTANBgkqhkiG9w0BAQsFAAOBgQBT+VLMbB9u27tBX8Aw
-ZrGY3rbNdBGhXVTksrjiF+6ZtDpD3iI56GH9zLxnqvXkgn3u0+Ard5TqF/xmdwVw
-NY0V/aWYfcL2G2auBCQrPvM03ozRnVUwVfP23eUzX2ORNHCYhd2ObQx4krrhs7cJ
-SWxtKwFlstoXY3K2g9oRD9UxdQ==
------END CERTIFICATE-----`
-
-// BarCert is a PEM-encoded TLS cert.
-// generated from src/crypto/tls:
-// go run generate_cert.go  --rsa-bits 1024 --host bar.org,bar.com  --ca --start-date "Jan 1 00:00:00 1970" --duration=10000h
-const barCert = `-----BEGIN CERTIFICATE-----
-MIICHTCCAYagAwIBAgIQcuIcNEXzBHPoxna5S6wG4jANBgkqhkiG9w0BAQsFADAS
-MRAwDgYDVQQKEwdBY21lIENvMB4XDTcwMDEwMTAwMDAwMFoXDTcxMDIyMTE2MDAw
-MFowEjEQMA4GA1UEChMHQWNtZSBDbzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
-gYEAqtcrP+KA7D6NjyztGNIPMup9KiBMJ8QL+preog/YHR7SQLO3kGFhpS3WKMab
-SzMypC3ZX1PZjBP5ZzwaV3PFbuwlCkPlyxR2lOWmullgI7mjY0TBeYLDIclIzGRp
-mpSDDSpkW1ay2iJDSpXjlhmwZr84hrCU7BRTQJo91fdsRTsCAwEAAaN0MHIwDgYD
-VR0PAQH/BAQDAgKkMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMB
-Af8wHQYDVR0OBBYEFK8jnzFQvBAgWtfzOyXY4VSkwrTXMBsGA1UdEQQUMBKCB2Jh
-ci5vcmeCB2Jhci5jb20wDQYJKoZIhvcNAQELBQADgYEAJz0ifAExisC/ZSRhWuHz
-7qs1i6Nd4+YgEVR8dR71MChP+AMxucY1/ajVjb9xlLys3GPE90TWSdVppabEVjZY
-Oq11nPKc50ItTt8dMku6t0JHBmzoGdkN0V4zJCBqdQJxhop8JpYJ0S9CW0eT93h3
-ipYQSsmIINGtMXJ8VkP/MlM=
------END CERTIFICATE-----`
-
-type gaugeMock struct {
-	metrics map[string]float64
-	labels  string
-}
-
-func (g gaugeMock) With(labelValues ...string) metrics.Gauge {
-	g.labels = strings.Join(labelValues, ",")
-	return g
-}
-
-func (g gaugeMock) Set(value float64) {
-	g.metrics[g.labels] = value
-}
-
-func (g gaugeMock) Add(delta float64) {
-	panic("implement me")
-}
-
-func TestAppendCertMetric(t *testing.T) {
-	testCases := []struct {
-		desc     string
-		certs    []string
-		expected map[string]float64
-	}{
-		{
-			desc:     "No certs",
-			certs:    []string{},
-			expected: map[string]float64{},
-		},
-		{
-			desc:  "One cert",
-			certs: []string{fooCert},
-			expected: map[string]float64{
-				"cn,,serial,123624926713171615935660664614975025408,sans,foo.com,foo.org": 3.6e+09,
-			},
-		},
-		{
-			desc:  "Two certs",
-			certs: []string{fooCert, barCert},
-			expected: map[string]float64{
-				"cn,,serial,123624926713171615935660664614975025408,sans,foo.com,foo.org": 3.6e+09,
-				"cn,,serial,152706022658490889223053211416725817058,sans,bar.com,bar.org": 3.6e+07,
-			},
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			gauge := &gaugeMock{
-				metrics: map[string]float64{},
-			}
-
-			for _, cert := range test.certs {
-				block, _ := pem.Decode([]byte(cert))
-				parsedCert, err := x509.ParseCertificate(block.Bytes)
-				require.NoError(t, err)
-
-				appendCertMetric(gauge, parsedCert)
-			}
-
-			assert.Equal(t, test.expected, gauge.metrics)
-		})
-	}
-}

docs/content/getting-started/faq.md

@@ -124,3 +124,16 @@ http:
     If there is a need for a response code other than a `503` and/or a custom message,
     the principle of the above example above (a catchall router) still stands,
     but the `unavailable` service should be adapted to fit such a need.
+
+## Why Is My TLS Certificate Not Reloaded When Its Contents Change ? 
+
+With the file provider,
+a configuration update is only triggered when one of the [watched](../providers/file.md#provider-configuration) configuration files is modified.
+
+Which is why, when a certificate is defined by path,
+and the actual contents of this certificate change,
+a configuration update is _not_ triggered.
+
+To take into account the new certificate contents, the update of the dynamic configuration must be forced.
+One way to achieve that, is to trigger a file notification,
+for example, by using the `touch` command on the configuration file.

docs/content/getting-started/install-traefik.md

@@ -16,7 +16,7 @@ Choose one of the [official Docker images](https://hub.docker.com/_/traefik) and
 
 ```bash
 docker run -d -p 8080:8080 -p 80:80 \
-    -v $PWD/traefik.yml:/etc/traefik/traefik.yml traefik:v2.5
+    -v $PWD/traefik.yml:/etc/traefik/traefik.yml traefik:v2.4
 ```
 
 For more details, go to the [Docker provider documentation](../providers/docker.md)

docs/content/getting-started/quick-start.md

@@ -15,7 +15,7 @@ version: '3'
 services:
   reverse-proxy:
     # The official v2 Traefik docker image
-    image: traefik:v2.5
+    image: traefik:v2.4
     # Enables the web UI and tells Traefik to listen to docker
     command: --api.insecure=true --providers.docker
     ports:

docs/content/https/tls.md

@@ -447,7 +447,7 @@ metadata:
 
 spec:
   clientAuth:
-    # the CA certificate is extracted from key `tls.ca` or `ca.crt` of the given secrets.
+    # the CA certificate is extracted from key `tls.ca` of the given secrets.
     secretNames:
       - secretCA
     clientAuthType: RequireAndVerifyClientCert

docs/content/middlewares/addprefix.md

@@ -3,7 +3,7 @@
 Prefixing the Path
 {: .subtitle }
 
-![AddPrefix](../../assets/img/middleware/addprefix.png)
+![AddPrefix](../assets/img/middleware/addprefix.png)
 
 The AddPrefix middleware updates the path of a request before forwarding it.
 

docs/content/middlewares/basicauth.md

@@ -3,7 +3,7 @@
 Adding Basic Authentication
 {: .subtitle }
 
-![BasicAuth](../../assets/img/middleware/basicauth.png)
+![BasicAuth](../assets/img/middleware/basicauth.png)
 
 The BasicAuth middleware restricts access to your services to known users.
 

docs/content/middlewares/buffering.md

@@ -3,7 +3,7 @@
 How to Read the Request before Forwarding It
 {: .subtitle }
 
-![Buffering](../../assets/img/middleware/buffering.png)
+![Buffering](../assets/img/middleware/buffering.png)
 
 The Buffering middleware limits the size of requests that can be forwarded to services.
 

docs/content/middlewares/chain.md

@@ -3,7 +3,7 @@
 When One Isn't Enough
 {: .subtitle }
 
-![Chain](../../assets/img/middleware/chain.png)
+![Chain](../assets/img/middleware/chain.png)
 
 The Chain middleware enables you to define reusable combinations of other pieces of middleware.
 It makes reusing the same groups easier.

docs/content/middlewares/circuitbreaker.md

@@ -3,7 +3,7 @@
 Don't Waste Time Calling Unhealthy Services
 {: .subtitle }
 
-![CircuitBreaker](../../assets/img/middleware/circuitbreaker.png)
+![CircuitBreaker](../assets/img/middleware/circuitbreaker.png)
 
 The circuit breaker protects your system from stacking requests to unhealthy services, resulting in cascading failures.
 

docs/content/middlewares/compress.md

@@ -3,7 +3,7 @@
 Compress Responses before Sending them to the Client
 {: .subtitle }
 
-![Compress](../../assets/img/middleware/compress.png)
+![Compress](../assets/img/middleware/compress.png)
 
 The Compress middleware uses gzip compression.
 

docs/content/middlewares/digestauth.md

@@ -3,7 +3,7 @@
 Adding Digest Authentication
 {: .subtitle }
 
-![BasicAuth](../../assets/img/middleware/digestauth.png)
+![BasicAuth](../assets/img/middleware/digestauth.png)
 
 The DigestAuth middleware restricts access to your services to known users.
 

docs/content/middlewares/errorpages.md

@@ -3,7 +3,7 @@
 It Has Never Been Easier to Say That Something Went Wrong
 {: .subtitle }
 
-![ErrorPages](../../assets/img/middleware/errorpages.png)
+![ErrorPages](../assets/img/middleware/errorpages.png)
 
 The ErrorPage middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.
 

docs/content/middlewares/forwardauth.md

@@ -3,7 +3,7 @@
 Using an External Service to Forward Authentication
 {: .subtitle }
 
-![AuthForward](../../assets/img/middleware/authforward.png)
+![AuthForward](../assets/img/middleware/authforward.png)
 
 The ForwardAuth middleware delegates authentication to an external service.
 If the service answers with a 2XX code, access is granted, and the original request is performed.
@@ -373,8 +373,7 @@ metadata:
   namespace: default
 
 data:
-  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key. 
-  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
 ```
 
 ```yaml tab="Consul Catalog"

docs/content/middlewares/headers.md

@@ -3,7 +3,7 @@
 Managing Request/Response headers
 {: .subtitle }
 
-![Headers](../../assets/img/middleware/headers.png)
+![Headers](../assets/img/middleware/headers.png)
 
 The Headers middleware manages the headers of requests and responses.
 
@@ -141,13 +141,13 @@ http:
 
 ### Using Security Headers
 
-Security-related headers (HSTS headers, Browser XSS filter, etc) can be managed similarly to custom headers as shown above.
+Security-related headers (HSTS headers, SSL redirection, Browser XSS filter, etc) can be managed similarly to custom headers as shown above.
 This functionality makes it possible to easily use security features by adding headers.
 
 ```yaml tab="Docker"
 labels:
   - "traefik.http.middlewares.testHeader.headers.framedeny=true"
-  - "traefik.http.middlewares.testHeader.headers.browserxssfilter=true"
+  - "traefik.http.middlewares.testHeader.headers.sslredirect=true"
 ```
 
 ```yaml tab="Kubernetes"
@@ -158,25 +158,25 @@ metadata:
 spec:
   headers:
     frameDeny: true
-    browserxssfilter: true
+    sslRedirect: true
 ```
 
 ```yaml tab="Consul Catalog"
 - "traefik.http.middlewares.testheader.headers.framedeny=true"
-- "traefik.http.middlewares.testheader.headers.browserxssfilter=true"
+- "traefik.http.middlewares.testheader.headers.sslredirect=true"
 ```
 
 ```json tab="Marathon"
 "labels": {
   "traefik.http.middlewares.testheader.headers.framedeny": "true",
-  "traefik.http.middlewares.testheader.headers.browserxssfilter": "true"
+  "traefik.http.middlewares.testheader.headers.sslredirect": "true"
 }
 ```
 
 ```yaml tab="Rancher"
 labels:
   - "traefik.http.middlewares.testheader.headers.framedeny=true"
-  - "traefik.http.middlewares.testheader.headers.browserxssfilter=true"
+  - "traefik.http.middlewares.testheader.headers.sslredirect=true"
 ```
 
 ```yaml tab="File (YAML)"
@@ -185,14 +185,14 @@ http:
     testHeader:
       headers:
         frameDeny: true
-        browserxssfilter: true
+        sslRedirect: true
 ```
 
 ```toml tab="File (TOML)"
 [http.middlewares]
   [http.middlewares.testHeader.headers]
     frameDeny = true
-    browserxssfilter = true
+    sslRedirect = true
 ```
 
 ### CORS Headers
@@ -355,26 +355,14 @@ The `hostsProxyHeaders` option is a set of header keys that may hold a proxied h
 
 ### `sslRedirect`
 
-!!! warning
-
-    Deprecated in favor of [EntryPoint redirection](../../routing/entrypoints.md#redirection) or the [RedirectScheme middleware](./redirectscheme.md).
-
 The `sslRedirect` only allow HTTPS requests when set to `true`.
 
 ### `sslTemporaryRedirect`
 
-!!! warning
-
-    Deprecated in favor of [EntryPoint redirection](../../routing/entrypoints.md#redirection) or the [RedirectScheme middleware](./redirectscheme.md).
-
 Set `sslTemporaryRedirect` to `true` to force an SSL redirection using a 302 (instead of a 301).
 
 ### `sslHost`
 
-!!! warning
-
-    Deprecated in favor of the [RedirectRegex middleware](./redirectregex.md).
-
 The `sslHost` option is the host name that is used to redirect HTTP requests to HTTPS.
 
 ### `sslProxyHeaders`
@@ -384,10 +372,6 @@ It can be useful when using other proxies (example: `"X-Forwarded-Proto": "https
 
 ### `sslForceHost`
 
-!!! warning
-
-    Deprecated in favor of the [RedirectRegex middleware](./redirectregex.md).
-
 Set `sslForceHost` to `true` and set `sslHost` to force requests to use `SSLHost` regardless of whether they already use SSL.
 
 ### `stsSeconds`
@@ -443,16 +427,8 @@ The `referrerPolicy` allows sites to control whether browsers forward the `Refer
 
 ### `featurePolicy`
 
-!!! warning
-
-    Deprecated in favor of `permissionsPolicy`
-
 The `featurePolicy` allows sites to control browser features.
 
-### `permissionsPolicy`
-
-The `permissionsPolicy` allows sites to control browser features.
-
 ### `isDevelopment`
 
 Set `isDevelopment` to `true` when developing to mitigate the unwanted effects of the `AllowedHosts`, SSL, and STS options.

docs/content/middlewares/http/overview.md

@@ -1,149 +0,0 @@
-# HTTP Middlewares
-
-Controlling connections
-{: .subtitle }
-
-![Overview](../../assets/img/middleware/overview.png)
-
-## Configuration Example
-
-```yaml tab="Docker"
-# As a Docker Label
-whoami:
-  #  A container that exposes an API to show its IP address
-  image: traefik/whoami
-  labels:
-    # Create a middleware named `foo-add-prefix`
-    - "traefik.http.middlewares.foo-add-prefix.addprefix.prefix=/foo"
-    # Apply the middleware named `foo-add-prefix` to the router named `router1`
-    - "traefik.http.routers.router1.middlewares=foo-add-prefix@docker"
-```
-
-```yaml tab="Kubernetes IngressRoute"
-# As a Kubernetes Traefik IngressRoute
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: middlewares.traefik.containo.us
-spec:
-  group: traefik.containo.us
-  version: v1alpha1
-  names:
-    kind: Middleware
-    plural: middlewares
-    singular: middleware
-  scope: Namespaced
-
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: stripprefix
-spec:
-  stripPrefix:
-    prefixes:
-      - /stripit
-
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: ingressroute
-spec:
-# more fields...
-  routes:
-    # more fields...
-    middlewares:
-      - name: stripprefix
-```
-
-```yaml tab="Consul Catalog"
-# Create a middleware named `foo-add-prefix`
-- "traefik.http.middlewares.foo-add-prefix.addprefix.prefix=/foo"
-# Apply the middleware named `foo-add-prefix` to the router named `router1`
-- "traefik.http.routers.router1.middlewares=foo-add-prefix@consulcatalog"
-```
-
-```json tab="Marathon"
-"labels": {
-  "traefik.http.middlewares.foo-add-prefix.addprefix.prefix": "/foo",
-  "traefik.http.routers.router1.middlewares": "foo-add-prefix@marathon"
-}
-```
-
-```yaml tab="Rancher"
-# As a Rancher Label
-labels:
-  # Create a middleware named `foo-add-prefix`
-  - "traefik.http.middlewares.foo-add-prefix.addprefix.prefix=/foo"
-  # Apply the middleware named `foo-add-prefix` to the router named `router1`
-  - "traefik.http.routers.router1.middlewares=foo-add-prefix@rancher"
-```
-
-```toml tab="File (TOML)"
-# As TOML Configuration File
-[http.routers]
-  [http.routers.router1]
-    service = "myService"
-    middlewares = ["foo-add-prefix"]
-    rule = "Host(`example.com`)"
-
-[http.middlewares]
-  [http.middlewares.foo-add-prefix.addPrefix]
-    prefix = "/foo"
-
-[http.services]
-  [http.services.service1]
-    [http.services.service1.loadBalancer]
-
-      [[http.services.service1.loadBalancer.servers]]
-        url = "http://127.0.0.1:80"
-```
-
-```yaml tab="File (YAML)"
-# As YAML Configuration File
-http:
-  routers:
-    router1:
-      service: myService
-      middlewares:
-        - "foo-add-prefix"
-      rule: "Host(`example.com`)"
-
-  middlewares:
-    foo-add-prefix:
-      addPrefix:
-        prefix: "/foo"
-
-  services:
-    service1:
-      loadBalancer:
-        servers:
-          - url: "http://127.0.0.1:80"
-```
-
-## Available HTTP Middlewares
-
-| Middleware                                | Purpose                                           | Area                        |
-|-------------------------------------------|---------------------------------------------------|-----------------------------|
-| [AddPrefix](addprefix.md)                 | Add a Path Prefix                                 | Path Modifier               |
-| [BasicAuth](basicauth.md)                 | Basic auth mechanism                              | Security, Authentication    |
-| [Buffering](buffering.md)                 | Buffers the request/response                      | Request Lifecycle           |
-| [Chain](chain.md)                         | Combine multiple pieces of middleware             | Middleware tool             |
-| [CircuitBreaker](circuitbreaker.md)       | Stop calling unhealthy services                   | Request Lifecycle           |
-| [Compress](compress.md)                   | Compress the response                             | Content Modifier            |
-| [DigestAuth](digestauth.md)               | Adds Digest Authentication                        | Security, Authentication    |
-| [Errors](errorpages.md)                   | Define custom error pages                         | Request Lifecycle           |
-| [ForwardAuth](forwardauth.md)             | Authentication delegation                         | Security, Authentication    |
-| [Headers](headers.md)                     | Add / Update headers                              | Security                    |
-| [IPWhiteList](ipwhitelist.md)             | Limit the allowed client IPs                      | Security, Request lifecycle |
-| [InFlightReq](inflightreq.md)             | Limit the number of simultaneous connections      | Security, Request lifecycle |
-| [PassTLSClientCert](passtlsclientcert.md) | Adding Client Certificates in a Header            | Security                    |
-| [RateLimit](ratelimit.md)                 | Limit the call frequency                          | Security, Request lifecycle |
-| [RedirectScheme](redirectscheme.md)       | Redirect easily the client elsewhere              | Request lifecycle           |
-| [RedirectRegex](redirectregex.md)         | Redirect the client elsewhere                     | Request lifecycle           |
-| [ReplacePath](replacepath.md)             | Change the path of the request                    | Path Modifier               |
-| [ReplacePathRegex](replacepathregex.md)   | Change the path of the request                    | Path Modifier               |
-| [Retry](retry.md)                         | Automatically retry the request in case of errors | Request lifecycle           |
-| [StripPrefix](stripprefix.md)             | Change the path of the request                    | Path Modifier               |
-| [StripPrefixRegex](stripprefixregex.md)   | Change the path of the request                    | Path Modifier               |

docs/content/middlewares/inflightreq.md

@@ -3,7 +3,7 @@
 Limiting the Number of Simultaneous In-Flight Requests
 {: .subtitle }
 
-![InFlightReq](../../assets/img/middleware/inflightreq.png)
+![InFlightReq](../assets/img/middleware/inflightreq.png)
 
 To proactively prevent services from being overwhelmed with high load, the number of allowed simultaneous in-flight requests can be limited.
 

docs/content/middlewares/ipwhitelist.md

@@ -3,7 +3,7 @@
 Limiting Clients to Specific IPs
 {: .subtitle }
 
-![IpWhiteList](../../assets/img/middleware/ipwhitelist.png)
+![IpWhiteList](../assets/img/middleware/ipwhitelist.png)
 
 IPWhitelist accepts / refuses requests based on the client IP.
 

docs/content/middlewares/overview.md

@@ -9,7 +9,7 @@ Attached to the routers, pieces of middleware are a means of tweaking the reques
 
 There are several available middleware in Traefik, some can modify the request, the headers, some are in charge of redirections, some add authentication, and so on.
 
-Middlewares that use the same protocol can be combined into chains to fit every scenario.
+Pieces of middleware can be combined in chains to fit every scenario.
 
 !!! warning "Provider Namespace"
 
@@ -31,6 +31,20 @@ whoami:
 ```
 
 ```yaml tab="Kubernetes IngressRoute"
+# As a Kubernetes Traefik IngressRoute
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: middlewares.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: Middleware
+    plural: middlewares
+    singular: middleware
+  scope: Namespaced
+
 ---
 apiVersion: traefik.containo.us/v1alpha1
 kind: Middleware
@@ -121,6 +135,26 @@ http:
 
 ## Available Middlewares
 
-A list of HTTP middlewares can be found [here](http/overview.md).
-
-A list of TCP middlewares can be found [here](tcp/overview.md).
+| Middleware                                | Purpose                                           | Area                        |
+|-------------------------------------------|---------------------------------------------------|-----------------------------|
+| [AddPrefix](addprefix.md)                 | Add a Path Prefix                                 | Path Modifier               |
+| [BasicAuth](basicauth.md)                 | Basic auth mechanism                              | Security, Authentication    |
+| [Buffering](buffering.md)                 | Buffers the request/response                      | Request Lifecycle           |
+| [Chain](chain.md)                         | Combine multiple pieces of middleware             | Middleware tool             |
+| [CircuitBreaker](circuitbreaker.md)       | Stop calling unhealthy services                   | Request Lifecycle           |
+| [Compress](compress.md)                   | Compress the response                             | Content Modifier            |
+| [DigestAuth](digestauth.md)               | Adds Digest Authentication                        | Security, Authentication    |
+| [Errors](errorpages.md)                   | Define custom error pages                         | Request Lifecycle           |
+| [ForwardAuth](forwardauth.md)             | Authentication delegation                         | Security, Authentication    |
+| [Headers](headers.md)                     | Add / Update headers                              | Security                    |
+| [IPWhiteList](ipwhitelist.md)             | Limit the allowed client IPs                      | Security, Request lifecycle |
+| [InFlightReq](inflightreq.md)             | Limit the number of simultaneous connections      | Security, Request lifecycle |
+| [PassTLSClientCert](passtlsclientcert.md) | Adding Client Certificates in a Header            | Security                    |
+| [RateLimit](ratelimit.md)                 | Limit the call frequency                          | Security, Request lifecycle |
+| [RedirectScheme](redirectscheme.md)       | Redirect easily the client elsewhere              | Request lifecycle           |
+| [RedirectRegex](redirectregex.md)         | Redirect the client elsewhere                     | Request lifecycle           |
+| [ReplacePath](replacepath.md)             | Change the path of the request                    | Path Modifier               |
+| [ReplacePathRegex](replacepathregex.md)   | Change the path of the request                    | Path Modifier               |
+| [Retry](retry.md)                         | Automatically retry the request in case of errors | Request lifecycle           |
+| [StripPrefix](stripprefix.md)             | Change the path of the request                    | Path Modifier               |
+| [StripPrefixRegex](stripprefixregex.md)   | Change the path of the request                    | Path Modifier               |

docs/content/middlewares/passtlsclientcert.md

@@ -248,7 +248,7 @@ PassTLSClientCert can add two headers to the request:
 !!! info
 
     * The headers are filled with escaped string so it can be safely placed inside a URL query.
-    * These options only work accordingly to the [MutualTLS configuration](../../https/tls.md#client-authentication-mtls).
+    * These options only work accordingly to the [MutualTLS configuration](../https/tls.md#client-authentication-mtls).
     That is to say, only the certificates that match the `clientAuth.clientAuthType` policy are passed.
 
 The following example shows a complete certificate and explains each of the middleware options.

docs/content/middlewares/tcp/ipwhitelist.md

@@ -1,67 +0,0 @@
-# IPWhiteList
-
-Limiting Clients to Specific IPs
-{: .subtitle }
-
-IPWhitelist accepts / refuses connections based on the client IP.
-
-## Configuration Examples
-
-```yaml tab="Docker"
-# Accepts connections from defined IP
-labels:
-  - "traefik.tcp.middlewares.test-ipwhitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
-```
-
-```yaml tab="Kubernetes"
-apiVersion: traefik.containo.us/v1alpha1
-kind: MiddlewareTCP
-metadata:
-  name: test-ipwhitelist
-spec:
-  ipWhiteList:
-    sourceRange:
-      - 127.0.0.1/32
-      - 192.168.1.7
-```
-
-```yaml tab="Consul Catalog"
-# Accepts request from defined IP
-- "traefik.tcp.middlewares.test-ipwhitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
-```
-
-```json tab="Marathon"
-"labels": {
-  "traefik.tcp.middlewares.test-ipwhitelist.ipwhitelist.sourcerange": "127.0.0.1/32,192.168.1.7"
-}
-```
-
-```yaml tab="Rancher"
-# Accepts request from defined IP
-labels:
-  - "traefik.tcp.middlewares.test-ipwhitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
-```
-
-```toml tab="File (TOML)"
-# Accepts request from defined IP
-[tcp.middlewares]
-  [tcp.middlewares.test-ipwhitelist.ipWhiteList]
-    sourceRange = ["127.0.0.1/32", "192.168.1.7"]
-```
-
-```yaml tab="File (YAML)"
-# Accepts request from defined IP
-http:
-  middlewares:
-    test-ipwhitelist:
-      ipWhiteList:
-        sourceRange:
-          - "127.0.0.1/32"
-          - "192.168.1.7"
-```
-
-## Configuration Options
-
-### `sourceRange`
-
-The `sourceRange` option sets the allowed IPs (or ranges of allowed IPs by using CIDR notation).

docs/content/middlewares/tcp/overview.md

@@ -1,134 +0,0 @@
-# TCP Middlewares
-
-Controlling connections
-{: .subtitle }
-
-![Overview](../../assets/img/middleware/overview.png)
-
-## Configuration Example
-
-```yaml tab="Docker"
-# As a Docker Label
-whoami:
-  #  A container that exposes an API to show its IP address
-  image: traefik/whoami
-  labels:
-    # Create a middleware named `foo-ip-whitelist`
-    - "traefik.tcp.middlewares.foo-ip-whitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
-    # Apply the middleware named `foo-ip-whitelist` to the router named `router1`
-    - "traefik.tcp.routers.router1.middlewares=foo-ip-whitelist@docker"
-```
-
-```yaml tab="Kubernetes IngressRoute"
-# As a Kubernetes Traefik IngressRoute
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: middlewaretcps.traefik.containo.us
-spec:
-  group: traefik.containo.us
-  version: v1alpha1
-  names:
-    kind: MiddlewareTCP
-    plural: middlewaretcps
-    singular: middlewaretcp
-  scope: Namespaced
-
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: foo-ip-whitelist
-spec:
-  ipWhiteList:
-    sourcerange:
-      - 127.0.0.1/32
-      - 192.168.1.7
-
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: ingressroute
-spec:
-# more fields...
-  routes:
-    # more fields...
-    middlewares:
-      - name: foo-ip-whitelist
-```
-
-```yaml tab="Consul Catalog"
-# Create a middleware named `foo-ip-whitelist`
-- "traefik.tcp.middlewares.foo-ip-whitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
-# Apply the middleware named `foo-ip-whitelist` to the router named `router1`
-- "traefik.tcp.routers.router1.middlewares=foo-ip-whitelist@consulcatalog"
-```
-
-```json tab="Marathon"
-"labels": {
-  "traefik.tcp.middlewares.foo-ip-whitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7",
-  "traefik.tcp.routers.router1.middlewares=foo-ip-whitelist@marathon"
-}
-```
-
-```yaml tab="Rancher"
-# As a Rancher Label
-labels:
-  # Create a middleware named `foo-ip-whitelist`
-  - "traefik.tcp.middlewares.foo-ip-whitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
-  # Apply the middleware named `foo-ip-whitelist` to the router named `router1`
-  - "traefik.tcp.routers.router1.middlewares=foo-ip-whitelist@rancher"
-```
-
-```toml tab="File (TOML)"
-# As TOML Configuration File
-[tcp.routers]
-  [tcp.routers.router1]
-    service = "myService"
-    middlewares = ["foo-ip-whitelist"]
-    rule = "Host(`example.com`)"
-
-[tcp.middlewares]
-  [tcp.middlewares.foo-ip-whitelist.ipWhiteList]
-    sourceRange = ["127.0.0.1/32", "192.168.1.7"]
-
-[tcp.services]
-  [tcp.services.service1]
-    [tcp.services.service1.loadBalancer]
-    [[tcp.services.service1.loadBalancer.servers]]
-      address = "10.0.0.10:4000"
-    [[tcp.services.service1.loadBalancer.servers]]
-      address = "10.0.0.11:4000"
-```
-
-```yaml tab="File (YAML)"
-# As YAML Configuration File
-tcp:
-  routers:
-    router1:
-      service: myService
-      middlewares:
-        - "foo-ip-whitelist"
-      rule: "Host(`example.com`)"
-
-  middlewares:
-    foo-ip-whitelist:
-      ipWhiteList:
-        sourceRange:
-          - "127.0.0.1/32"
-          - "192.168.1.7"
-
-  services:
-    service1:
-      loadBalancer:
-        servers:
-        - address: "10.0.0.10:4000"
-        - address: "10.0.0.11:4000"
-```
-
-## Available TCP Middlewares
-
-| Middleware                                | Purpose                                           | Area                        |
-|-------------------------------------------|---------------------------------------------------|-----------------------------|
-| [IPWhiteList](ipwhitelist.md)             | Limit the allowed client IPs                      | Security, Request lifecycle |

docs/content/migration/v1-to-v2.md

@@ -327,7 +327,7 @@ With Traefik v2 it is applied on an entry point or a [Router](../routing/routers
 To apply a redirection:
 
 - on an entry point, the [HTTP redirection](../routing/entrypoints.md#redirection) has to be configured.
-- on a router, one of the redirect middlewares, [RedirectRegex](../middlewares/http/redirectregex.md) or [RedirectScheme](../middlewares/http/redirectscheme.md), has to be configured and added to the router middlewares list.
+- on a router, one of the redirect middlewares, [RedirectRegex](../middlewares/redirectregex.md) or [RedirectScheme](../middlewares/redirectscheme.md), has to be configured and added to the router middlewares list.
 
 !!! example "Global HTTP to HTTPS redirection"
 
@@ -545,7 +545,7 @@ Use Case: Incoming requests to `http://example.org/admin` are forwarded to the w
 with the path `/admin` stripped, e.g. to `http://<IP>:<port>/`. In this case, you must:
 
 - First, configure a router named `admin` with a rule matching at least the path prefix with the `PathPrefix` keyword,
-- Then, define a middleware of type [`stripprefix`](../middlewares/http/stripprefix.md), which removes the prefix `/admin`, associated to the router `admin`.
+- Then, define a middleware of type [`stripprefix`](../middlewares/stripprefix.md), which removes the prefix `/admin`, associated to the router `admin`.
 
 !!! example "Strip Path Prefix When Forwarding to Backend"
 
@@ -660,12 +660,12 @@ with the path `/admin` stripped, e.g. to `http://<IP>:<port>/`. In this case, yo
 
 ??? question "What About Other Path Transformations?"
 
-    Instead of removing the path prefix with the [`stripprefix` middleware](../../middlewares/http/stripprefix/), you can also:
+    Instead of removing the path prefix with the [`stripprefix` middleware](../../middlewares/stripprefix/), you can also:
 
-    - Add a path prefix with the [`addprefix` middleware](../../middlewares/http/addprefix/)
-    - Replace the complete path of the request with the [`replacepath` middleware](../../middlewares/http/replacepath/)
-    - ReplaceRewrite path using Regexp with the [`replacepathregex` middleware](../../middlewares/http/replacepathregex/)
-    - And a lot more on the [`HTTP middlewares` page](../../middlewares/http/overview/)
+    - Add a path prefix with the [`addprefix` middleware](../../middlewares/addprefix/)
+    - Replace the complete path of the request with the [`replacepath` middleware](../../middlewares/replacepath/)
+    - ReplaceRewrite path using Regexp with the [`replacepathregex` middleware](../../middlewares/replacepathregex/)
+    - And a lot more on the [`middlewares` page](../../middlewares/overview/)
 
 ## ACME (LetsEncrypt)
 

docs/content/migration/v2.md

@@ -365,38 +365,13 @@ For more information, please read the [HTTP routers rule](../routing/routers/ind
 
 In `v2.4.9`, we changed span error to log only server errors (>= 500).
 
-## v2.4 to v2.5
+## v2.4.9 to v2.4.10
 
-### Kubernetes CRD
+### K8S CrossNamespace
 
-In `v2.5`, the [Traefik CRDs](../reference/dynamic-configuration/kubernetes-crd.md#definitions) have been updated to support the new API version `apiextensions.k8s.io/v1`. 
-As required by `apiextensions.k8s.io/v1`, we have included the OpenAPI validation schema. 
+In `v2.4.10`, the default value for `allowCrossNamespace` has been changed to `false`.
 
-After deploying the new [Traefik CRDs](../reference/dynamic-configuration/kubernetes-crd.md#definitions), the resources will be validated only on creation or update.
+### K8S ExternalName Service
 
-Please note that the unknown fields will not be pruned when migrating from `apiextensions.k8s.io/v1beta1` to `apiextensions.k8s.io/v1` CRDs.
-For more details check out the official [documentation](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#specifying-a-structural-schema).
-
-### Kubernetes Ingress
-
-Traefik v2.5 moves forward for the Ingress provider to support Kubernetes v1.22.
-
-Traefik now supports only v1.14+ Kubernetes clusters, which means the support of `extensions/v1beta1` API Version ingresses has been dropped.
-
-The `extensions/v1beta1` API Version should now be replaced either by `networking.k8s.io/v1beta1` or by `networking.k8s.io/v1` (as of Kubernetes v1.19+).
-
-The support of the `networking.k8s.io/v1beta1` API Version will stop in Kubernetes v1.22.
-
-## v2.5 to v2.6
-
-### Headers middleware: ssl redirect options
-
-`sslRedirect`, `sslTemporaryRedirect`, `sslHost` and `sslForceHost` are deprecated in Traefik v2.5.
-
-For simple HTTP to HTTPS redirection, you may use [EntryPoints redirections](../routing/entrypoints.md#redirection).
-
-For more advanced use cases, you can use either the [RedirectScheme middleware](../middlewares/http/redirectscheme.md) or the [RedirectRegex middleware](../middlewares/http/redirectregex.md).
-
-### Headers middleware: accessControlAllowOrigin
-
-`accessControlAllowOrigin` is no longer supported.
+In `v2.4.10`, by default, it is no longer authorized to reference Kubernetes ExternalName services.
+To allow it, the `allowExternalNameServices` option should be set to `true`.

docs/content/observability/access-logs.md

@@ -209,7 +209,7 @@ accessLog:
     | `RequestScheme`         | The HTTP scheme requested `http` or `https`.                                                                                                                        |
     | `RequestLine`           | `RequestMethod` + `RequestPath` + `RequestProtocol`                                                                                                                 |
     | `RequestContentSize`    | The number of bytes in the request entity (a.k.a. body) sent by the client.                                                                                         |
-    | `OriginDuration`        | The time taken (in nanoseconds) by the origin server ('upstream') to return its response.                                                                           |
+    | `OriginDuration`        | The time taken (in nanoseconds) by the origin server ('upstream') to return its response.                                                                                            |
     | `OriginContentSize`     | The content length specified by the origin server, or 0 if unspecified.                                                                                             |
     | `OriginStatus`          | The HTTP status code returned by the origin server. If the request was handled by this Traefik instance (e.g. with a redirect), then this value will be absent.     |
     | `OriginStatusLine`      | `OriginStatus` + Status code explanation                                                                                                                            |
@@ -218,10 +218,8 @@ accessLog:
     | `DownstreamContentSize` | The number of bytes in the response entity returned to the client. This is in addition to the "Content-Length" header, which may be present in the origin response. |
     | `RequestCount`          | The number of requests received since the Traefik instance started.                                                                                                 |
     | `GzipRatio`             | The response body compression ratio achieved.                                                                                                                       |
-    | `Overhead`              | The processing time overhead (in nanoseconds) caused by Traefik.                                                                                                    |
+    | `Overhead`              | The processing time overhead (in nanoseconds) caused by Traefik.                                                                                                                     |
     | `RetryAttempts`         | The amount of attempts the request was retried.                                                                                                                     |
-    | `TLSVersion`            | The TLS version used by the connection (e.g. `1.2`) (if connection is TLS).                                                                                         |
-    | `TLSCipher`             | The TLS cipher used by the connection (e.g. `TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA`) (if connection is TLS)                                                           |
 
 ## Log Rotation
 

docs/content/observability/metrics/datadog.md

@@ -59,27 +59,6 @@ metrics:
 ```bash tab="CLI"
 --metrics.datadog.addEntryPointsLabels=true
 ```
-#### `AddRoutersLabels`
-
-_Optional, Default=false_
-
-Enable metrics on routers.
-
-```toml tab="File (TOML)"
-[metrics]
-  [metrics.datadog]
-    addRoutersLabels = true
-```
-
-```yaml tab="File (YAML)"
-metrics:
-  datadog:
-    addRoutersLabels: true
-```
-
-```bash tab="CLI"
---metrics.datadog.addrouterslabels=true
-```
 
 #### `addServicesLabels`
 

docs/content/observability/metrics/influxdb.md

@@ -170,28 +170,6 @@ metrics:
 --metrics.influxdb.addEntryPointsLabels=true
 ```
 
-#### `AddRoutersLabels`
-
-_Optional, Default=false_
-
-Enable metrics on routers.
-
-```toml tab="File (TOML)"
-[metrics]
-  [metrics.influxDB]
-    addRoutersLabels = true
-```
-
-```yaml tab="File (YAML)"
-metrics:
-  influxDB:
-    addRoutersLabels: true
-```
-
-```bash tab="CLI"
---metrics.influxdb.addrouterslabels=true
-```
-
 #### `addServicesLabels`
 
 _Optional, Default=true_

docs/content/observability/metrics/prometheus.md

@@ -64,28 +64,6 @@ metrics:
 --metrics.prometheus.addEntryPointsLabels=true
 ```
 
-#### `AddRoutersLabels`
-
-_Optional, Default=false_
-
-Enable metrics on routers.
-
-```toml tab="File (TOML)"
-[metrics]
-  [metrics.prometheus]
-    addRoutersLabels = true
-```
-
-```yaml tab="File (YAML)"
-metrics:
-  prometheus:
-    addRoutersLabels: true
-```
-
-```bash tab="CLI"
---metrics.prometheus.addrouterslabels=true
-```
-
 #### `addServicesLabels`
 
 _Optional, Default=true_

docs/content/observability/metrics/statsd.md

@@ -60,28 +60,6 @@ metrics:
 --metrics.statsd.addEntryPointsLabels=true
 ```
 
-#### `AddRoutersLabels`
-
-_Optional, Default=false_
-
-Enable metrics on entry points.
-
-```toml tab="File (TOML)"
-[metrics]
-  [metrics.statsD]
-    addRoutersLabels = true
-```
-
-```yaml tab="File (YAML)"
-metrics:
-  statsD:
-    addRoutersLabels: true
-```
-
-```bash tab="CLI"
---metrics.statsd.addrouterslabels=true
-```
-
 #### `addServicesLabels`
 
 _Optional, Default=true_

docs/content/observability/tracing/jaeger.md

@@ -20,9 +20,6 @@ tracing:
     Traefik is able to send data over the compact thrift protocol to the [Jaeger agent](https://www.jaegertracing.io/docs/deployment/#agent)
     or a [Jaeger collector](https://www.jaegertracing.io/docs/deployment/#collectors).
 
-!!! info
-    All Jaeger configuration can be overridden by [environment variables](https://github.com/jaegertracing/jaeger-client-go#environment-variables)
-
 #### `samplingServerURL`
 
 _Required, Default="http://localhost:5778/sampling"_

docs/content/operations/dashboard.md

@@ -66,8 +66,8 @@ with a router attached to the service `api@internal` in the
 to allow defining:
 
 - One or more security features through [middlewares](../middlewares/overview.md)
-  like authentication ([basicAuth](../middlewares/http/basicauth.md) , [digestAuth](../middlewares/http/digestauth.md),
-  [forwardAuth](../middlewares/http/forwardauth.md)) or [whitelisting](../middlewares/http/ipwhitelist.md).
+  like authentication ([basicAuth](../middlewares/basicauth.md) , [digestAuth](../middlewares/digestauth.md),
+  [forwardAuth](../middlewares/forwardauth.md)) or [whitelisting](../middlewares/ipwhitelist.md).
 
 - A [router rule](#dashboard-router-rule) for accessing the dashboard,
   through Traefik itself (sometimes referred as "Traefik-ception").

docs/content/providers/docker.md

@@ -252,7 +252,7 @@ See the sections [Docker API Access](#docker-api-access) and [Docker Swarm API A
 
     services:
       traefik:
-         image: traefik:v2.5 # The official v2 Traefik docker image
+         image: traefik:v2.4 # The official v2 Traefik docker image
          ports:
            - "80:80"
          volumes:

docs/content/providers/kubernetes-crd.md

@@ -20,17 +20,11 @@ the Traefik engineering team developed a [Custom Resource Definition](https://ku
         * Apply the needed kubernetesCRD provider [configuration](#provider-configuration)
     * Add all necessary Traefik custom [resources](../reference/dynamic-configuration/kubernetes-crd.md#resources)
 
-!!! warning "Deprecated apiextensions.k8s.io/v1beta1 CRD"
-
-    The `apiextensions.k8s.io/v1beta1` CustomResourceDefinition is deprecated in Kubernetes `v1.16+` and will be removed in `v1.22+`.
-    
-    For Kubernetes `v1.16+`, please use the Traefik `apiextensions.k8s.io/v1` CRDs instead.
-
 ??? example "Initializing Resource Definition and RBAC"
 
     ```yaml tab="Traefik Resource Definition"
     # All resources definition must be declared
-    --8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml"
+    --8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition.yml"
     ```
 
     ```yaml tab="RBAC for Traefik CRD"
@@ -266,29 +260,48 @@ providers:
 
 ### `allowCrossNamespace`
 
-_Optional, Default: true_
+_Optional, Default: false_
 
-If the parameter is set to `false`, IngressRoutes are not able to reference any resources in other namespaces than theirs.
-
-!!! warning "Deprecation"
-
-    Please note that the default value for this option will be set to `false` in a future version.
+If the parameter is set to `true`, IngressRoutes are  able to reference  resources in other namespaces than theirs.
 
 ```yaml tab="File (YAML)"
 providers:
   kubernetesCRD:
-    allowCrossNamespace: false
+    allowCrossNamespace: true
     # ...
 ```
 
 ```toml tab="File (TOML)"
 [providers.kubernetesCRD]
-  allowCrossNamespace = false
+  allowCrossNamespace = true
   # ...
 ```
 
 ```bash tab="CLI"
---providers.kubernetescrd.allowCrossNamespace=false
+--providers.kubernetescrd.allowCrossNamespace=true
+```
+
+### `allowExternalNameServices`
+
+_Optional, Default: false_
+
+If the parameter is set to `true`, IngressRoutes are able to reference ExternalName services.
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesCRD:
+    allowExternalNameServices: true
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.kubernetesCRD]
+  allowExternalNameServices = true
+  # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetescrd.allowexternalnameservices=true
 ```
 
 ## Full Example

docs/content/providers/kubernetes-gateway.md

@@ -77,13 +77,13 @@ The [getting started guide](https://gateway-api.sigs.k8s.io/guides/getting-start
 
 !!! note ""
 
-    Keep in mind that the Traefik Gateway provider only supports the `v0.2.0`.
+    Keep in mind that the Traefik Gateway provider only supports the `v0.1.0`.
 
 For now, the Traefik Gateway Provider can be used while following the below guides:
 
 * [Simple Gateway](https://gateway-api.sigs.k8s.io/guides/simple-gateway/)
 * [HTTP routing](https://gateway-api.sigs.k8s.io/guides/http-routing/)
-* [TLS](https://gateway-api.sigs.k8s.io/guides/tls/)
+* [TLS](https://gateway-api.sigs.k8s.io/guides/tls/) (Partial support: only on listeners with terminate mode)
 
 ## Resource Configuration
 
@@ -96,9 +96,7 @@ Traefik implements the following resources:
 
 * `GatewayClass` defines a set of Gateways that share a common configuration and behaviour.
 * `Gateway` describes how traffic can be translated to Services within the cluster.
-* `HTTPRoute` defines HTTP rules for mapping requests from a Gateway to Kubernetes Services.
-* `TCPRoute` defines TCP rules for mapping requests from a Gateway to Kubernetes Services.
-* `TLSRoute` defines TLS rules for mapping requests from a Gateway to Kubernetes Services.
+* `HTTPRoute` define HTTP rules for mapping requests from a Gateway to Kubernetes Services.
 
 ## Provider Configuration
 

docs/content/providers/kubernetes-ingress.md

@@ -6,10 +6,6 @@ The Kubernetes Ingress Controller.
 The Traefik Kubernetes Ingress provider is a Kubernetes Ingress controller; that is to say,
 it manages access to cluster services by supporting the [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) specification.
 
-## Requirements
-
-Traefik supports `1.14+` Kubernetes clusters.
-
 ## Routing Configuration
 
 See the dedicated section in [routing](../routing/providers/kubernetes-ingress.md).
@@ -35,9 +31,9 @@ The provider then watches for incoming ingresses events, such as the example bel
 and derives the corresponding dynamic configuration from it,
 which in turn creates the resulting routers, services, handlers, etc.
 
-```yaml tab="Ingress"
+```yaml tab="File (YAML)"
 kind: Ingress
-apiVersion: networking.k8s.io/v1beta1
+apiVersion: extensions/v1beta1
 metadata:
   name: "foo"
   namespace: production
@@ -57,32 +53,6 @@ spec:
               servicePort: 80
 ```
 
-```yaml tab="Ingress Kubernetes v1.19+"
-kind: Ingress
-apiVersion: networking.k8s.io/v1
-metadata:
-  name: "foo"
-  namespace: production
-
-spec:
-  rules:
-    - host: example.net
-      http:
-        paths:
-          - path: /bar
-            backend:
-              service:
-                name:  service1
-                port:
-                  number: 80
-          - path: /foo
-            backend:
-              service:
-                name:  service1
-                port:
-                  number: 80
-```
-
 ## LetsEncrypt Support with the Ingress Provider
 
 By design, Traefik is a stateless application,
@@ -250,13 +220,11 @@ Value of `kubernetes.io/ingress.class` annotation that identifies Ingress object
 If the parameter is set, only Ingresses containing an annotation with the same value are processed.
 Otherwise, Ingresses missing the annotation, having an empty value, or the value `traefik` are processed.
 
-??? info "Kubernetes 1.18+"
+!!! info "Kubernetes 1.18+"
 
     If the Kubernetes cluster version is 1.18+,
     the new `IngressClass` resource can be leveraged to identify Ingress objects that should be processed.
-    In that case, Traefik will look for an `IngressClass` in the cluster with the controller value equal to *traefik.io/ingress-controller*.
-
-    In addition to the controller value matching mechanism, the property `ingressClass` (if set) will be used to select IngressClasses by applying a strict matching on their name.
+    In that case, Traefik will look for an `IngressClass` in the cluster with the controller value equal to *traefik.io/ingress-controller*. 
 
     Please see [this article](https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/) for more information or the example below.
 
@@ -286,39 +254,6 @@ Otherwise, Ingresses missing the annotation, having an empty value, or the value
               servicePort: 80
     ```
 
-??? info "Kubernetes 1.19+"
-
-    If the Kubernetes cluster version is 1.19+,
-    prefer using the `networking.k8s.io/v1` [apiVersion](https://v1-19.docs.kubernetes.io/docs/setup/release/notes/#api-change) of `Ingress` and `IngressClass`.
-
-    ```yaml tab="IngressClass"
-    apiVersion: networking.k8s.io/v1
-    kind: IngressClass
-    metadata:
-      name: traefik-lb
-    spec:
-      controller: traefik.io/ingress-controller
-    ```
-
-    ```yaml tab="Ingress"
-    apiVersion: "networking.k8s.io/v1"
-    kind: "Ingress"
-    metadata:
-      name: "example-ingress"
-    spec:
-      ingressClassName: "traefik-lb"
-      rules:
-      - host: "*.example.com"
-        http:
-          paths:
-          - path: "/example"
-            backend:
-              service:
-                name: "example-service"
-                port:
-                    number: 80
-    ```
-
 ```yaml tab="File (YAML)"
 providers:
   kubernetesIngress:
@@ -440,30 +375,29 @@ providers:
 --providers.kubernetesingress.throttleDuration=10s
 ```
 
-### `allowEmptyServices`
+### `allowExternalNameServices`
 
-_Optional, Default: false
+_Optional, Default: false_
+
+If the parameter is set to `true`, Ingresses are able to reference ExternalName services.
 
 ```yaml tab="File (YAML)"
 providers:
   kubernetesIngress:
-    allowEmptyServices: true
+    allowExternalNameServices: true
     # ...
 ```
 
 ```toml tab="File (TOML)"
 [providers.kubernetesIngress]
-  allowEmptyServices = true
+  allowExternalNameServices = true
   # ...
 ```
 
 ```bash tab="CLI"
---providers.kubernetesingress.allowEmptyServices=true
+--providers.kubernetesingress.allowexternalnameservices=true
 ```
 
-Allow the creation of services if there are no endpoints available.
-This results in `503` http responses instead of `404`.
-
 ### Further
 
 To learn more about the various aspects of the Ingress specification that Traefik supports,

docs/content/reference/dynamic-configuration/docker-labels.yml

@@ -35,6 +35,7 @@
 - "traefik.http.middlewares.middleware10.headers.accesscontrolallowcredentials=true"
 - "traefik.http.middlewares.middleware10.headers.accesscontrolallowheaders=foobar, foobar"
 - "traefik.http.middlewares.middleware10.headers.accesscontrolallowmethods=foobar, foobar"
+- "traefik.http.middlewares.middleware10.headers.accesscontrolalloworigin=foobar"
 - "traefik.http.middlewares.middleware10.headers.accesscontrolalloworiginlist=foobar, foobar"
 - "traefik.http.middlewares.middleware10.headers.accesscontrolalloworiginlistregex=foobar, foobar"
 - "traefik.http.middlewares.middleware10.headers.accesscontrolexposeheaders=foobar, foobar"
@@ -159,9 +160,7 @@
 - "traefik.http.services.service01.loadbalancer.server.port=foobar"
 - "traefik.http.services.service01.loadbalancer.server.scheme=foobar"
 - "traefik.http.services.service01.loadbalancer.serverstransport=foobar"
-- "traefik.tcp.middlewares.middleware00.ipwhitelist.sourcerange=foobar, foobar"
 - "traefik.tcp.routers.tcprouter0.entrypoints=foobar, foobar"
-- "traefik.tcp.routers.tcprouter0.middlewares=foobar, foobar"
 - "traefik.tcp.routers.tcprouter0.rule=foobar"
 - "traefik.tcp.routers.tcprouter0.service=foobar"
 - "traefik.tcp.routers.tcprouter0.tls=true"
@@ -173,7 +172,6 @@
 - "traefik.tcp.routers.tcprouter0.tls.options=foobar"
 - "traefik.tcp.routers.tcprouter0.tls.passthrough=true"
 - "traefik.tcp.routers.tcprouter1.entrypoints=foobar, foobar"
-- "traefik.tcp.routers.tcprouter1.middlewares=foobar, foobar"
 - "traefik.tcp.routers.tcprouter1.rule=foobar"
 - "traefik.tcp.routers.tcprouter1.service=foobar"
 - "traefik.tcp.routers.tcprouter1.tls=true"

docs/content/reference/dynamic-configuration/file.toml

@@ -69,8 +69,6 @@
         service = "foobar"
         maxBodySize = 42
 
-        [http.services.Service02.mirroring.healthCheck]
-
         [[http.services.Service02.mirroring.mirrors]]
           name = "foobar"
           percent = 42
@@ -80,7 +78,6 @@
           percent = 42
     [http.services.Service03]
       [http.services.Service03.weighted]
-        [http.services.Service03.weighted.healthCheck]
 
         [[http.services.Service03.weighted.services]]
           name = "foobar"
@@ -155,6 +152,7 @@
         accessControlAllowCredentials = true
         accessControlAllowHeaders = ["foobar", "foobar"]
         accessControlAllowMethods = ["foobar", "foobar"]
+        accessControlAllowOrigin = "foobar"
         accessControlAllowOriginList = ["foobar", "foobar"]
         accessControlAllowOriginListRegex = ["foobar", "foobar"]
         accessControlExposeHeaders = ["foobar", "foobar"]
@@ -277,7 +275,6 @@
       insecureSkipVerify = true
       rootCAs = ["foobar", "foobar"]
       maxIdleConnsPerHost = 42
-      disableHTTP2 = true
 
       [[http.serversTransports.ServersTransport0.certificates]]
         certFile = "foobar"
@@ -295,7 +292,6 @@
       insecureSkipVerify = true
       rootCAs = ["foobar", "foobar"]
       maxIdleConnsPerHost = 42
-      disableHTTP2 = true
 
       [[http.serversTransports.ServersTransport1.certificates]]
         certFile = "foobar"
@@ -313,7 +309,6 @@
   [tcp.routers]
     [tcp.routers.TCPRouter0]
       entryPoints = ["foobar", "foobar"]
-      middlewares = ["foobar", "foobar"]
       service = "foobar"
       rule = "foobar"
       [tcp.routers.TCPRouter0.tls]
@@ -330,7 +325,6 @@
           sans = ["foobar", "foobar"]
     [tcp.routers.TCPRouter1]
       entryPoints = ["foobar", "foobar"]
-      middlewares = ["foobar", "foobar"]
       service = "foobar"
       rule = "foobar"
       [tcp.routers.TCPRouter1.tls]
@@ -367,10 +361,6 @@
         [[tcp.services.TCPService02.weighted.services]]
           name = "foobar"
           weight = 42
-  [tcp.middlewares]
-    [tcp.middlewares.Middleware00]
-      [tcp.middlewares.Middleware00.ipWhiteList]
-      sourceRange = ["foobar", "foobar"]
 
 [udp]
   [udp.routers]

docs/content/reference/dynamic-configuration/file.yaml

@@ -75,7 +75,6 @@ http:
       mirroring:
         service: foobar
         maxBodySize: 42
-        healthCheck: {}
         mirrors:
         - name: foobar
           percent: 42
@@ -83,7 +82,6 @@ http:
           percent: 42
     Service03:
       weighted:
-        healthCheck: {}
         services:
         - name: foobar
           weight: 42
@@ -179,6 +177,7 @@ http:
         accessControlAllowMethods:
         - foobar
         - foobar
+        accessControlAllowOrigin: foobar
         accessControlAllowOriginList:
         - foobar
         - foobar
@@ -328,7 +327,6 @@ http:
         dialTimeout: 42s
         responseHeaderTimeout: 42s
         idleConnTimeout: 42s
-      disableHTTP2: true
     ServersTransport1:
       serverName: foobar
       insecureSkipVerify: true
@@ -345,16 +343,12 @@ http:
         dialTimeout: 42s
         responseHeaderTimeout: 42s
         idleConnTimeout: 42s
-      disableHTTP2: true
 tcp:
   routers:
     TCPRouter0:
       entryPoints:
       - foobar
       - foobar
-      middlewares:
-      - foobar
-      - foobar
       service: foobar
       rule: foobar
       tls:
@@ -374,9 +368,6 @@ tcp:
       entryPoints:
       - foobar
       - foobar
-      middlewares:
-      - foobar
-      - foobar
       service: foobar
       rule: foobar
       tls:
@@ -392,12 +383,6 @@ tcp:
           sans:
           - foobar
           - foobar
-  middlewares:
-    Middleware00:
-      ipWhiteList:
-        sourceRange:
-        - foobar
-        - foobar
   services:
     TCPService01:
       loadBalancer:

docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml

@@ -1,8 +0,0 @@
---8<-- "content/reference/dynamic-configuration/traefik.containo.us_ingressroutes.yaml"
---8<-- "content/reference/dynamic-configuration/traefik.containo.us_ingressroutetcps.yaml"
---8<-- "content/reference/dynamic-configuration/traefik.containo.us_ingressrouteudps.yaml"
---8<-- "content/reference/dynamic-configuration/traefik.containo.us_middlewares.yaml"
---8<-- "content/reference/dynamic-configuration/traefik.containo.us_serverstransports.yaml"
---8<-- "content/reference/dynamic-configuration/traefik.containo.us_tlsoptions.yaml"
---8<-- "content/reference/dynamic-configuration/traefik.containo.us_tlsstores.yaml"
---8<-- "content/reference/dynamic-configuration/traefik.containo.us_traefikservices.yaml"

docs/content/reference/dynamic-configuration/kubernetes-crd-definition.yml

@@ -0,0 +1,118 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: ingressroutes.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: IngressRoute
+    plural: ingressroutes
+    singular: ingressroute
+  scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: middlewares.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: Middleware
+    plural: middlewares
+    singular: middleware
+  scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: ingressroutetcps.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: IngressRouteTCP
+    plural: ingressroutetcps
+    singular: ingressroutetcp
+  scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: ingressrouteudps.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: IngressRouteUDP
+    plural: ingressrouteudps
+    singular: ingressrouteudp
+  scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: tlsoptions.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: TLSOption
+    plural: tlsoptions
+    singular: tlsoption
+  scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: tlsstores.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: TLSStore
+    plural: tlsstores
+    singular: tlsstore
+  scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: traefikservices.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: TraefikService
+    plural: traefikservices
+    singular: traefikservice
+  scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serverstransports.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: ServersTransport
+    plural: serverstransports
+    singular: serverstransport
+  scope: Namespaced

docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml

@@ -34,7 +34,6 @@ rules:
       - traefik.containo.us
     resources:
       - middlewares
-      - middlewaretcps
       - ingressroutes
       - traefikservices
       - ingressroutetcps

docs/content/reference/dynamic-configuration/kubernetes-crd-resource.yml

@@ -63,10 +63,10 @@ spec:
   mirroring:
     name: wrr2
     kind: TraefikService
-    # Optional
-    maxBodySize: 2000000000
     mirrors:
       - name: s2
+        # Optional
+        maxBodySize: 2000000000
         # Optional, as it is the default value
         kind: Service
         percent: 20
@@ -77,7 +77,6 @@ apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
   name: ingressroute
-
 spec:
   entryPoints:
     - web
@@ -99,7 +98,6 @@ spec:
           port: 433
           serversTransport: mytransport
     - match: PathPrefix(`/misc`)
-      kind: Rule
       services:
         - name: s3
           port: 80
@@ -107,7 +105,6 @@ spec:
         - name: stripprefix
         - name: addprefix
     - match: PathPrefix(`/misc`)
-      kind: Rule
       services:
         - name: s3
           # Optional, as it is the default value
@@ -116,12 +113,10 @@ spec:
           # scheme allow to override the scheme for the service. (ex: https or h2c)
           scheme: https
     - match: PathPrefix(`/lb`)
-      kind: Rule
       services:
         - name: wrr1
           kind: TraefikService
     - match: PathPrefix(`/mirrored`)
-      kind: Rule
       services:
         - name: mirror1
           kind: TraefikService
@@ -147,8 +142,6 @@ spec:
       services:
         - name: whoamitcp
           port: 8080
-      middlewares:
-        - name: ipwhitelist
   tls:
     secretName: foosecret
     passthrough: false
@@ -188,10 +181,10 @@ spec:
     - foobar
     - foobar
   clientAuth:
-    secretNames:
+    caFiles:
       - foobar
       - foobar
-    clientAuthType: RequireAndVerifyClientCert
+    clientAuthType: foobar
   sniStrict: true
   preferServerCipherSuites: true
 
@@ -216,4 +209,3 @@ spec:
     dialTimeout: 42s
     responseHeaderTimeout: 42s
     idleConnTimeout: 42s
-  disableHTTP2: true

docs/content/reference/dynamic-configuration/kubernetes-crd.md

@@ -5,12 +5,8 @@ Dynamic configuration with Kubernetes Custom Resource
 
 ## Definitions
 
-```yaml tab="apiextensions.k8s.io/v1"
---8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml"
-```
-
-```yaml tab="apiextensions.k8s.io/v1beta1"
---8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition-v1beta1.yml"
+```yaml
+--8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition.yml"
 ```
 
 ## Resources

docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml

@@ -20,8 +20,6 @@ rules:
       - gatewayclasses
       - gateways
       - httproutes
-      - tcproutes
-      - tlsroutes
     verbs:
       - get
       - list
@@ -32,8 +30,6 @@ rules:
       - gatewayclasses/status
       - gateways/status
       - httproutes/status
-      - tcproutes/status
-      - tlsroutes/status
     verbs:
       - update
 

docs/content/reference/dynamic-configuration/kubernetes-gateway-resource.yml

@@ -22,44 +22,7 @@ spec:
         namespaces:
           from: Same
         selector:
-          matchLabels:
-            app: foo
-     - protocol: HTTPS
-       port: 443
-       tls:
-         certificateRef:
-           group: "core"
-           kind: "Secret"
-           name: "mysecret"
-       routes:
-         kind: HTTPRoute
-         selector:
-           matchLabels:
-             app: foo
-    - protocol: TCP
-      port: 9000
-      routes:
-        kind: TCPRoute
-        namespaces:
-          from: Same
-        selector:
-          matchLabels:
-            app: footcp
-    - protocol: TLS
-      port: 9443
-      hostname: example.com
-      tls:
-        certificateRef:
-          group: "core"
-          kind: "Secret"
-          name: "mysecret"
-      routes:
-        kind: TLSRoute
-        namespaces:
-          from: Same
-        selector:
-          matchLabels:
-            app: footls
+          app: foo
 
 ---
 kind: HTTPRoute
@@ -81,44 +44,3 @@ spec:
         - serviceName: whoami
           port: 80
           weight: 1
-    - matches:
-        - path:
-            type: Prefix
-            value: /foo
-      forwardTo:
-        - backendRef:
-            group: traefik.containo.us
-            kind: TraefikService
-            name: myservice@file
-          weight: 1
-          port: 80
-
----
-kind: TCPRoute
-apiVersion: networking.x-k8s.io/v1alpha1
-metadata:
-  name: tcp-app-1
-  namespace: default
-  labels:
-    app: footcp
-spec:
-  rules:
-     - forwardTo:
-        - serviceName: whoamitcp
-          port: 9000
-          weight: 1
-
----
-kind: TLSRoute
-apiVersion: networking.x-k8s.io/v1alpha1
-metadata:
-  name: tls-app-1
-  namespace: default
-  labels:
-    app: footls
-spec:
-  rules:
-    - forwardTo:
-        - serviceName: whoamitcp
-          port: 9000
-          weight: 1

docs/content/reference/dynamic-configuration/kubernetes-gateway-simple-http.yml

@@ -14,9 +14,9 @@ metadata:
   namespace: default
 spec:
   gatewayClassName: my-gateway-class
-  listeners:  # Use GatewayClass defaults for listener definition.
+  listeners:
     - protocol: HTTP
-      port: 443
+      port: 80
       routes:
         kind: HTTPRoute
         namespaces:
@@ -35,7 +35,7 @@ metadata:
     app: foo
 spec:
   hostnames:
-    - "foo.com"
+    - "whoami"
   rules:
     - matches:
         - path:

docs/content/reference/dynamic-configuration/kubernetes-gateway.md

@@ -9,8 +9,6 @@ Dynamic configuration with Kubernetes Gateway provider.
 --8<-- "content/reference/dynamic-configuration/networking.x-k8s.io_gatewayclasses.yaml"
 --8<-- "content/reference/dynamic-configuration/networking.x-k8s.io_gateways.yaml"
 --8<-- "content/reference/dynamic-configuration/networking.x-k8s.io_httproutes.yaml"
---8<-- "content/reference/dynamic-configuration/networking.x-k8s.io_tcproutes.yaml"
---8<-- "content/reference/dynamic-configuration/networking.x-k8s.io_tlsroutes.yaml"
 ```
 
 ## Resources

docs/content/reference/dynamic-configuration/kv-ref.md

@@ -43,6 +43,7 @@
 | `traefik/http/middlewares/Middleware10/headers/accessControlAllowHeaders/1` | `foobar` |
 | `traefik/http/middlewares/Middleware10/headers/accessControlAllowMethods/0` | `foobar` |
 | `traefik/http/middlewares/Middleware10/headers/accessControlAllowMethods/1` | `foobar` |
+| `traefik/http/middlewares/Middleware10/headers/accessControlAllowOrigin` | `foobar` |
 | `traefik/http/middlewares/Middleware10/headers/accessControlAllowOriginList/0` | `foobar` |
 | `traefik/http/middlewares/Middleware10/headers/accessControlAllowOriginList/1` | `foobar` |
 | `traefik/http/middlewares/Middleware10/headers/accessControlAllowOriginListRegex/0` | `foobar` |
@@ -168,7 +169,6 @@
 | `traefik/http/serversTransports/ServersTransport0/certificates/0/keyFile` | `foobar` |
 | `traefik/http/serversTransports/ServersTransport0/certificates/1/certFile` | `foobar` |
 | `traefik/http/serversTransports/ServersTransport0/certificates/1/keyFile` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport0/disableHTTP2` | `true` |
 | `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/dialTimeout` | `42s` |
 | `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/idleConnTimeout` | `42s` |
 | `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/responseHeaderTimeout` | `42s` |
@@ -181,7 +181,6 @@
 | `traefik/http/serversTransports/ServersTransport1/certificates/0/keyFile` | `foobar` |
 | `traefik/http/serversTransports/ServersTransport1/certificates/1/certFile` | `foobar` |
 | `traefik/http/serversTransports/ServersTransport1/certificates/1/keyFile` | `foobar` |
-| `traefik/http/serversTransports/ServersTransport1/disableHTTP2` | `true` |
 | `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/dialTimeout` | `42s` |
 | `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/idleConnTimeout` | `42s` |
 | `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/responseHeaderTimeout` | `42s` |
@@ -208,14 +207,12 @@
 | `traefik/http/services/Service01/loadBalancer/sticky/cookie/name` | `foobar` |
 | `traefik/http/services/Service01/loadBalancer/sticky/cookie/sameSite` | `foobar` |
 | `traefik/http/services/Service01/loadBalancer/sticky/cookie/secure` | `true` |
-| `traefik/http/services/Service02/mirroring/healthCheck` | `` |
 | `traefik/http/services/Service02/mirroring/maxBodySize` | `42` |
 | `traefik/http/services/Service02/mirroring/mirrors/0/name` | `foobar` |
 | `traefik/http/services/Service02/mirroring/mirrors/0/percent` | `42` |
 | `traefik/http/services/Service02/mirroring/mirrors/1/name` | `foobar` |
 | `traefik/http/services/Service02/mirroring/mirrors/1/percent` | `42` |
 | `traefik/http/services/Service02/mirroring/service` | `foobar` |
-| `traefik/http/services/Service03/weighted/healthCheck` | `` |
 | `traefik/http/services/Service03/weighted/services/0/name` | `foobar` |
 | `traefik/http/services/Service03/weighted/services/0/weight` | `42` |
 | `traefik/http/services/Service03/weighted/services/1/name` | `foobar` |
@@ -224,12 +221,8 @@
 | `traefik/http/services/Service03/weighted/sticky/cookie/name` | `foobar` |
 | `traefik/http/services/Service03/weighted/sticky/cookie/sameSite` | `foobar` |
 | `traefik/http/services/Service03/weighted/sticky/cookie/secure` | `true` |
-| `traefik/tcp/middlewares/Middleware00/ipWhiteList/sourceRange/0` | `foobar` |
-| `traefik/tcp/middlewares/Middleware00/ipWhiteList/sourceRange/1` | `foobar` |
 | `traefik/tcp/routers/TCPRouter0/entryPoints/0` | `foobar` |
 | `traefik/tcp/routers/TCPRouter0/entryPoints/1` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/middlewares/0` | `foobar` |
-| `traefik/tcp/routers/TCPRouter0/middlewares/1` | `foobar` |
 | `traefik/tcp/routers/TCPRouter0/rule` | `foobar` |
 | `traefik/tcp/routers/TCPRouter0/service` | `foobar` |
 | `traefik/tcp/routers/TCPRouter0/tls/certResolver` | `foobar` |
@@ -243,8 +236,6 @@
 | `traefik/tcp/routers/TCPRouter0/tls/passthrough` | `true` |
 | `traefik/tcp/routers/TCPRouter1/entryPoints/0` | `foobar` |
 | `traefik/tcp/routers/TCPRouter1/entryPoints/1` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/middlewares/0` | `foobar` |
-| `traefik/tcp/routers/TCPRouter1/middlewares/1` | `foobar` |
 | `traefik/tcp/routers/TCPRouter1/rule` | `foobar` |
 | `traefik/tcp/routers/TCPRouter1/service` | `foobar` |
 | `traefik/tcp/routers/TCPRouter1/tls/certResolver` | `foobar` |

docs/content/reference/dynamic-configuration/marathon-labels.json

@@ -35,6 +35,7 @@
 "traefik.http.middlewares.middleware10.headers.accesscontrolallowcredentials": "true",
 "traefik.http.middlewares.middleware10.headers.accesscontrolallowheaders": "foobar, foobar",
 "traefik.http.middlewares.middleware10.headers.accesscontrolallowmethods": "foobar, foobar",
+"traefik.http.middlewares.middleware10.headers.accesscontrolalloworigin": "foobar",
 "traefik.http.middlewares.middleware10.headers.accesscontrolalloworiginlist": "foobar, foobar",
 "traefik.http.middlewares.middleware10.headers.accesscontrolalloworiginlistregex": "foobar, foobar",
 "traefik.http.middlewares.middleware10.headers.accesscontrolexposeheaders": "foobar, foobar",

docs/content/reference/dynamic-configuration/networking.x-k8s.io_tcproutes.yaml

@@ -1,254 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.4.1
-  creationTimestamp: null
-  name: tcproutes.networking.x-k8s.io
-spec:
-  group: networking.x-k8s.io
-  names:
-    kind: TCPRoute
-    listKind: TCPRouteList
-    plural: tcproutes
-    singular: tcproute
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: TCPRoute is the Schema for the TCPRoute resource.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: Spec defines the desired state of TCPRoute.
-            properties:
-              gateways:
-                default:
-                  allow: SameNamespace
-                description: Gateways defines which Gateways can use this Route.
-                properties:
-                  allow:
-                    default: SameNamespace
-                    description: 'Allow indicates which Gateways will be allowed to use this route. Possible values are: * All: Gateways in any namespace can use this route. * FromList: Only Gateways specified in GatewayRefs may use this route. * SameNamespace: Only Gateways in the same namespace may use this route.'
-                    enum:
-                    - All
-                    - FromList
-                    - SameNamespace
-                    type: string
-                  gatewayRefs:
-                    description: GatewayRefs must be specified when Allow is set to "FromList". In that case, only Gateways referenced in this list will be allowed to use this route. This field is ignored for other values of "Allow".
-                    items:
-                      description: GatewayReference identifies a Gateway in a specified namespace.
-                      properties:
-                        name:
-                          description: Name is the name of the referent.
-                          maxLength: 253
-                          minLength: 1
-                          type: string
-                        namespace:
-                          description: Namespace is the namespace of the referent.
-                          maxLength: 253
-                          minLength: 1
-                          type: string
-                      required:
-                      - name
-                      - namespace
-                      type: object
-                    type: array
-                type: object
-              rules:
-                description: Rules are a list of TCP matchers and actions.
-                items:
-                  description: TCPRouteRule is the configuration for a given rule.
-                  properties:
-                    forwardTo:
-                      description: ForwardTo defines the backend(s) where matching requests should be sent.
-                      items:
-                        description: RouteForwardTo defines how a Route should forward a request.
-                        properties:
-                          backendRef:
-                            description: "BackendRef is a reference to a backend to forward matched requests to. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. \n If the referent cannot be found, the rule is not included in the route. The controller should raise the \"ResolvedRefs\" condition on the Gateway with the \"DegradedRoutes\" reason. The gateway status for this route should be updated with a condition that describes the error more specifically. \n Support: Custom"
-                            properties:
-                              group:
-                                description: Group is the group of the referent.
-                                maxLength: 253
-                                minLength: 1
-                                type: string
-                              kind:
-                                description: Kind is kind of the referent.
-                                maxLength: 253
-                                minLength: 1
-                                type: string
-                              name:
-                                description: Name is the name of the referent.
-                                maxLength: 253
-                                minLength: 1
-                                type: string
-                            required:
-                            - group
-                            - kind
-                            - name
-                            type: object
-                          port:
-                            description: "Port specifies the destination port number to use for the backend referenced by the ServiceName or BackendRef field. If unspecified, the destination port in the request is used when forwarding to a backendRef or serviceName. \n Support: Core"
-                            format: int32
-                            maximum: 65535
-                            minimum: 1
-                            type: integer
-                          serviceName:
-                            description: "ServiceName refers to the name of the Service to forward matched requests to. When specified, this takes the place of BackendRef. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. \n If the referent cannot be found, the rule is not included in the route. The controller should raise the \"ResolvedRefs\" condition on the Gateway with the \"DegradedRoutes\" reason. The gateway status for this route should be updated with a condition that describes the error more specifically. \n The protocol to use is defined using AppProtocol field (introduced in Kubernetes 1.18) in the Service resource. In the absence of the AppProtocol field a `networking.x-k8s.io/app-protocol` annotation on the BackendPolicy resource may be used to define the protocol. If the AppProtocol field is available, this annotation should not be used. The AppProtocol field, when populated, takes precedence over the annotation in the BackendPolicy resource. For custom backends, it is encouraged to add a semantically-equivalent field in the Custom Resource Definition. \n Support: Core"
-                            maxLength: 253
-                            type: string
-                          weight:
-                            default: 1
-                            description: "Weight specifies the proportion of HTTP requests forwarded to the backend referenced by the ServiceName or BackendRef field. This is computed as weight/(sum of all weights in this ForwardTo list). For non-zero values, there may be some epsilon from the exact proportion defined here depending on the precision an implementation supports. Weight is not a percentage and the sum of weights does not need to equal 100. \n If only one backend is specified and it has a weight greater than 0, 100% of the traffic is forwarded to that backend. If weight is set to 0, no traffic should be forwarded for this entry. If unspecified, weight defaults to 1. \n Support: Extended"
-                            format: int32
-                            maximum: 1000000
-                            minimum: 0
-                            type: integer
-                        type: object
-                      maxItems: 16
-                      minItems: 1
-                      type: array
-                    matches:
-                      description: Matches define conditions used for matching the rule against incoming TCP connections. Each match is independent, i.e. this rule will be matched if **any** one of the matches is satisfied. If unspecified, all requests from the associated gateway TCP listener will match.
-                      items:
-                        description: TCPRouteMatch defines the predicate used to match connections to a given action.
-                        properties:
-                          extensionRef:
-                            description: "ExtensionRef is an optional, implementation-specific extension to the \"match\" behavior.  For example, resource \"mytcproutematcher\" in group \"networking.acme.io\". If the referent cannot be found, the rule is not included in the route. The controller should raise the \"ResolvedRefs\" condition on the Gateway with the \"DegradedRoutes\" reason. The gateway status for this route should be updated with a condition that describes the error more specifically. \n Support: Custom"
-                            properties:
-                              group:
-                                description: Group is the group of the referent.
-                                maxLength: 253
-                                minLength: 1
-                                type: string
-                              kind:
-                                description: Kind is kind of the referent.
-                                maxLength: 253
-                                minLength: 1
-                                type: string
-                              name:
-                                description: Name is the name of the referent.
-                                maxLength: 253
-                                minLength: 1
-                                type: string
-                            required:
-                            - group
-                            - kind
-                            - name
-                            type: object
-                        type: object
-                      maxItems: 8
-                      type: array
-                  required:
-                  - forwardTo
-                  type: object
-                maxItems: 16
-                minItems: 1
-                type: array
-            required:
-            - rules
-            type: object
-          status:
-            description: Status defines the current state of TCPRoute.
-            properties:
-              gateways:
-                description: "Gateways is a list of Gateways that are associated with the route, and the status of the route with respect to each Gateway. When a Gateway selects this route, the controller that manages the Gateway must add an entry to this list when the controller first sees the route and should update the entry as appropriate when the route is modified. \n A maximum of 100 Gateways will be represented in this list. If this list is full, there may be additional Gateways using this Route that are not included in the list. An empty list means the route has not been admitted by any Gateway."
-                items:
-                  description: RouteGatewayStatus describes the status of a route with respect to an associated Gateway.
-                  properties:
-                    conditions:
-                      description: Conditions describes the status of the route with respect to the Gateway. The "Admitted" condition must always be specified by controllers to indicate whether the route has been admitted or rejected by the Gateway, and why. Note that the route's availability is also subject to the Gateway's own status conditions and listener status.
-                      items:
-                        description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions.  For example, type FooStatus struct{     // Represents the observations of a foo's current state.     // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\"     // +patchMergeKey=type     // +patchStrategy=merge     // +listType=map     // +listMapKey=type     Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n     // other fields }"
-                        properties:
-                          lastTransitionTime:
-                            description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                            format: date-time
-                            type: string
-                          message:
-                            description: message is a human readable message indicating details about the transition. This may be an empty string.
-                            maxLength: 32768
-                            type: string
-                          observedGeneration:
-                            description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
-                            format: int64
-                            minimum: 0
-                            type: integer
-                          reason:
-                            description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
-                            maxLength: 1024
-                            minLength: 1
-                            pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                            type: string
-                          status:
-                            description: status of the condition, one of True, False, Unknown.
-                            enum:
-                            - "True"
-                            - "False"
-                            - Unknown
-                            type: string
-                          type:
-                            description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
-                            maxLength: 316
-                            pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                            type: string
-                        required:
-                        - lastTransitionTime
-                        - message
-                        - reason
-                        - status
-                        - type
-                        type: object
-                      maxItems: 8
-                      type: array
-                      x-kubernetes-list-map-keys:
-                      - type
-                      x-kubernetes-list-type: map
-                    gatewayRef:
-                      description: GatewayRef is a reference to a Gateway object that is associated with the route.
-                      properties:
-                        name:
-                          description: Name is the name of the referent.
-                          maxLength: 253
-                          minLength: 1
-                          type: string
-                        namespace:
-                          description: Namespace is the namespace of the referent.
-                          maxLength: 253
-                          minLength: 1
-                          type: string
-                      required:
-                      - name
-                      - namespace
-                      type: object
-                  required:
-                  - gatewayRef
-                  type: object
-                maxItems: 100
-                type: array
-            required:
-            - gateways
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

docs/content/reference/dynamic-configuration/networking.x-k8s.io_tlsroutes.yaml

@@ -1,263 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.4.1
-  creationTimestamp: null
-  name: tlsroutes.networking.x-k8s.io
-spec:
-  group: networking.x-k8s.io
-  names:
-    kind: TLSRoute
-    listKind: TLSRouteList
-    plural: tlsroutes
-    singular: tlsroute
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: "The TLSRoute resource is similar to TCPRoute, but can be configured to match against TLS-specific metadata. This allows more flexibility in matching streams for a given TLS listener. \n If you need to forward traffic to a single target for a TLS listener, you could choose to use a TCPRoute with a TLS listener."
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: Spec defines the desired state of TLSRoute.
-            properties:
-              gateways:
-                default:
-                  allow: SameNamespace
-                description: Gateways defines which Gateways can use this Route.
-                properties:
-                  allow:
-                    default: SameNamespace
-                    description: 'Allow indicates which Gateways will be allowed to use this route. Possible values are: * All: Gateways in any namespace can use this route. * FromList: Only Gateways specified in GatewayRefs may use this route. * SameNamespace: Only Gateways in the same namespace may use this route.'
-                    enum:
-                    - All
-                    - FromList
-                    - SameNamespace
-                    type: string
-                  gatewayRefs:
-                    description: GatewayRefs must be specified when Allow is set to "FromList". In that case, only Gateways referenced in this list will be allowed to use this route. This field is ignored for other values of "Allow".
-                    items:
-                      description: GatewayReference identifies a Gateway in a specified namespace.
-                      properties:
-                        name:
-                          description: Name is the name of the referent.
-                          maxLength: 253
-                          minLength: 1
-                          type: string
-                        namespace:
-                          description: Namespace is the namespace of the referent.
-                          maxLength: 253
-                          minLength: 1
-                          type: string
-                      required:
-                      - name
-                      - namespace
-                      type: object
-                    type: array
-                type: object
-              rules:
-                description: Rules are a list of TLS matchers and actions.
-                items:
-                  description: TLSRouteRule is the configuration for a given rule.
-                  properties:
-                    forwardTo:
-                      description: ForwardTo defines the backend(s) where matching requests should be sent.
-                      items:
-                        description: RouteForwardTo defines how a Route should forward a request.
-                        properties:
-                          backendRef:
-                            description: "BackendRef is a reference to a backend to forward matched requests to. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. \n If the referent cannot be found, the rule is not included in the route. The controller should raise the \"ResolvedRefs\" condition on the Gateway with the \"DegradedRoutes\" reason. The gateway status for this route should be updated with a condition that describes the error more specifically. \n Support: Custom"
-                            properties:
-                              group:
-                                description: Group is the group of the referent.
-                                maxLength: 253
-                                minLength: 1
-                                type: string
-                              kind:
-                                description: Kind is kind of the referent.
-                                maxLength: 253
-                                minLength: 1
-                                type: string
-                              name:
-                                description: Name is the name of the referent.
-                                maxLength: 253
-                                minLength: 1
-                                type: string
-                            required:
-                            - group
-                            - kind
-                            - name
-                            type: object
-                          port:
-                            description: "Port specifies the destination port number to use for the backend referenced by the ServiceName or BackendRef field. If unspecified, the destination port in the request is used when forwarding to a backendRef or serviceName. \n Support: Core"
-                            format: int32
-                            maximum: 65535
-                            minimum: 1
-                            type: integer
-                          serviceName:
-                            description: "ServiceName refers to the name of the Service to forward matched requests to. When specified, this takes the place of BackendRef. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. \n If the referent cannot be found, the rule is not included in the route. The controller should raise the \"ResolvedRefs\" condition on the Gateway with the \"DegradedRoutes\" reason. The gateway status for this route should be updated with a condition that describes the error more specifically. \n The protocol to use is defined using AppProtocol field (introduced in Kubernetes 1.18) in the Service resource. In the absence of the AppProtocol field a `networking.x-k8s.io/app-protocol` annotation on the BackendPolicy resource may be used to define the protocol. If the AppProtocol field is available, this annotation should not be used. The AppProtocol field, when populated, takes precedence over the annotation in the BackendPolicy resource. For custom backends, it is encouraged to add a semantically-equivalent field in the Custom Resource Definition. \n Support: Core"
-                            maxLength: 253
-                            type: string
-                          weight:
-                            default: 1
-                            description: "Weight specifies the proportion of HTTP requests forwarded to the backend referenced by the ServiceName or BackendRef field. This is computed as weight/(sum of all weights in this ForwardTo list). For non-zero values, there may be some epsilon from the exact proportion defined here depending on the precision an implementation supports. Weight is not a percentage and the sum of weights does not need to equal 100. \n If only one backend is specified and it has a weight greater than 0, 100% of the traffic is forwarded to that backend. If weight is set to 0, no traffic should be forwarded for this entry. If unspecified, weight defaults to 1. \n Support: Extended"
-                            format: int32
-                            maximum: 1000000
-                            minimum: 0
-                            type: integer
-                        type: object
-                      maxItems: 16
-                      minItems: 1
-                      type: array
-                    matches:
-                      description: Matches define conditions used for matching the rule against an incoming TLS handshake. Each match is independent, i.e. this rule will be matched if **any** one of the matches is satisfied. If unspecified, all requests from the associated gateway TLS listener will match.
-                      items:
-                        description: TLSRouteMatch defines the predicate used to match connections to a given action.
-                        properties:
-                          extensionRef:
-                            description: "ExtensionRef is an optional, implementation-specific extension to the \"match\" behavior.  For example, resource \"mytlsroutematcher\" in group \"networking.acme.io\". If the referent cannot be found, the rule is not included in the route. The controller should raise the \"ResolvedRefs\" condition on the Gateway with the \"DegradedRoutes\" reason. The gateway status for this route should be updated with a condition that describes the error more specifically. \n Support: Custom"
-                            properties:
-                              group:
-                                description: Group is the group of the referent.
-                                maxLength: 253
-                                minLength: 1
-                                type: string
-                              kind:
-                                description: Kind is kind of the referent.
-                                maxLength: 253
-                                minLength: 1
-                                type: string
-                              name:
-                                description: Name is the name of the referent.
-                                maxLength: 253
-                                minLength: 1
-                                type: string
-                            required:
-                            - group
-                            - kind
-                            - name
-                            type: object
-                          snis:
-                            description: "SNIs defines a set of SNI names that should match against the SNI attribute of TLS ClientHello message in TLS handshake. \n SNI can be \"precise\" which is a domain name without the terminating dot of a network host (e.g. \"foo.example.com\") or \"wildcard\", which is a domain name prefixed with a single wildcard label (e.g. `*.example.com`). The wildcard character `*` must appear by itself as the first DNS label and matches only a single label. You cannot have a wildcard label by itself (e.g. Host == `*`). \n Requests will be matched against the Host field in the following order: \n 1. If SNI is precise, the request matches this rule if the SNI in    ClientHello is equal to one of the defined SNIs. 2. If SNI is a wildcard, then the request matches this rule if the    SNI is to equal to the suffix (removing the first label) of the    wildcard rule. 3. If SNIs is unspecified, all requests associated with the gateway TLS    listener will match. This can be used to define a default backend    for a TLS listener. \n Support: Core"
-                            items:
-                              description: Hostname is used to specify a hostname that should be matched.
-                              maxLength: 253
-                              minLength: 1
-                              type: string
-                            maxItems: 16
-                            type: array
-                        type: object
-                      maxItems: 8
-                      type: array
-                  required:
-                  - forwardTo
-                  type: object
-                maxItems: 16
-                minItems: 1
-                type: array
-            required:
-            - rules
-            type: object
-          status:
-            description: Status defines the current state of TLSRoute.
-            properties:
-              gateways:
-                description: "Gateways is a list of Gateways that are associated with the route, and the status of the route with respect to each Gateway. When a Gateway selects this route, the controller that manages the Gateway must add an entry to this list when the controller first sees the route and should update the entry as appropriate when the route is modified. \n A maximum of 100 Gateways will be represented in this list. If this list is full, there may be additional Gateways using this Route that are not included in the list. An empty list means the route has not been admitted by any Gateway."
-                items:
-                  description: RouteGatewayStatus describes the status of a route with respect to an associated Gateway.
-                  properties:
-                    conditions:
-                      description: Conditions describes the status of the route with respect to the Gateway. The "Admitted" condition must always be specified by controllers to indicate whether the route has been admitted or rejected by the Gateway, and why. Note that the route's availability is also subject to the Gateway's own status conditions and listener status.
-                      items:
-                        description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions.  For example, type FooStatus struct{     // Represents the observations of a foo's current state.     // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\"     // +patchMergeKey=type     // +patchStrategy=merge     // +listType=map     // +listMapKey=type     Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n     // other fields }"
-                        properties:
-                          lastTransitionTime:
-                            description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-                            format: date-time
-                            type: string
-                          message:
-                            description: message is a human readable message indicating details about the transition. This may be an empty string.
-                            maxLength: 32768
-                            type: string
-                          observedGeneration:
-                            description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
-                            format: int64
-                            minimum: 0
-                            type: integer
-                          reason:
-                            description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
-                            maxLength: 1024
-                            minLength: 1
-                            pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
-                            type: string
-                          status:
-                            description: status of the condition, one of True, False, Unknown.
-                            enum:
-                            - "True"
-                            - "False"
-                            - Unknown
-                            type: string
-                          type:
-                            description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
-                            maxLength: 316
-                            pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
-                            type: string
-                        required:
-                        - lastTransitionTime
-                        - message
-                        - reason
-                        - status
-                        - type
-                        type: object
-                      maxItems: 8
-                      type: array
-                      x-kubernetes-list-map-keys:
-                      - type
-                      x-kubernetes-list-type: map
-                    gatewayRef:
-                      description: GatewayRef is a reference to a Gateway object that is associated with the route.
-                      properties:
-                        name:
-                          description: Name is the name of the referent.
-                          maxLength: 253
-                          minLength: 1
-                          type: string
-                        namespace:
-                          description: Namespace is the namespace of the referent.
-                          maxLength: 253
-                          minLength: 1
-                          type: string
-                      required:
-                      - name
-                      - namespace
-                      type: object
-                  required:
-                  - gatewayRef
-                  type: object
-                maxItems: 100
-                type: array
-            required:
-            - gateways
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_ingressroutes.yaml

@@ -1,198 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.4.1
-  creationTimestamp: null
-  name: ingressroutes.traefik.containo.us
-spec:
-  group: traefik.containo.us
-  names:
-    kind: IngressRoute
-    listKind: IngressRouteList
-    plural: ingressroutes
-    singular: ingressroute
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: IngressRoute is an Ingress CRD specification.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: IngressRouteSpec is a specification for a IngressRouteSpec
-              resource.
-            properties:
-              entryPoints:
-                items:
-                  type: string
-                type: array
-              routes:
-                items:
-                  description: Route contains the set of routes.
-                  properties:
-                    kind:
-                      enum:
-                      - Rule
-                      type: string
-                    match:
-                      type: string
-                    middlewares:
-                      items:
-                        description: MiddlewareRef is a ref to the Middleware resources.
-                        properties:
-                          name:
-                            type: string
-                          namespace:
-                            type: string
-                        required:
-                        - name
-                        type: object
-                      type: array
-                    priority:
-                      type: integer
-                    services:
-                      items:
-                        description: Service defines an upstream to proxy traffic.
-                        properties:
-                          kind:
-                            enum:
-                            - Service
-                            - TraefikService
-                            type: string
-                          name:
-                            description: Name is a reference to a Kubernetes Service
-                              object (for a load-balancer of servers), or to a TraefikService
-                              object (service load-balancer, mirroring, etc). The
-                              differentiation between the two is specified in the
-                              Kind field.
-                            type: string
-                          namespace:
-                            type: string
-                          passHostHeader:
-                            type: boolean
-                          port:
-                            anyOf:
-                            - type: integer
-                            - type: string
-                            x-kubernetes-int-or-string: true
-                          responseForwarding:
-                            description: ResponseForwarding holds configuration for
-                              the forward of the response.
-                            properties:
-                              flushInterval:
-                                type: string
-                            type: object
-                          scheme:
-                            type: string
-                          serversTransport:
-                            type: string
-                          sticky:
-                            description: Sticky holds the sticky configuration.
-                            properties:
-                              cookie:
-                                description: Cookie holds the sticky configuration
-                                  based on cookie.
-                                properties:
-                                  httpOnly:
-                                    type: boolean
-                                  name:
-                                    type: string
-                                  sameSite:
-                                    type: string
-                                  secure:
-                                    type: boolean
-                                type: object
-                            type: object
-                          strategy:
-                            type: string
-                          weight:
-                            description: Weight should only be specified when Name
-                              references a TraefikService object (and to be precise,
-                              one that embeds a Weighted Round Robin).
-                            type: integer
-                        required:
-                        - name
-                        type: object
-                      type: array
-                  required:
-                  - kind
-                  - match
-                  type: object
-                type: array
-              tls:
-                description: "TLS contains the TLS certificates configuration of the
-                  routes. To enable Let's Encrypt, use an empty TLS struct, e.g. in
-                  YAML: \n \t tls: {} # inline format \n \t tls: \t   secretName:
-                  # block format"
-                properties:
-                  certResolver:
-                    type: string
-                  domains:
-                    items:
-                      description: Domain holds a domain name with SANs.
-                      properties:
-                        main:
-                          type: string
-                        sans:
-                          items:
-                            type: string
-                          type: array
-                      type: object
-                    type: array
-                  options:
-                    description: Options is a reference to a TLSOption, that specifies
-                      the parameters of the TLS connection.
-                    properties:
-                      name:
-                        type: string
-                      namespace:
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  secretName:
-                    description: SecretName is the name of the referenced Kubernetes
-                      Secret to specify the certificate details.
-                    type: string
-                  store:
-                    description: Store is a reference to a TLSStore, that specifies
-                      the parameters of the TLS store.
-                    properties:
-                      name:
-                        type: string
-                      namespace:
-                        type: string
-                    required:
-                    - name
-                    type: object
-                type: object
-            required:
-            - routes
-            type: object
-        required:
-        - metadata
-        - spec
-        type: object
-    served: true
-    storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_ingressroutetcps.yaml

@@ -1,160 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.4.1
-  creationTimestamp: null
-  name: ingressroutetcps.traefik.containo.us
-spec:
-  group: traefik.containo.us
-  names:
-    kind: IngressRouteTCP
-    listKind: IngressRouteTCPList
-    plural: ingressroutetcps
-    singular: ingressroutetcp
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: IngressRouteTCP is an Ingress CRD specification.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: IngressRouteTCPSpec is a specification for a IngressRouteTCPSpec
-              resource.
-            properties:
-              entryPoints:
-                items:
-                  type: string
-                type: array
-              routes:
-                items:
-                  description: RouteTCP contains the set of routes.
-                  properties:
-                    match:
-                      type: string
-                    middlewares:
-                      description: Middlewares contains references to MiddlewareTCP
-                        resources.
-                      items:
-                        description: ObjectReference is a generic reference to a Traefik
-                          resource.
-                        properties:
-                          name:
-                            type: string
-                          namespace:
-                            type: string
-                        required:
-                        - name
-                        type: object
-                      type: array
-                    services:
-                      items:
-                        description: ServiceTCP defines an upstream to proxy traffic.
-                        properties:
-                          name:
-                            type: string
-                          namespace:
-                            type: string
-                          port:
-                            anyOf:
-                            - type: integer
-                            - type: string
-                            x-kubernetes-int-or-string: true
-                          proxyProtocol:
-                            description: ProxyProtocol holds the ProxyProtocol configuration.
-                            properties:
-                              version:
-                                type: integer
-                            type: object
-                          terminationDelay:
-                            type: integer
-                          weight:
-                            type: integer
-                        required:
-                        - name
-                        - port
-                        type: object
-                      type: array
-                  required:
-                  - match
-                  type: object
-                type: array
-              tls:
-                description: "TLSTCP contains the TLS certificates configuration of
-                  the routes. To enable Let's Encrypt, use an empty TLS struct, e.g.
-                  in YAML: \n \t tls: {} # inline format \n \t tls: \t   secretName:
-                  # block format"
-                properties:
-                  certResolver:
-                    type: string
-                  domains:
-                    items:
-                      description: Domain holds a domain name with SANs.
-                      properties:
-                        main:
-                          type: string
-                        sans:
-                          items:
-                            type: string
-                          type: array
-                      type: object
-                    type: array
-                  options:
-                    description: Options is a reference to a TLSOption, that specifies
-                      the parameters of the TLS connection.
-                    properties:
-                      name:
-                        type: string
-                      namespace:
-                        type: string
-                    required:
-                    - name
-                    type: object
-                  passthrough:
-                    type: boolean
-                  secretName:
-                    description: SecretName is the name of the referenced Kubernetes
-                      Secret to specify the certificate details.
-                    type: string
-                  store:
-                    description: Store is a reference to a TLSStore, that specifies
-                      the parameters of the TLS store.
-                    properties:
-                      name:
-                        type: string
-                      namespace:
-                        type: string
-                    required:
-                    - name
-                    type: object
-                type: object
-            required:
-            - routes
-            type: object
-        required:
-        - metadata
-        - spec
-        type: object
-    served: true
-    storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_ingressrouteudps.yaml

@@ -1,84 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.4.1
-  creationTimestamp: null
-  name: ingressrouteudps.traefik.containo.us
-spec:
-  group: traefik.containo.us
-  names:
-    kind: IngressRouteUDP
-    listKind: IngressRouteUDPList
-    plural: ingressrouteudps
-    singular: ingressrouteudp
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: IngressRouteUDP is an Ingress CRD specification.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: IngressRouteUDPSpec is a specification for a IngressRouteUDPSpec
-              resource.
-            properties:
-              entryPoints:
-                items:
-                  type: string
-                type: array
-              routes:
-                items:
-                  description: RouteUDP contains the set of routes.
-                  properties:
-                    services:
-                      items:
-                        description: ServiceUDP defines an upstream to proxy traffic.
-                        properties:
-                          name:
-                            type: string
-                          namespace:
-                            type: string
-                          port:
-                            anyOf:
-                            - type: integer
-                            - type: string
-                            x-kubernetes-int-or-string: true
-                          weight:
-                            type: integer
-                        required:
-                        - name
-                        - port
-                        type: object
-                      type: array
-                  type: object
-                type: array
-            required:
-            - routes
-            type: object
-        required:
-        - metadata
-        - spec
-        type: object
-    served: true
-    storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_middlewares.yaml

@@ -1,563 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.4.1
-  creationTimestamp: null
-  name: middlewares.traefik.containo.us
-spec:
-  group: traefik.containo.us
-  names:
-    kind: Middleware
-    listKind: MiddlewareList
-    plural: middlewares
-    singular: middleware
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: Middleware is a specification for a Middleware resource.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: MiddlewareSpec holds the Middleware configuration.
-            properties:
-              addPrefix:
-                description: AddPrefix holds the AddPrefix configuration.
-                properties:
-                  prefix:
-                    type: string
-                type: object
-              basicAuth:
-                description: BasicAuth holds the HTTP basic authentication configuration.
-                properties:
-                  headerField:
-                    type: string
-                  realm:
-                    type: string
-                  removeHeader:
-                    type: boolean
-                  secret:
-                    type: string
-                type: object
-              buffering:
-                description: Buffering holds the request/response buffering configuration.
-                properties:
-                  maxRequestBodyBytes:
-                    format: int64
-                    type: integer
-                  maxResponseBodyBytes:
-                    format: int64
-                    type: integer
-                  memRequestBodyBytes:
-                    format: int64
-                    type: integer
-                  memResponseBodyBytes:
-                    format: int64
-                    type: integer
-                  retryExpression:
-                    type: string
-                type: object
-              chain:
-                description: Chain holds a chain of middlewares.
-                properties:
-                  middlewares:
-                    items:
-                      description: MiddlewareRef is a ref to the Middleware resources.
-                      properties:
-                        name:
-                          type: string
-                        namespace:
-                          type: string
-                      required:
-                      - name
-                      type: object
-                    type: array
-                type: object
-              circuitBreaker:
-                description: CircuitBreaker holds the circuit breaker configuration.
-                properties:
-                  expression:
-                    type: string
-                type: object
-              compress:
-                description: Compress holds the compress configuration.
-                properties:
-                  excludedContentTypes:
-                    items:
-                      type: string
-                    type: array
-                type: object
-              contentType:
-                description: ContentType middleware - or rather its unique `autoDetect`
-                  option - specifies whether to let the `Content-Type` header, if
-                  it has not been set by the backend, be automatically set to a value
-                  derived from the contents of the response. As a proxy, the default
-                  behavior should be to leave the header alone, regardless of what
-                  the backend did with it. However, the historic default was to always
-                  auto-detect and set the header if it was nil, and it is going to
-                  be kept that way in order to support users currently relying on
-                  it. This middleware exists to enable the correct behavior until
-                  at least the default one can be changed in a future version.
-                properties:
-                  autoDetect:
-                    type: boolean
-                type: object
-              digestAuth:
-                description: DigestAuth holds the Digest HTTP authentication configuration.
-                properties:
-                  headerField:
-                    type: string
-                  realm:
-                    type: string
-                  removeHeader:
-                    type: boolean
-                  secret:
-                    type: string
-                type: object
-              errors:
-                description: ErrorPage holds the custom error page configuration.
-                properties:
-                  query:
-                    type: string
-                  service:
-                    description: Service defines an upstream to proxy traffic.
-                    properties:
-                      kind:
-                        enum:
-                        - Service
-                        - TraefikService
-                        type: string
-                      name:
-                        description: Name is a reference to a Kubernetes Service object
-                          (for a load-balancer of servers), or to a TraefikService
-                          object (service load-balancer, mirroring, etc). The differentiation
-                          between the two is specified in the Kind field.
-                        type: string
-                      namespace:
-                        type: string
-                      passHostHeader:
-                        type: boolean
-                      port:
-                        anyOf:
-                        - type: integer
-                        - type: string
-                        x-kubernetes-int-or-string: true
-                      responseForwarding:
-                        description: ResponseForwarding holds configuration for the
-                          forward of the response.
-                        properties:
-                          flushInterval:
-                            type: string
-                        type: object
-                      scheme:
-                        type: string
-                      serversTransport:
-                        type: string
-                      sticky:
-                        description: Sticky holds the sticky configuration.
-                        properties:
-                          cookie:
-                            description: Cookie holds the sticky configuration based
-                              on cookie.
-                            properties:
-                              httpOnly:
-                                type: boolean
-                              name:
-                                type: string
-                              sameSite:
-                                type: string
-                              secure:
-                                type: boolean
-                            type: object
-                        type: object
-                      strategy:
-                        type: string
-                      weight:
-                        description: Weight should only be specified when Name references
-                          a TraefikService object (and to be precise, one that embeds
-                          a Weighted Round Robin).
-                        type: integer
-                    required:
-                    - name
-                    type: object
-                  status:
-                    items:
-                      type: string
-                    type: array
-                type: object
-              forwardAuth:
-                description: ForwardAuth holds the http forward authentication configuration.
-                properties:
-                  address:
-                    type: string
-                  authRequestHeaders:
-                    items:
-                      type: string
-                    type: array
-                  authResponseHeaders:
-                    items:
-                      type: string
-                    type: array
-                  authResponseHeadersRegex:
-                    type: string
-                  tls:
-                    description: ClientTLS holds TLS specific configurations as client.
-                    properties:
-                      caOptional:
-                        type: boolean
-                      caSecret:
-                        type: string
-                      certSecret:
-                        type: string
-                      insecureSkipVerify:
-                        type: boolean
-                    type: object
-                  trustForwardHeader:
-                    type: boolean
-                type: object
-              headers:
-                description: Headers holds the custom header configuration.
-                properties:
-                  accessControlAllowCredentials:
-                    description: AccessControlAllowCredentials is only valid if true.
-                      false is ignored.
-                    type: boolean
-                  accessControlAllowHeaders:
-                    description: AccessControlAllowHeaders must be used in response
-                      to a preflight request with Access-Control-Request-Headers set.
-                    items:
-                      type: string
-                    type: array
-                  accessControlAllowMethods:
-                    description: AccessControlAllowMethods must be used in response
-                      to a preflight request with Access-Control-Request-Method set.
-                    items:
-                      type: string
-                    type: array
-                  accessControlAllowOriginList:
-                    description: AccessControlAllowOriginList is a list of allowable
-                      origins. Can also be a wildcard origin "*".
-                    items:
-                      type: string
-                    type: array
-                  accessControlAllowOriginListRegex:
-                    description: AccessControlAllowOriginListRegex is a list of allowable
-                      origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
-                    items:
-                      type: string
-                    type: array
-                  accessControlExposeHeaders:
-                    description: AccessControlExposeHeaders sets valid headers for
-                      the response.
-                    items:
-                      type: string
-                    type: array
-                  accessControlMaxAge:
-                    description: AccessControlMaxAge sets the time that a preflight
-                      request may be cached.
-                    format: int64
-                    type: integer
-                  addVaryHeader:
-                    description: AddVaryHeader controls if the Vary header is automatically
-                      added/updated when the AccessControlAllowOriginList is set.
-                    type: boolean
-                  allowedHosts:
-                    items:
-                      type: string
-                    type: array
-                  browserXssFilter:
-                    type: boolean
-                  contentSecurityPolicy:
-                    type: string
-                  contentTypeNosniff:
-                    type: boolean
-                  customBrowserXSSValue:
-                    type: string
-                  customFrameOptionsValue:
-                    type: string
-                  customRequestHeaders:
-                    additionalProperties:
-                      type: string
-                    type: object
-                  customResponseHeaders:
-                    additionalProperties:
-                      type: string
-                    type: object
-                  featurePolicy:
-                    type: string
-                  forceSTSHeader:
-                    type: boolean
-                  frameDeny:
-                    type: boolean
-                  hostsProxyHeaders:
-                    items:
-                      type: string
-                    type: array
-                  isDevelopment:
-                    type: boolean
-                  publicKey:
-                    type: string
-                  referrerPolicy:
-                    type: string
-                  sslForceHost:
-                    description: 'Deprecated: use RedirectRegex instead.'
-                    type: boolean
-                  sslHost:
-                    description: 'Deprecated: use RedirectRegex instead.'
-                    type: string
-                  sslProxyHeaders:
-                    additionalProperties:
-                      type: string
-                    type: object
-                  sslRedirect:
-                    description: 'Deprecated: use EntryPoint redirection or RedirectScheme
-                      instead.'
-                    type: boolean
-                  sslTemporaryRedirect:
-                    description: 'Deprecated: use EntryPoint redirection or RedirectScheme
-                      instead.'
-                    type: boolean
-                  stsIncludeSubdomains:
-                    type: boolean
-                  stsPreload:
-                    type: boolean
-                  stsSeconds:
-                    format: int64
-                    type: integer
-                type: object
-              inFlightReq:
-                description: InFlightReq limits the number of requests being processed
-                  and served concurrently.
-                properties:
-                  amount:
-                    format: int64
-                    type: integer
-                  sourceCriterion:
-                    description: SourceCriterion defines what criterion is used to
-                      group requests as originating from a common source. If none
-                      are set, the default is to use the request's remote address
-                      field. All fields are mutually exclusive.
-                    properties:
-                      ipStrategy:
-                        description: IPStrategy holds the ip strategy configuration.
-                        properties:
-                          depth:
-                            type: integer
-                          excludedIPs:
-                            items:
-                              type: string
-                            type: array
-                        type: object
-                      requestHeaderName:
-                        type: string
-                      requestHost:
-                        type: boolean
-                    type: object
-                type: object
-              ipWhiteList:
-                description: IPWhiteList holds the ip white list configuration.
-                properties:
-                  ipStrategy:
-                    description: IPStrategy holds the ip strategy configuration.
-                    properties:
-                      depth:
-                        type: integer
-                      excludedIPs:
-                        items:
-                          type: string
-                        type: array
-                    type: object
-                  sourceRange:
-                    items:
-                      type: string
-                    type: array
-                type: object
-              passTLSClientCert:
-                description: PassTLSClientCert holds the TLS client cert headers configuration.
-                properties:
-                  info:
-                    description: TLSClientCertificateInfo holds the client TLS certificate
-                      info configuration.
-                    properties:
-                      issuer:
-                        description: TLSCLientCertificateDNInfo holds the client TLS
-                          certificate distinguished name info configuration. cf https://tools.ietf.org/html/rfc3739
-                        properties:
-                          commonName:
-                            type: boolean
-                          country:
-                            type: boolean
-                          domainComponent:
-                            type: boolean
-                          locality:
-                            type: boolean
-                          organization:
-                            type: boolean
-                          province:
-                            type: boolean
-                          serialNumber:
-                            type: boolean
-                        type: object
-                      notAfter:
-                        type: boolean
-                      notBefore:
-                        type: boolean
-                      sans:
-                        type: boolean
-                      serialNumber:
-                        type: boolean
-                      subject:
-                        description: TLSCLientCertificateDNInfo holds the client TLS
-                          certificate distinguished name info configuration. cf https://tools.ietf.org/html/rfc3739
-                        properties:
-                          commonName:
-                            type: boolean
-                          country:
-                            type: boolean
-                          domainComponent:
-                            type: boolean
-                          locality:
-                            type: boolean
-                          organization:
-                            type: boolean
-                          province:
-                            type: boolean
-                          serialNumber:
-                            type: boolean
-                        type: object
-                    type: object
-                  pem:
-                    type: boolean
-                type: object
-              plugin:
-                additionalProperties:
-                  x-kubernetes-preserve-unknown-fields: true
-                type: object
-              rateLimit:
-                description: RateLimit holds the rate limiting configuration for a
-                  given router.
-                properties:
-                  average:
-                    format: int64
-                    type: integer
-                  burst:
-                    format: int64
-                    type: integer
-                  period:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    x-kubernetes-int-or-string: true
-                  sourceCriterion:
-                    description: SourceCriterion defines what criterion is used to
-                      group requests as originating from a common source. If none
-                      are set, the default is to use the request's remote address
-                      field. All fields are mutually exclusive.
-                    properties:
-                      ipStrategy:
-                        description: IPStrategy holds the ip strategy configuration.
-                        properties:
-                          depth:
-                            type: integer
-                          excludedIPs:
-                            items:
-                              type: string
-                            type: array
-                        type: object
-                      requestHeaderName:
-                        type: string
-                      requestHost:
-                        type: boolean
-                    type: object
-                type: object
-              redirectRegex:
-                description: RedirectRegex holds the redirection configuration.
-                properties:
-                  permanent:
-                    type: boolean
-                  regex:
-                    type: string
-                  replacement:
-                    type: string
-                type: object
-              redirectScheme:
-                description: RedirectScheme holds the scheme redirection configuration.
-                properties:
-                  permanent:
-                    type: boolean
-                  port:
-                    type: string
-                  scheme:
-                    type: string
-                type: object
-              replacePath:
-                description: ReplacePath holds the ReplacePath configuration.
-                properties:
-                  path:
-                    type: string
-                type: object
-              replacePathRegex:
-                description: ReplacePathRegex holds the ReplacePathRegex configuration.
-                properties:
-                  regex:
-                    type: string
-                  replacement:
-                    type: string
-                type: object
-              retry:
-                description: Retry holds the retry configuration.
-                properties:
-                  attempts:
-                    type: integer
-                  initialInterval:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    x-kubernetes-int-or-string: true
-                type: object
-              stripPrefix:
-                description: StripPrefix holds the StripPrefix configuration.
-                properties:
-                  forceSlash:
-                    type: boolean
-                  prefixes:
-                    items:
-                      type: string
-                    type: array
-                type: object
-              stripPrefixRegex:
-                description: StripPrefixRegex holds the StripPrefixRegex configuration.
-                properties:
-                  regex:
-                    items:
-                      type: string
-                    type: array
-                type: object
-            type: object
-        required:
-        - metadata
-        - spec
-        type: object
-    served: true
-    storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_middlewaretcps.yaml

@@ -1,59 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.4.1
-  creationTimestamp: null
-  name: middlewaretcps.traefik.containo.us
-spec:
-  group: traefik.containo.us
-  names:
-    kind: MiddlewareTCP
-    listKind: MiddlewareTCPList
-    plural: middlewaretcps
-    singular: middlewaretcp
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: MiddlewareTCP is a specification for a MiddlewareTCP resource.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: MiddlewareTCPSpec holds the MiddlewareTCP configuration.
-            properties:
-              ipWhiteList:
-                description: TCPIPWhiteList holds the TCP ip white list configuration.
-                properties:
-                  sourceRange:
-                    items:
-                      type: string
-                    type: array
-                type: object
-            type: object
-        required:
-        - metadata
-        - spec
-        type: object
-    served: true
-    storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_serverstransports.yaml

@@ -1,101 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.4.1
-  creationTimestamp: null
-  name: serverstransports.traefik.containo.us
-spec:
-  group: traefik.containo.us
-  names:
-    kind: ServersTransport
-    listKind: ServersTransportList
-    plural: serverstransports
-    singular: serverstransport
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: ServersTransport is a specification for a ServersTransport resource.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: ServersTransportSpec options to configure communication between
-              Traefik and the servers.
-            properties:
-              certificatesSecrets:
-                description: Certificates for mTLS.
-                items:
-                  type: string
-                type: array
-              disableHTTP2:
-                description: Disable HTTP/2 for connections with backend servers.
-                type: boolean
-              forwardingTimeouts:
-                description: Timeouts for requests forwarded to the backend servers.
-                properties:
-                  dialTimeout:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: The amount of time to wait until a connection to
-                      a backend server can be established. If zero, no timeout exists.
-                    x-kubernetes-int-or-string: true
-                  idleConnTimeout:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: The maximum period for which an idle HTTP keep-alive
-                      connection will remain open before closing itself.
-                    x-kubernetes-int-or-string: true
-                  responseHeaderTimeout:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    description: The amount of time to wait for a server's response
-                      headers after fully writing the request (including its body,
-                      if any). If zero, no timeout exists.
-                    x-kubernetes-int-or-string: true
-                type: object
-              insecureSkipVerify:
-                description: Disable SSL certificate verification.
-                type: boolean
-              maxIdleConnsPerHost:
-                description: If non-zero, controls the maximum idle (keep-alive) to
-                  keep per-host. If zero, DefaultMaxIdleConnsPerHost is used.
-                type: integer
-              rootCAsSecrets:
-                description: Add cert file for self-signed certificate.
-                items:
-                  type: string
-                type: array
-              serverName:
-                description: ServerName used to contact the server.
-                type: string
-            type: object
-        required:
-        - metadata
-        - spec
-        type: object
-    served: true
-    storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_tlsoptions.yaml

@@ -1,87 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.4.1
-  creationTimestamp: null
-  name: tlsoptions.traefik.containo.us
-spec:
-  group: traefik.containo.us
-  names:
-    kind: TLSOption
-    listKind: TLSOptionList
-    plural: tlsoptions
-    singular: tlsoption
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: TLSOption is a specification for a TLSOption resource.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: TLSOptionSpec configures TLS for an entry point.
-            properties:
-              cipherSuites:
-                items:
-                  type: string
-                type: array
-              clientAuth:
-                description: ClientAuth defines the parameters of the client authentication
-                  part of the TLS connection, if any.
-                properties:
-                  clientAuthType:
-                    description: ClientAuthType defines the client authentication
-                      type to apply.
-                    enum:
-                    - NoClientCert
-                    - RequestClientCert
-                    - VerifyClientCertIfGiven
-                    - RequireAndVerifyClientCert
-                    type: string
-                  secretNames:
-                    description: SecretName is the name of the referenced Kubernetes
-                      Secret to specify the certificate details.
-                    items:
-                      type: string
-                    type: array
-                type: object
-              curvePreferences:
-                items:
-                  type: string
-                type: array
-              maxVersion:
-                type: string
-              minVersion:
-                type: string
-              preferServerCipherSuites:
-                type: boolean
-              sniStrict:
-                type: boolean
-            type: object
-        required:
-        - metadata
-        - spec
-        type: object
-    served: true
-    storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_tlsstores.yaml

@@ -1,64 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.4.1
-  creationTimestamp: null
-  name: tlsstores.traefik.containo.us
-spec:
-  group: traefik.containo.us
-  names:
-    kind: TLSStore
-    listKind: TLSStoreList
-    plural: tlsstores
-    singular: tlsstore
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: TLSStore is a specification for a TLSStore resource.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: TLSStoreSpec configures a TLSStore resource.
-            properties:
-              defaultCertificate:
-                description: DefaultCertificate holds a secret name for the TLSOption
-                  resource.
-                properties:
-                  secretName:
-                    description: SecretName is the name of the referenced Kubernetes
-                      Secret to specify the certificate details.
-                    type: string
-                required:
-                - secretName
-                type: object
-            required:
-            - defaultCertificate
-            type: object
-        required:
-        - metadata
-        - spec
-        type: object
-    served: true
-    storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_traefikservices.yaml

@@ -1,270 +0,0 @@
-
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.4.1
-  creationTimestamp: null
-  name: traefikservices.traefik.containo.us
-spec:
-  group: traefik.containo.us
-  names:
-    kind: TraefikService
-    listKind: TraefikServiceList
-    plural: traefikservices
-    singular: traefikservice
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: TraefikService is the specification for a service (that an IngressRoute
-          refers to) that is usually not a terminal service (i.e. not a pod of servers),
-          as opposed to a Kubernetes Service. That is to say, it usually refers to
-          other (children) services, which themselves can be TraefikServices or Services.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: ServiceSpec defines whether a TraefikService is a load-balancer
-              of services or a mirroring service.
-            properties:
-              mirroring:
-                description: Mirroring defines a mirroring service, which is composed
-                  of a main load-balancer, and a list of mirrors.
-                properties:
-                  kind:
-                    enum:
-                    - Service
-                    - TraefikService
-                    type: string
-                  maxBodySize:
-                    format: int64
-                    type: integer
-                  mirrors:
-                    items:
-                      description: MirrorService defines one of the mirrors of a Mirroring
-                        service.
-                      properties:
-                        kind:
-                          enum:
-                          - Service
-                          - TraefikService
-                          type: string
-                        name:
-                          description: Name is a reference to a Kubernetes Service
-                            object (for a load-balancer of servers), or to a TraefikService
-                            object (service load-balancer, mirroring, etc). The differentiation
-                            between the two is specified in the Kind field.
-                          type: string
-                        namespace:
-                          type: string
-                        passHostHeader:
-                          type: boolean
-                        percent:
-                          type: integer
-                        port:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          x-kubernetes-int-or-string: true
-                        responseForwarding:
-                          description: ResponseForwarding holds configuration for
-                            the forward of the response.
-                          properties:
-                            flushInterval:
-                              type: string
-                          type: object
-                        scheme:
-                          type: string
-                        serversTransport:
-                          type: string
-                        sticky:
-                          description: Sticky holds the sticky configuration.
-                          properties:
-                            cookie:
-                              description: Cookie holds the sticky configuration based
-                                on cookie.
-                              properties:
-                                httpOnly:
-                                  type: boolean
-                                name:
-                                  type: string
-                                sameSite:
-                                  type: string
-                                secure:
-                                  type: boolean
-                              type: object
-                          type: object
-                        strategy:
-                          type: string
-                        weight:
-                          description: Weight should only be specified when Name references
-                            a TraefikService object (and to be precise, one that embeds
-                            a Weighted Round Robin).
-                          type: integer
-                      required:
-                      - name
-                      type: object
-                    type: array
-                  name:
-                    description: Name is a reference to a Kubernetes Service object
-                      (for a load-balancer of servers), or to a TraefikService object
-                      (service load-balancer, mirroring, etc). The differentiation
-                      between the two is specified in the Kind field.
-                    type: string
-                  namespace:
-                    type: string
-                  passHostHeader:
-                    type: boolean
-                  port:
-                    anyOf:
-                    - type: integer
-                    - type: string
-                    x-kubernetes-int-or-string: true
-                  responseForwarding:
-                    description: ResponseForwarding holds configuration for the forward
-                      of the response.
-                    properties:
-                      flushInterval:
-                        type: string
-                    type: object
-                  scheme:
-                    type: string
-                  serversTransport:
-                    type: string
-                  sticky:
-                    description: Sticky holds the sticky configuration.
-                    properties:
-                      cookie:
-                        description: Cookie holds the sticky configuration based on
-                          cookie.
-                        properties:
-                          httpOnly:
-                            type: boolean
-                          name:
-                            type: string
-                          sameSite:
-                            type: string
-                          secure:
-                            type: boolean
-                        type: object
-                    type: object
-                  strategy:
-                    type: string
-                  weight:
-                    description: Weight should only be specified when Name references
-                      a TraefikService object (and to be precise, one that embeds
-                      a Weighted Round Robin).
-                    type: integer
-                required:
-                - name
-                type: object
-              weighted:
-                description: WeightedRoundRobin defines a load-balancer of services.
-                properties:
-                  services:
-                    items:
-                      description: Service defines an upstream to proxy traffic.
-                      properties:
-                        kind:
-                          enum:
-                          - Service
-                          - TraefikService
-                          type: string
-                        name:
-                          description: Name is a reference to a Kubernetes Service
-                            object (for a load-balancer of servers), or to a TraefikService
-                            object (service load-balancer, mirroring, etc). The differentiation
-                            between the two is specified in the Kind field.
-                          type: string
-                        namespace:
-                          type: string
-                        passHostHeader:
-                          type: boolean
-                        port:
-                          anyOf:
-                          - type: integer
-                          - type: string
-                          x-kubernetes-int-or-string: true
-                        responseForwarding:
-                          description: ResponseForwarding holds configuration for
-                            the forward of the response.
-                          properties:
-                            flushInterval:
-                              type: string
-                          type: object
-                        scheme:
-                          type: string
-                        serversTransport:
-                          type: string
-                        sticky:
-                          description: Sticky holds the sticky configuration.
-                          properties:
-                            cookie:
-                              description: Cookie holds the sticky configuration based
-                                on cookie.
-                              properties:
-                                httpOnly:
-                                  type: boolean
-                                name:
-                                  type: string
-                                sameSite:
-                                  type: string
-                                secure:
-                                  type: boolean
-                              type: object
-                          type: object
-                        strategy:
-                          type: string
-                        weight:
-                          description: Weight should only be specified when Name references
-                            a TraefikService object (and to be precise, one that embeds
-                            a Weighted Round Robin).
-                          type: integer
-                      required:
-                      - name
-                      type: object
-                    type: array
-                  sticky:
-                    description: Sticky holds the sticky configuration.
-                    properties:
-                      cookie:
-                        description: Cookie holds the sticky configuration based on
-                          cookie.
-                        properties:
-                          httpOnly:
-                            type: boolean
-                          name:
-                            type: string
-                          sameSite:
-                            type: string
-                          secure:
-                            type: boolean
-                        type: object
-                    type: object
-                type: object
-            type: object
-        required:
-        - metadata
-        - spec
-        type: object
-    served: true
-    storage: true
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

docs/content/reference/static-configuration/cli-ref.md

@@ -102,9 +102,6 @@ Entry points definition. (Default: ```false```)
 `--entrypoints.<name>.address`:  
 Entry point address.
 
-`--entrypoints.<name>.enablehttp3`:  
-Enable HTTP3. (Default: ```false```)
-
 `--entrypoints.<name>.forwardedheaders.insecure`:  
 Trust all forwarded headers. (Default: ```false```)
 
@@ -171,18 +168,12 @@ ReadTimeout is the maximum duration for reading the entire request, including th
 `--entrypoints.<name>.transport.respondingtimeouts.writetimeout`:  
 WriteTimeout is the maximum duration before timing out writes of the response. If zero, no timeout is set. (Default: ```0```)
 
-`--entrypoints.<name>.udp.timeout`:  
-Timeout defines how long to wait on an idle session before releasing the related resources. (Default: ```3```)
-
 `--experimental.devplugin.gopath`:  
 plugin's GOPATH.
 
 `--experimental.devplugin.modulename`:  
 plugin's module name.
 
-`--experimental.http3`:  
-Enable HTTP3. (Default: ```false```)
-
 `--experimental.kubernetesgateway`:  
 Allow the Kubernetes gateway api provider usage. (Default: ```false```)
 
@@ -231,9 +222,6 @@ Enable metrics on entry points. (Default: ```true```)
 `--metrics.datadog.address`:  
 Datadog's address. (Default: ```localhost:8125```)
 
-`--metrics.datadog.addrouterslabels`:  
-Enable metrics on routers. (Default: ```false```)
-
 `--metrics.datadog.addserviceslabels`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -249,9 +237,6 @@ Enable metrics on entry points. (Default: ```true```)
 `--metrics.influxdb.address`:  
 InfluxDB address. (Default: ```localhost:8089```)
 
-`--metrics.influxdb.addrouterslabels`:  
-Enable metrics on routers. (Default: ```false```)
-
 `--metrics.influxdb.addserviceslabels`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -279,9 +264,6 @@ Prometheus metrics exporter type. (Default: ```false```)
 `--metrics.prometheus.addentrypointslabels`:  
 Enable metrics on entry points. (Default: ```true```)
 
-`--metrics.prometheus.addrouterslabels`:  
-Enable metrics on routers. (Default: ```false```)
-
 `--metrics.prometheus.addserviceslabels`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -303,9 +285,6 @@ Enable metrics on entry points. (Default: ```true```)
 `--metrics.statsd.address`:  
 StatsD address. (Default: ```localhost:8125```)
 
-`--metrics.statsd.addrouterslabels`:  
-Enable metrics on routers. (Default: ```false```)
-
 `--metrics.statsd.addserviceslabels`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -577,7 +556,10 @@ TLS key
 Enable Kubernetes backend with default settings. (Default: ```false```)
 
 `--providers.kubernetescrd.allowcrossnamespace`:  
-Allow cross namespace resource reference. (Default: ```true```)
+Allow cross namespace resource reference. (Default: ```false```)
+
+`--providers.kubernetescrd.allowexternalnameservices`:  
+Allow ExternalName services. (Default: ```false```)
 
 `--providers.kubernetescrd.certauthfilepath`:  
 Kubernetes certificate authority file path (not needed for in-cluster client).
@@ -624,8 +606,8 @@ Kubernetes bearer token (not needed for in-cluster client).
 `--providers.kubernetesingress`:  
 Enable Kubernetes backend with default settings. (Default: ```false```)
 
-`--providers.kubernetesingress.allowemptyservices`:  
-Allow creation of services without endpoints. (Default: ```false```)
+`--providers.kubernetesingress.allowexternalnameservices`:  
+Allow ExternalName services. (Default: ```false```)
 
 `--providers.kubernetesingress.certauthfilepath`:  
 Kubernetes certificate authority file path (not needed for in-cluster client).
@@ -634,7 +616,7 @@ Kubernetes certificate authority file path (not needed for in-cluster client).
 Kubernetes server endpoint (required for external cluster client).
 
 `--providers.kubernetesingress.ingressclass`:  
-Value of kubernetes.io/ingress.class annotation or IngressClass name to watch for.
+Value of kubernetes.io/ingress.class annotation to watch for.
 
 `--providers.kubernetesingress.ingressendpoint.hostname`:  
 Hostname used for Kubernetes Ingress endpoints.
@@ -720,9 +702,6 @@ Display additional provider logs. (Default: ```false```)
 `--providers.marathon.watch`:  
 Watch provider. (Default: ```true```)
 
-`--providers.plugin.<name>`:  
-Plugins configuration.
-
 `--providers.providersthrottleduration`:  
 Backends throttle duration: minimum duration between 2 events from providers before applying a new configuration. It avoids unnecessary reloads if multiples events are sent in a short amount of time. (Default: ```2```)
 

docs/content/reference/static-configuration/env-ref.md

@@ -102,9 +102,6 @@ Entry points definition. (Default: ```false```)
 `TRAEFIK_ENTRYPOINTS_<NAME>_ADDRESS`:  
 Entry point address.
 
-`TRAEFIK_ENTRYPOINTS_<NAME>_ENABLEHTTP3`:  
-Enable HTTP3. (Default: ```false```)
-
 `TRAEFIK_ENTRYPOINTS_<NAME>_FORWARDEDHEADERS_INSECURE`:  
 Trust all forwarded headers. (Default: ```false```)
 
@@ -171,18 +168,12 @@ ReadTimeout is the maximum duration for reading the entire request, including th
 `TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_RESPONDINGTIMEOUTS_WRITETIMEOUT`:  
 WriteTimeout is the maximum duration before timing out writes of the response. If zero, no timeout is set. (Default: ```0```)
 
-`TRAEFIK_ENTRYPOINTS_<NAME>_UDP_TIMEOUT`:  
-Timeout defines how long to wait on an idle session before releasing the related resources. (Default: ```3```)
-
 `TRAEFIK_EXPERIMENTAL_DEVPLUGIN_GOPATH`:  
 plugin's GOPATH.
 
 `TRAEFIK_EXPERIMENTAL_DEVPLUGIN_MODULENAME`:  
 plugin's module name.
 
-`TRAEFIK_EXPERIMENTAL_HTTP3`:  
-Enable HTTP3. (Default: ```false```)
-
 `TRAEFIK_EXPERIMENTAL_KUBERNETESGATEWAY`:  
 Allow the Kubernetes gateway api provider usage. (Default: ```false```)
 
@@ -231,9 +222,6 @@ Enable metrics on entry points. (Default: ```true```)
 `TRAEFIK_METRICS_DATADOG_ADDRESS`:  
 Datadog's address. (Default: ```localhost:8125```)
 
-`TRAEFIK_METRICS_DATADOG_ADDROUTERSLABELS`:  
-Enable metrics on routers. (Default: ```false```)
-
 `TRAEFIK_METRICS_DATADOG_ADDSERVICESLABELS`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -249,9 +237,6 @@ Enable metrics on entry points. (Default: ```true```)
 `TRAEFIK_METRICS_INFLUXDB_ADDRESS`:  
 InfluxDB address. (Default: ```localhost:8089```)
 
-`TRAEFIK_METRICS_INFLUXDB_ADDROUTERSLABELS`:  
-Enable metrics on routers. (Default: ```false```)
-
 `TRAEFIK_METRICS_INFLUXDB_ADDSERVICESLABELS`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -279,9 +264,6 @@ Prometheus metrics exporter type. (Default: ```false```)
 `TRAEFIK_METRICS_PROMETHEUS_ADDENTRYPOINTSLABELS`:  
 Enable metrics on entry points. (Default: ```true```)
 
-`TRAEFIK_METRICS_PROMETHEUS_ADDROUTERSLABELS`:  
-Enable metrics on routers. (Default: ```false```)
-
 `TRAEFIK_METRICS_PROMETHEUS_ADDSERVICESLABELS`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -303,9 +285,6 @@ Enable metrics on entry points. (Default: ```true```)
 `TRAEFIK_METRICS_STATSD_ADDRESS`:  
 StatsD address. (Default: ```localhost:8125```)
 
-`TRAEFIK_METRICS_STATSD_ADDROUTERSLABELS`:  
-Enable metrics on routers. (Default: ```false```)
-
 `TRAEFIK_METRICS_STATSD_ADDSERVICESLABELS`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -577,7 +556,10 @@ TLS key
 Enable Kubernetes backend with default settings. (Default: ```false```)
 
 `TRAEFIK_PROVIDERS_KUBERNETESCRD_ALLOWCROSSNAMESPACE`:  
-Allow cross namespace resource reference. (Default: ```true```)
+Allow cross namespace resource reference. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_KUBERNETESCRD_ALLOWEXTERNALNAMESERVICES`:  
+Allow ExternalName services. (Default: ```false```)
 
 `TRAEFIK_PROVIDERS_KUBERNETESCRD_CERTAUTHFILEPATH`:  
 Kubernetes certificate authority file path (not needed for in-cluster client).
@@ -624,8 +606,8 @@ Kubernetes bearer token (not needed for in-cluster client).
 `TRAEFIK_PROVIDERS_KUBERNETESINGRESS`:  
 Enable Kubernetes backend with default settings. (Default: ```false```)
 
-`TRAEFIK_PROVIDERS_KUBERNETESINGRESS_ALLOWEMPTYSERVICES`:  
-Allow creation of services without endpoints. (Default: ```false```)
+`TRAEFIK_PROVIDERS_KUBERNETESINGRESS_ALLOWEXTERNALNAMESERVICES`:  
+Allow ExternalName services. (Default: ```false```)
 
 `TRAEFIK_PROVIDERS_KUBERNETESINGRESS_CERTAUTHFILEPATH`:  
 Kubernetes certificate authority file path (not needed for in-cluster client).
@@ -634,7 +616,7 @@ Kubernetes certificate authority file path (not needed for in-cluster client).
 Kubernetes server endpoint (required for external cluster client).
 
 `TRAEFIK_PROVIDERS_KUBERNETESINGRESS_INGRESSCLASS`:  
-Value of kubernetes.io/ingress.class annotation or IngressClass name to watch for.
+Value of kubernetes.io/ingress.class annotation to watch for.
 
 `TRAEFIK_PROVIDERS_KUBERNETESINGRESS_INGRESSENDPOINT_HOSTNAME`:  
 Hostname used for Kubernetes Ingress endpoints.
@@ -720,9 +702,6 @@ Display additional provider logs. (Default: ```false```)
 `TRAEFIK_PROVIDERS_MARATHON_WATCH`:  
 Watch provider. (Default: ```true```)
 
-`TRAEFIK_PROVIDERS_PLUGIN_<NAME>`:  
-Plugins configuration.
-
 `TRAEFIK_PROVIDERS_PROVIDERSTHROTTLEDURATION`:  
 Backends throttle duration: minimum duration between 2 events from providers before applying a new configuration. It avoids unnecessary reloads if multiples events are sent in a short amount of time. (Default: ```2```)
 

docs/content/reference/static-configuration/file.toml

@@ -14,7 +14,6 @@
 [entryPoints]
   [entryPoints.EntryPoint0]
     address = "foobar"
-    enableHTTP3 = true
     [entryPoints.EntryPoint0.transport]
       [entryPoints.EntryPoint0.transport.lifeCycle]
         requestAcceptGraceTimeout = 42
@@ -29,8 +28,6 @@
     [entryPoints.EntryPoint0.forwardedHeaders]
       insecure = true
       trustedIPs = ["foobar", "foobar"]
-    [entryPoints.EntryPoint0.udp]
-      timeout = 42
     [entryPoints.EntryPoint0.http]
       middlewares = ["foobar", "foobar"]
       [entryPoints.EntryPoint0.http.redirections]
@@ -106,7 +103,6 @@
     labelSelector = "foobar"
     ingressClass = "foobar"
     throttleDuration = "42s"
-    allowEmptyServices = true
     [providers.kubernetesIngress.ingressEndpoint]
       ip = "foobar"
       hostname = "foobar"
@@ -236,7 +232,6 @@
   [metrics.prometheus]
     buckets = [42.0, 42.0]
     addEntryPointsLabels = true
-    addRoutersLabels = true
     addServicesLabels = true
     entryPoint = "foobar"
     manualRouting = true
@@ -244,13 +239,11 @@
     address = "foobar"
     pushInterval = "42s"
     addEntryPointsLabels = true
-    addRoutersLabels = true
     addServicesLabels = true
   [metrics.statsD]
     address = "foobar"
     pushInterval = "42s"
     addEntryPointsLabels = true
-    addRoutersLabels = true
     addServicesLabels = true
     prefix = "foobar"
   [metrics.influxDB]
@@ -262,7 +255,6 @@
     username = "foobar"
     password = "foobar"
     addEntryPointsLabels = true
-    addRoutersLabels = true
     addServicesLabels = true
 
 [ping]
@@ -390,7 +382,6 @@
 
 [experimental]
   kubernetesGateway = true
-  http3 = true
   [experimental.plugins]
     [experimental.plugins.Descriptor0]
       moduleName = "foobar"

docs/content/reference/static-configuration/file.yaml

@@ -32,9 +32,6 @@ entryPoints:
       trustedIPs:
       - foobar
       - foobar
-    enableHTTP3: true
-    udp:
-      timeout: 42
     http:
       redirections:
         entryPoint:
@@ -114,7 +111,6 @@ providers:
     labelSelector: foobar
     ingressClass: foobar
     throttleDuration: 42s
-    allowEmptyServices: true
     ingressEndpoint:
       ip: foobar
       hostname: foobar
@@ -258,7 +254,6 @@ metrics:
     - 42
     - 42
     addEntryPointsLabels: true
-    addRoutersLabels: true
     addServicesLabels: true
     entryPoint: foobar
     manualRouting: true
@@ -266,13 +261,11 @@ metrics:
     address: foobar
     pushInterval: 42
     addEntryPointsLabels: true
-    addRoutersLabels: true
     addServicesLabels: true
   statsD:
     address: foobar
     pushInterval: 42
     addEntryPointsLabels: true
-    addRoutersLabels: true
     addServicesLabels: true
     prefix: foobar
   influxDB:
@@ -284,7 +277,6 @@ metrics:
     username: foobar
     password: foobar
     addEntryPointsLabels: true
-    addRoutersLabels: true
     addServicesLabels: true
 ping:
   entryPoint: foobar
@@ -410,7 +402,6 @@ pilot:
   dashboard: true
 experimental:
   kubernetesGateway: true
-  http3: true
   plugins:
     Descriptor0:
       moduleName: foobar
@@ -421,3 +412,4 @@ experimental:
   devPlugin:
     goPath: foobar
     moduleName: foobar
+

docs/content/routing/entrypoints.md

@@ -100,7 +100,6 @@ They can be defined by using a file (YAML or TOML) or CLI arguments.
     entryPoints:
       name:
         address: ":8888" # same as ":8888/tcp"
-        enableHTTP3: true
         transport:
           lifeCycle:
             requestAcceptGraceTimeout: 42
@@ -126,7 +125,6 @@ They can be defined by using a file (YAML or TOML) or CLI arguments.
     [entryPoints]
       [entryPoints.name]
         address = ":8888" # same as ":8888/tcp"
-        enableHTTP3 = true
         [entryPoints.name.transport]
           [entryPoints.name.transport.lifeCycle]
             requestAcceptGraceTimeout = 42
@@ -146,7 +144,6 @@ They can be defined by using a file (YAML or TOML) or CLI arguments.
     ```bash tab="CLI"
     ## Static configuration
     --entryPoints.name.address=:8888 # same as :8888/tcp
-    --entryPoints.name.http3=true
     --entryPoints.name.transport.lifeCycle.requestAcceptGraceTimeout=42
     --entryPoints.name.transport.lifeCycle.graceTimeOut=42
     --entryPoints.name.transport.respondingTimeouts.readTimeout=42
@@ -221,43 +218,6 @@ If both TCP and UDP are wanted for the same port, two entryPoints definitions ar
 
     Full details for how to specify `address` can be found in [net.Listen](https://golang.org/pkg/net/#Listen) (and [net.Dial](https://golang.org/pkg/net/#Dial)) of the doc for go.
 
-### EnableHTTP3
-
-`enableHTTP3` defines that you want to enable HTTP3 on this `address`.
-You can only enable HTTP3 on a TCP entrypoint.
-Enabling HTTP3 will automatically add the correct headers for the connection upgrade to HTTP3.
-
-??? info "HTTP3 uses UDP+TLS"
-
-    As HTTP3 uses UDP, you can't have a TCP entrypoint with HTTP3 on the same port as a UDP entrypoint.
-    Since HTTP3 requires the use of TLS, only routers with TLS enabled will be usable with HTTP3.
-
-!!! warning "Enabling Experimental HTTP3"
-
-    As the HTTP3 spec is still in draft, HTTP3 support in Traefik is an experimental feature and needs to be activated 
-    in the experimental section of the static configuration.
-    
-    ```yaml tab="File (YAML)"
-    experimental:
-      http3: true
-    
-    entryPoints:
-      name:
-        enableHTTP3: true
-    ```
-
-    ```toml tab="File (TOML)"
-    [experimental]
-      http3 = true
-    
-    [entryPoints.name]
-      enableHTTP3 = true
-    ```
-    
-    ```bash tab="CLI"
-    --experimental.http3=true --entrypoints.name.enablehttp3=true
-    ```
-
 ### Forwarded Headers
 
 You can configure Traefik to trust the forwarded headers information (`X-Forwarded-*`).
@@ -864,35 +824,3 @@ entryPoints:
     --entrypoints.websecure.address=:443
     --entrypoints.websecure.http.tls.certResolver=leresolver
     ```
-
-## UDP Options
-
-This whole section is dedicated to options, keyed by entry point, that will apply only to UDP routing.
-
-### Timeout
-
-_Optional, Default=3s_
-
-Timeout defines how long to wait on an idle session before releasing the related resources.
-The Timeout value must be greater than zero.
-
-```yaml tab="File (YAML)"
-entryPoints:
-  foo:
-    address: ':8000/udp'
-    udp:
-      timeout: 10s
-```
-
-```toml tab="File (TOML)"
-[entryPoints.foo]
-  address = ":8000/udp"
-
-    [entryPoints.foo.udp]
-      timeout = "10s"
-```
-
-```bash tab="CLI"
-entrypoints.foo.address=:8000/udp
-entrypoints.foo.udp.timeout=10s
-```

docs/content/routing/overview.md

@@ -22,7 +22,7 @@ If they do, the router might transform the request using pieces of [middleware](
 ## Example with a File Provider
 
 Below is an example of a full configuration file for the [file provider](../providers/file.md) that forwards `http://domain/whoami/` requests to a service reachable on `http://private/whoami-service/`.
-In the process, Traefik will make sure that the user is authenticated (using the [BasicAuth middleware](../middlewares/http/basicauth.md)).
+In the process, Traefik will make sure that the user is authenticated (using the [BasicAuth middleware](../middlewares/basicauth.md)).
 
 Static configuration:
 

docs/content/routing/providers/consul-catalog.md

@@ -263,7 +263,7 @@ you'd add the tag `traefik.http.services.{name-of-your-choice}.loadbalancer.pass
 
 You can declare pieces of middleware using tags starting with `traefik.http.middlewares.{name-of-your-choice}.`, followed by the middleware type/options.
 
-For example, to declare a middleware [`redirectscheme`](../../middlewares/http/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
+For example, to declare a middleware [`redirectscheme`](../../middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
 
 More information about available middlewares in the dedicated [middlewares section](../../middlewares/overview.md).
 

docs/content/routing/providers/docker.md

@@ -419,7 +419,7 @@ you'd add the label `traefik.http.services.<name-of-your-choice>.loadbalancer.pa
 You can declare pieces of middleware using labels starting with `traefik.http.middlewares.<name-of-your-choice>.`,
 followed by the middleware type/options.
 
-For example, to declare a middleware [`redirectscheme`](../../middlewares/http/redirectscheme.md) named `my-redirect`,
+For example, to declare a middleware [`redirectscheme`](../../middlewares/redirectscheme.md) named `my-redirect`,
 you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme=https`.
 
 More information about available middlewares in the dedicated [middlewares section](../../middlewares/overview.md).

docs/content/routing/providers/ecs.md

@@ -268,7 +268,7 @@ you'd add the label `traefik.http.services.{name-of-your-choice}.loadbalancer.pa
 
 You can declare pieces of middleware using labels starting with `traefik.http.middlewares.{name-of-your-choice}.`, followed by the middleware type/options.
 
-For example, to declare a middleware [`redirectscheme`](../../middlewares/http/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
+For example, to declare a middleware [`redirectscheme`](../../middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
 
 More information about available middlewares in the dedicated [middlewares section](../../middlewares/overview.md).
 

docs/content/routing/providers/kubernetes-crd.md

@@ -9,7 +9,7 @@ The Kubernetes Ingress Controller, The Custom Resource Way.
 
     ```yaml tab="Resource Definition"
     # All resources definition must be declared
-    --8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml"
+    --8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition.yml"
     ```
     
     ```yaml tab="RBAC"
@@ -43,7 +43,7 @@ The Kubernetes Ingress Controller, The Custom Resource Way.
           serviceAccountName: traefik-ingress-controller
           containers:
             - name: traefik
-              image: traefik:v2.5
+              image: traefik:v2.4
               args:
                 - --log.level=DEBUG
                 - --api
@@ -145,7 +145,7 @@ The Kubernetes Ingress Controller, The Custom Resource Way.
     
     spec:
       entryPoints:
-        - udpep
+        - fooudp
       routes:
       - kind: Rule
         services:
@@ -332,7 +332,7 @@ Register the `IngressRoute` [kind](../../reference/dynamic-configuration/kuberne
           name: foo
           namespace: default
           passHostHeader: true
-          port: 80                      # [9]
+          port: 80
           responseForwarding:
             flushInterval: 1ms
           scheme: https
@@ -345,39 +345,38 @@ Register the `IngressRoute` [kind](../../reference/dynamic-configuration/kuberne
               sameSite: none
           strategy: RoundRobin
           weight: 10
-      tls:                              # [10]
-        secretName: supersecret         # [11]
-        options:                        # [12]
-          name: opt                     # [13]
-          namespace: default            # [14]
-        certResolver: foo               # [15]
-        domains:                        # [16]
-        - main: example.net             # [17]
-          sans:                         # [18]
+      tls:                              # [9]
+        secretName: supersecret         # [10]
+        options:                        # [11]
+          name: opt                     # [12]
+          namespace: default            # [13]
+        certResolver: foo               # [14]
+        domains:                        # [15]
+        - main: example.net             # [16]
+          sans:                         # [17]
           - a.example.net
           - b.example.net
     ```
 
-| Ref  | Attribute                    | Purpose                                                                                                                                                                                                                  |
-|------|------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| [1]  | `entryPoints`                | List of [entry points](../routers/index.md#entrypoints) names                                                                                                                                                            |
-| [2]  | `routes`                     | List of routes                                                                                                                                                                                                           |
-| [3]  | `routes[n].match`            | Defines the [rule](../routers/index.md#rule) corresponding to an underlying router.                                                                                                                                      |
-| [4]  | `routes[n].priority`         | [Disambiguate](../routers/index.md#priority) rules of the same length, for route matching                                                                                                                                |
-| [5]  | `routes[n].middlewares`      | List of reference to [Middleware](#kind-middleware)                                                                                                                                                                      |
-| [6]  | `middlewares[n].name`        | Defines the [Middleware](#kind-middleware) name                                                                                                                                                                          |
-| [7]  | `middlewares[n].namespace`   | Defines the [Middleware](#kind-middleware) namespace                                                                                                                                                                     |
-| [8]  | `routes[n].services`         | List of any combination of [TraefikService](#kind-traefikservice) and reference to a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) (See below for `ExternalName Service` setup) |
-| [9]  | `services[n].port`           | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). This can be a reference to a named port.                                                                   |
-| [10] | `tls`                        | Defines [TLS](../routers/index.md#tls) certificate configuration                                                                                                                                                         |
-| [11] | `tls.secretName`             | Defines the [secret](https://kubernetes.io/docs/concepts/configuration/secret/) name used to store the certificate (in the `IngressRoute` namespace)                                                                     |
-| [12] | `tls.options`                | Defines the reference to a [TLSOption](#kind-tlsoption)                                                                                                                                                                  |
-| [13] | `options.name`               | Defines the [TLSOption](#kind-tlsoption) name                                                                                                                                                                            |
-| [14] | `options.namespace`          | Defines the [TLSOption](#kind-tlsoption) namespace                                                                                                                                                                       |
-| [15] | `tls.certResolver`           | Defines the reference to a [CertResolver](../routers/index.md#certresolver)                                                                                                                                              |
-| [16] | `tls.domains`                | List of [domains](../routers/index.md#domains)                                                                                                                                                                           |
-| [17] | `domains[n].main`            | Defines the main domain name                                                                                                                                                                                             |
-| [18] | `domains[n].sans`            | List of SANs (alternative domains)                                                                                                                                                                                       |
+| Ref  | Attribute                  | Purpose                                                                                                                                                                                                                  |
+|------|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [1]  | `entryPoints`              | List of [entry points](../routers/index.md#entrypoints) names                                                                                                                                                            |
+| [2]  | `routes`                   | List of routes                                                                                                                                                                                                           |
+| [3]  | `routes[n].match`          | Defines the [rule](../routers/index.md#rule) corresponding to an underlying router.                                                                                                                                      |
+| [4]  | `routes[n].priority`       | [Disambiguate](../routers/index.md#priority) rules of the same length, for route matching                                                                                                                                |
+| [5]  | `routes[n].middlewares`    | List of reference to [Middleware](#kind-middleware)                                                                                                                                                                      |
+| [6]  | `middlewares[n].name`      | Defines the [Middleware](#kind-middleware) name                                                                                                                                                                          |
+| [7]  | `middlewares[n].namespace` | Defines the [Middleware](#kind-middleware) namespace                                                                                                                                                                     |
+| [8]  | `routes[n].services`       | List of any combination of [TraefikService](#kind-traefikservice) and reference to a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) (See below for `ExternalName Service` setup) |
+| [9]  | `tls`                      | Defines [TLS](../routers/index.md#tls) certificate configuration                                                                                                                                                         |
+| [10] | `tls.secretName`           | Defines the [secret](https://kubernetes.io/docs/concepts/configuration/secret/) name used to store the certificate (in the `IngressRoute` namespace)                                                                     |
+| [11] | `tls.options`              | Defines the reference to a [TLSOption](#kind-tlsoption)                                                                                                                                                                  |
+| [12] | `options.name`             | Defines the [TLSOption](#kind-tlsoption) name                                                                                                                                                                            |
+| [13] | `options.namespace`        | Defines the [TLSOption](#kind-tlsoption) namespace                                                                                                                                                                       |
+| [14] | `tls.certResolver`         | Defines the reference to a [CertResolver](../routers/index.md#certresolver)                                                                                                                                              |
+| [15] | `tls.domains`              | List of [domains](../routers/index.md#domains)                                                                                                                                                                           |
+| [16] | `domains[n].main`          | Defines the main domain name                                                                                                                                                                                             |
+| [17] | `domains[n].sans`          | List of SANs (alternative domains)                                                                                                                                                                                       |
 
 ??? example "Declaring an IngressRoute"
 
@@ -1116,7 +1115,7 @@ Register the `IngressRouteTCP` [kind](../../reference/dynamic-configuration/kube
 | [3]  | `routes[n].match`              | Defines the [rule](../routers/index.md#rule_1) corresponding to an underlying router                                                                                                                                                                                                                                                                                                 |
 | [4]  | `routes[n].services`           | List of [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) definitions  (See below for `ExternalName Service` setup)                                                                                                                                                                                                                             |
 | [5]  | `services[n].name`             | Defines the name of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/)                                                                                                                                                                                                                                                                         |
-| [6]  | `services[n].port`             | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). This can be a reference to a named port.                                                                                                                                                                                                                               |
+| [6]  | `services[n].port`             | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/)                                                                                                                                                                                                                                                                         |
 | [7]  | `services[n].weight`           | Defines the weight to apply to the server load balancing                                                                                                                                                                                                                                                                                                                             |
 | [8]  | `services[n].terminationDelay` | corresponds to the deadline that the proxy sets, after one of its connected peers indicates it has closed the writing capability of its connection, to close the reading capability as well, hence fully terminating the connection. It is a duration in milliseconds, defaulting to 100. A negative value means an infinite deadline (i.e. the reading capability is never closed). |
 | [9]  | `proxyProtocol`                | Defines the [PROXY protocol](../services/index.md#proxy-protocol) configuration                                                                                                                                                                                                                                                                                                      |
@@ -1293,9 +1292,9 @@ Register the `IngressRouteUDP` [kind](../../reference/dynamic-configuration/kube
 |------|--------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | [1]  | `entryPoints`                  | List of [entrypoints](../routers/index.md#entrypoints_1) names                                                                                                                                                                                                                                                                                                                           |
 | [2]  | `routes`                       | List of routes                                                                                                                                                                                                                                                                                                                                                                           |
-| [3]  | `routes[n].services`           | List of [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) definitions (See below for `ExternalName Service` setup)                                                                                                                                                                                                                                  |
+| [3]  | `routes[n].services`           | List of [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) definitions                                                                                                                                                                                                                                                                               |
 | [4]  | `services[n].name`             | Defines the name of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/)                                                                                                                                                                                                                                                                             |
-| [6]  | `services[n].port`             | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). This can be a reference to a named port.                                                                                                                                                                                                                                   |
+| [6]  | `services[n].port`             | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/)                                                                                                                                                                                                                                                                             |
 | [7]  | `services[n].weight`           | Defines the weight to apply to the server load balancing                                                                                                                                                                                                                                                                                                                                 |
 
 ??? example "Declaring an IngressRouteUDP"
@@ -1319,105 +1318,6 @@ Register the `IngressRouteUDP` [kind](../../reference/dynamic-configuration/kube
           weight: 10
     ```
 
-!!! important "Using Kubernetes ExternalName Service"
-
-    Traefik backends creation needs a port to be set, however Kubernetes [ExternalName Service](https://kubernetes.io/fr/docs/concepts/services-networking/service/#externalname) could be defined without any port.
-    Accordingly, Traefik supports defining a port in two ways:
-    
-    - only on `IngressRouteUDP` service
-    - on both sides, you'll be warned if the ports don't match, and the `IngressRouteUDP` service port is used
-    
-    Thus, in case of two sides port definition, Traefik expects a match between ports.
-    
-    ??? example "Examples"
-        
-        ```yaml tab="IngressRouteUDP"
-        ---
-        apiVersion: traefik.containo.us/v1alpha1
-        kind: IngressRouteUDP
-        metadata:
-          name: test.route
-          namespace: default
-        
-        spec:
-          entryPoints:
-            - foo
-        
-          routes:
-          - services:
-            - name: external-svc
-              port: 80
-        
-        ---
-        apiVersion: v1
-        kind: Service
-        metadata:
-          name: external-svc
-          namespace: default
-        spec:
-          externalName: external.domain
-          type: ExternalName
-        ```
-        
-        ```yaml tab="ExternalName Service"
-        ---
-        apiVersion: traefik.containo.us/v1alpha1
-        kind: IngressRouteUDP
-        metadata:
-          name: test.route
-          namespace: default
-        
-        spec:
-          entryPoints:
-            - foo
-        
-          routes:
-          - services:
-            - name: external-svc
-        
-        ---
-        apiVersion: v1
-        kind: Service
-        metadata:
-          name: external-svc
-          namespace: default
-        spec:
-          externalName: external.domain
-          type: ExternalName
-          ports:
-            - port: 80
-        ```
-        
-        ```yaml tab="Both sides"
-        ---
-        apiVersion: traefik.containo.us/v1alpha1
-        kind: IngressRouteUDP
-        metadata:
-          name: test.route
-          namespace: default
-        
-        spec:
-          entryPoints:
-            - foo
-        
-          routes:
-          - services:
-            - name: external-svc
-              port: 80
-        
-        ---
-        apiVersion: v1
-        kind: Service
-        metadata:
-          name: external-svc
-          namespace: default
-        spec:
-          externalName: external.domain
-          type: ExternalName
-          ports:
-            - port: 80
-        ```
-
 ### Kind: `TLSOption`
 
 `TLSOption` is the CRD implementation of a [Traefik "TLS Option"](../../https/tls.md#tls-options).
@@ -1451,20 +1351,16 @@ or referencing TLS options in the [`IngressRoute`](#kind-ingressroute) / [`Ingre
       sniStrict: true                               # [8]
     ```
 
-| Ref | Attribute                   | Purpose                                                                                                                                                                                                                    |
-|-----|-----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| [1] | `minVersion`                | Defines the [minimum TLS version](../../https/tls.md#minimum-tls-version) that is acceptable                                                                                                                               |
-| [2] | `maxVersion`                | Defines the [maximum TLS version](../../https/tls.md#maximum-tls-version) that is acceptable                                                                                                                               |
-| [3] | `cipherSuites`              | list of supported [cipher suites](../../https/tls.md#cipher-suites) for TLS versions up to TLS 1.2                                                                                                                         |
-| [4] | `curvePreferences`          | List of the [elliptic curves references](../../https/tls.md#curve-preferences) that will be used in an ECDHE handshake, in preference order                                                                                |
-| [5] | `clientAuth`                | determines the server's policy for TLS [Client Authentication](../../https/tls.md#client-authentication-mtls)                                                                                                              |
-| [6] | `clientAuth.secretNames`    | list of names of the referenced Kubernetes [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) (in TLSOption namespace). The secret must contain a certificate under either a `tls.ca` or a `ca.crt` key. |
-| [7] | `clientAuth.clientAuthType` | defines the client authentication type to apply. The available values are: `NoClientCert`, `RequestClientCert`, `VerifyClientCertIfGiven` and `RequireAndVerifyClientCert`                                                 |
-| [8] | `sniStrict`                 | if `true`, Traefik won't allow connections from clients connections that do not specify a server_name extension                                                                                                            |
-
-!!! info "CA Secret"
-
-    The CA secret must contain a base64 encoded certificate under either a `tls.ca` or a `ca.crt` key.
+| Ref | Attribute                   | Purpose                                                                                                                                                                    |
+|-----|-----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [1] | `minVersion`                | Defines the [minimum TLS version](../../https/tls.md#minimum-tls-version) that is acceptable                                                                               |
+| [2] | `maxVersion`                | Defines the [maximum TLS version](../../https/tls.md#maximum-tls-version) that is acceptable                                                                               |
+| [3] | `cipherSuites`              | list of supported [cipher suites](../../https/tls.md#cipher-suites) for TLS versions up to TLS 1.2                                                                         |
+| [4] | `curvePreferences`          | List of the [elliptic curves references](../../https/tls.md#curve-preferences) that will be used in an ECDHE handshake, in preference order                                |
+| [5] | `clientAuth`                | determines the server's policy for TLS [Client Authentication](../../https/tls.md#client-authentication-mtls)                                                              |
+| [6] | `clientAuth.secretNames`    | list of names of the referenced Kubernetes [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) (in TLSOption namespace)                                   |
+| [7] | `clientAuth.clientAuthType` | defines the client authentication type to apply. The available values are: `NoClientCert`, `RequestClientCert`, `VerifyClientCertIfGiven` and `RequireAndVerifyClientCert` |
+| [8] | `sniStrict`                 | if `true`, Traefik won't allow connections from clients connections that do not specify a server_name extension                                                            |
 
 ??? example "Declaring and referencing a TLSOption"
    
@@ -1517,7 +1413,6 @@ or referencing TLS options in the [`IngressRoute`](#kind-ingressroute) / [`Ingre
       namespace: default
     
     data:
-      # Must contain a certificate under either a `tls.ca` or a `ca.crt` key.
       tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
     
     ---
@@ -1528,7 +1423,6 @@ or referencing TLS options in the [`IngressRoute`](#kind-ingressroute) / [`Ingre
       namespace: default
     
     data:
-      # Must contain a certificate under either a `tls.ca` or a `ca.crt` key. 
       tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
     ```
         
@@ -1654,7 +1548,7 @@ or referencing TLS stores in the [`IngressRoute`](#kind-ingressroute) / [`Ingres
 |-----|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|
 | [1] | `serverName`            | ServerName used to contact the server.                                                                                                               |
 | [2] | `insecureSkipVerify`    | Disable SSL certificate verification.                                                                                                                |
-| [3] | `rootCAsSecrets`        | Add cert file for self-signed certificate. The secret must contain a certificate under either a tls.ca or a ca.crt key.                              |
+| [3] | `rootCAsSecrets`        | Add cert file for self-signed certificate.                                                                                                           |
 | [4] | `certificatesSecrets`   | Certificates for mTLS.                                                                                                                               |
 | [5] | `maxIdleConnsPerHost`   | If non-zero, controls the maximum idle (keep-alive) to keep per-host. If zero, `defaultMaxIdleConnsPerHost` is used.                                 |
 | [6] | `forwardingTimeouts`    | Timeouts for requests forwarded to the backend servers.                                                                                              |
@@ -1662,10 +1556,6 @@ or referencing TLS stores in the [`IngressRoute`](#kind-ingressroute) / [`Ingres
 | [8] | `responseHeaderTimeout` | The amount of time to wait for a server's response headers after fully writing the request (including its body, if any). If zero, no timeout exists. |
 | [9] | `idleConnTimeout`       | The maximum period for which an idle HTTP keep-alive connection will remain open before closing itself.                                              |
 
-!!! info "CA Secret"
-
-    The CA secret must contain a base64 encoded certificate under either a `tls.ca` or a `ca.crt` key.
-
 ??? example "Declaring and referencing a ServersTransport"
    
     ```yaml tab="ServersTransport"

docs/content/routing/providers/kubernetes-gateway.md

@@ -33,13 +33,11 @@ The Kubernetes Gateway API, The Experimental Way.
     
 You can find an excerpt of the supported Kubernetes Gateway API resources in the table below:
 
-| Kind                               | Purpose                                                                   | Concept Behind                                                                       |
-|------------------------------------|---------------------------------------------------------------------------|--------------------------------------------------------------------------------------|
-| [GatewayClass](#kind-gatewayclass) | Defines a set of Gateways that share a common configuration and behaviour | [GatewayClass](https://gateway-api.sigs.k8s.io/api-types/gatewayclass)               |
-| [Gateway](#kind-gateway)           | Describes how traffic can be translated to Services within the cluster    | [Gateway](https://gateway-api.sigs.k8s.io/api-types/gateway)                         |
-| [HTTPRoute](#kind-httproute)       | HTTP rules for mapping requests from a Gateway to Kubernetes Services     | [Route](https://gateway-api.sigs.k8s.io/api-types/httproute)                         |
-| [TCPRoute](#kind-tcproute)         | Allows mapping TCP requests from a Gateway to Kubernetes Services         | [Route](https://gateway-api.sigs.k8s.io/concepts/api-overview/#httptcpfooroute)      |
-| [TLSRoute](#kind-tlsroute)         | Allows mapping TLS requests from a Gateway to Kubernetes Services         | [Route](https://gateway-api.sigs.k8s.io/concepts/api-overview/#httptcpfooroute)      |
+| Kind                               | Purpose                                                                   | Concept Behind                                                              |
+|------------------------------------|---------------------------------------------------------------------------|-----------------------------------------------------------------------------|
+| [GatewayClass](#kind-gatewayclass) | Defines a set of Gateways that share a common configuration and behaviour | [GatewayClass](https://gateway-api.sigs.k8s.io/api-types/gatewayclass)  |
+| [Gateway](#kind-gateway)           | Describes how traffic can be translated to Services within the cluster    | [Gateway](https://gateway-api.sigs.k8s.io/api-types/gateway)            |
+| [HTTPRoute](#kind-httproute)       | HTTP rules for mapping requests from a Gateway to Kubernetes Services     | [Route](https://gateway-api.sigs.k8s.io/api-types/httproute)      |
 
 ### Kind: `GatewayClass`
 
@@ -72,114 +70,43 @@ More details on the Gateway [official documentation](https://gateway-api.sigs.k8
 Register the `Gateway` [definition](../../reference/dynamic-configuration/kubernetes-gateway.md#definitions) in the
 Kubernetes cluster before creating `Gateway` objects.
 
-Depending on the Listener Protocol, different modes and Route types are supported.
-
-| Listener Protocol | TLS Mode       | Route Type Supported         |
-|-------------------|----------------|------------------------------|
-| TCP               | Not applicable | [TCPRoute](#kind-tcproute)   |
-| TLS               | Passthrough    | [TLSRoute](#kind-tlsroute)   |
-| TLS               | Terminate      | [TCPRoute](#kind-tcproute)   |
-| HTTP              | Not applicable | [HTTPRoute](#kind-httproute) |
-| HTTPS             | Terminate      | [HTTPRoute](#kind-httproute) |
-
 !!! info "Declaring Gateway"
 
-    ```yaml tab="HTTP Listener"
-    kind: Gateway
-    apiVersion: networking.x-k8s.io/v1alpha1
-    metadata:
-      name: my-http-gateway
-      namespace: default
-    spec:
-      gatewayClassName: my-gateway-class        # [1]
-      listeners:                                # [2]
-        - protocol: HTTP                        # [3] 
-          port: 80                              # [4]
-          routes:                               # [8]
-            kind: HTTPRoute                     # [9]
-            selector:                           # [10]
-              matchLabels:                      # [11]
-                app: foo
     ```
-
-    ```yaml tab="HTTPS Listener"
     kind: Gateway
     apiVersion: networking.x-k8s.io/v1alpha1
     metadata:
-      name: my-https-gateway
+      name: my-gateway
       namespace: default
     spec:
       gatewayClassName: my-gateway-class        # [1]
       listeners:                                # [2]
         - protocol: HTTPS                       # [3] 
           port: 443                             # [4]
-          tls:                                  # [6]
-            certificateRef:                     # [7]
+          tls:                                  # [5]
+            certificateRef:                     # [6]
               group: "core"
               kind: "Secret"
               name: "mysecret"
-          routes:                               # [8]
-            kind: HTTPRoute                     # [9]
-            selector:                           # [10]
-              matchLabels:                      # [11]
+          routes:                               # [7]
+            kind: HTTPRoute                     # [8]
+            selector:                           # [9]
+              matchLabels:                      # [10]
                 app: foo
     ```
 
-    ```yaml tab="TCP Listener"
-    kind: Gateway
-    apiVersion: networking.x-k8s.io/v1alpha1
-    metadata:
-      name: my-tcp-gateway
-      namespace: default
-    spec:
-      gatewayClassName: my-gateway-class        # [1]
-      listeners:                                # [2]
-        - protocol: TCP                         # [3] 
-          port: 8000                            # [4]
-          routes:                               # [8]
-            kind: TCPRoute                      # [9]
-            selector:                           # [10]
-              matchLabels:                      # [11]
-                app: footcp
-    ```
-
-    ```yaml tab="TLS Listener"
-    kind: Gateway
-    apiVersion: networking.x-k8s.io/v1alpha1
-    metadata:
-      name: my-tls-gateway
-      namespace: default
-    spec:
-      gatewayClassName: my-gateway-class        # [1]
-      listeners:                                # [2]
-        - protocol: TLS                         # [3] 
-          port: 443                             # [4]
-          hostname: foo.com                     # [5]
-          tls:                                  # [6]
-            certificateRef:                     # [7]
-              group: "core"
-              kind: "Secret"
-              name: "mysecret"
-          routes:                               # [8]
-            kind: TLSRoute                      # [9]
-            selector:                           # [10]
-              matchLabels:                      # [11]
-                app: footcp
-    ```
-
-| Ref  | Attribute          | Description                                                                                                                                          |
-|------|--------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|
-| [1]  | `gatewayClassName` | GatewayClassName used for this Gateway. This is the name of a GatewayClass resource.                                                                 |
-| [2]  | `listeners`        | Logical endpoints that are bound on this Gateway's addresses. At least one Listener MUST be specified.                                               |
-| [3]  | `protocol`         | The network protocol this listener expects to receive (only HTTP and HTTPS are implemented).                                                         |
-| [4]  | `port`             | The network port.                                                                                                                                    |
-| [5]  | `hostname`         | Hostname specifies the virtual hostname to match for protocol types that define this concept. When unspecified, “”, or *, all hostnames are matched. |
-| [6]  | `tls`              | TLS configuration for the Listener. This field is required if the Protocol field is "HTTPS" or "TLS" and ignored otherwise.                          |
-| [7]  | `certificateRef`   | The reference to Kubernetes object that contains a TLS certificate and private key.                                                                  |
-| [8]  | `routes`           | A schema for associating routes with the Listener using selectors.                                                                                   |
-| [9]  | `kind`             | The kind of the referent.                                                                                                                            |
-| [10] | `selector`         | Routes in namespaces selected by the selector may be used by this Gateway routes to associate with the Gateway.                                      |
-| [11] | `matchLabels`      | A set of route labels used for selecting routes to associate with the Gateway.                                                                       |
+| Ref  | Attribute          | Description                                                                                                                 |
+|------|--------------------|-----------------------------------------------------------------------------------------------------------------------------|
+| [1]  | `gatewayClassName` | GatewayClassName used for this Gateway. This is the name of a GatewayClass resource.                                        |
+| [2]  | `listeners`        | Logical endpoints that are bound on this Gateway's addresses. At least one Listener MUST be specified.                      |
+| [3]  | `protocol`         | The network protocol this listener expects to receive (only HTTP and HTTPS are implemented).                                |
+| [4]  | `port`             | The network port.                                                                                                           |
+| [5]  | `tls`              | TLS configuration for the Listener. This field is required if the Protocol field is "HTTPS" or "TLS" and ignored otherwise. |
+| [6]  | `certificateRef`   | The reference to Kubernetes object that contains a TLS certificate and private key.                                         |
+| [7]  | `routes`           | A schema for associating routes with the Listener using selectors.                                                          |
+| [8]  | `kind`             | The kind of the referent.                                                                                                   |
+| [9]  | `selector`         | Routes in namespaces selected by the selector may be used by this Gateway routes to associate with the Gateway.   |
+| [10] | `matchLabels`      | A set of route labels used for selecting routes to associate with the Gateway.                                              |
 
 ### Kind: `HTTPRoute`
 
@@ -196,133 +123,39 @@ Kubernetes cluster before creating `HTTPRoute` objects.
     metadata:
       name: http-app-1
       namespace: default
-      labels:                                   # [1]
+      labels:                       # [1]
         app: foo
     spec:
-      hostnames:                                # [2]
+      hostnames:                    # [2]
         - "whoami"
-      rules:                                    # [3]
-        - matches:                              # [4]
-            - path:                             # [5]
-                type: Exact                     # [6]
-                value: /bar                     # [7]
-            - headers:                          # [8]
-                type: Exact                     # [9]
-                values:                         # [10]
+      rules:                        # [3]
+        - matches:                  # [4]
+            - path:                 # [5]
+                type: Exact         # [6]
+                value: /bar         # [7]
+            - headers:              # [8]
+                type: Exact         # [9]
+                values:             # [10]
                   foo: bar
-          forwardTo:                            # [11]
-            - serviceName: whoami               # [12]
-              weight: 1                         # [13]
-              port: 80                          # [14]
-            - backendRef:                       # [15]
-                group: traefik.containo.us      # [16]
-                kind: TraefikService            # [17]
-                name: api@internal              # [18]
-              port: 80
-              weight: 1
+          forwardTo:                # [11]
+            - serviceName: whoami   # [12]
+              weight: 1             # [13]
+              port: 80              # [14]
     ```
 
-| Ref  | Attribute     | Description                                                                                                                                                                                                                                  |
-|------|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| [1]  | `labels`      | Labels to match with the `Gateway` labelselector.                                                                                                                                                                                            |
-| [2]  | `hostnames`   | A set of hostname that should match against the HTTP Host header to select a HTTPRoute to process the request.                                                                                                                               |
-| [3]  | `rules`       | A list of HTTP matchers, filters and actions.                                                                                                                                                                                                |
-| [4]  | `matches`     | Conditions used for matching the rule against incoming HTTP requests. Each match is independent, i.e. this rule will be matched if **any** one of the matches is satisfied.                                                                  |
-| [5]  | `path`        | An HTTP request path matcher. If this field is not specified, a default prefix match on the "/" path is provided.                                                                                                                            |
-| [6]  | `type`        | Type of match against the path Value (supported types: `Exact`, `Prefix`).                                                                                                                                                                   |
-| [7]  | `value`       | The value of the HTTP path to match against.                                                                                                                                                                                                 |
-| [8]  | `headers`     | Conditions to select a HTTP route by matching HTTP request headers.                                                                                                                                                                          |
-| [9]  | `type`        | Type of match for the HTTP request header match against the `values` (supported types: `Exact`).                                                                                                                                             |
-| [10] | `values`      | A map of HTTP Headers to be matched. It MUST contain at least one entry.                                                                                                                                                                     |
-| [11] | `forwardTo`   | The upstream target(s) where the request should be sent.                                                                                                                                                                                     |
-| [12] | `serviceName` | The name of the referent service.                                                                                                                                                                                                            |
-| [13] | `weight`      | The proportion of traffic forwarded to a targetRef, computed as weight/(sum of all weights in targetRefs).                                                                                                                                   |
-| [14] | `port`        | The port of the referent service.                                                                                                                                                                                                            |
-| [15] | `backendRef`  | The BackendRef is a reference to a backend (API object within a known namespace) to forward matched requests to. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. Only `TraefikService` is supported. |
-| [16] | `group`       | Group is the group of the referent. Only `traefik.containo.us` value is supported.                                                                                                                                                           |
-| [17] | `kind`        | Kind is kind of the referent. Only `TraefikService` value is supported.                                                                                                                                                                      |
-| [18] | `name`        | Name is the name of the referent.                                                                                                                                                                                                            |
-
-### Kind: `TCPRoute`
-
-`TCPRoute` allows mapping TCP requests from a `Gateway` to Kubernetes Services
-
-Register the `TCPRoute` [definition](../../reference/dynamic-configuration/kubernetes-gateway.md#definitions) in the
-Kubernetes cluster before creating `TCPRoute` objects.
-
-!!! info "Declaring TCPRoute"
-
-    ```yaml
-    kind: TCPRoute
-    apiVersion: networking.x-k8s.io/v1alpha1
-    metadata:
-      name: tcp-app-1
-      namespace: default
-      labels:                                   # [1]
-        app: tcp-app-1
-    spec:
-      rules:                                    # [2]
-        - forwardTo:                            # [3]
-            - serviceName: whoamitcp            # [4]
-              weight: 1                         # [5]
-              port: 8080                        # [6]
-            - backendRef:                       # [7]
-                group: traefik.containo.us      # [8]
-                kind: TraefikService            # [9]
-                name: api@internal              # [10]
-    ```
-
-| Ref  | Attribute     | Description                                                                                                                                                                                                                                  |
-|------|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| [1]  | `labels`      | Labels to match with the `Gateway` labelselector.                                                                                                                                                                                            |
-| [2]  | `rules`       | Rules are a list of TCP matchers and actions.                                                                                                                                                                                                |
-| [3]  | `forwardTo`   | The upstream target(s) where the request should be sent.                                                                                                                                                                                     |
-| [4]  | `serviceName` | The name of the referent service.                                                                                                                                                                                                            |
-| [5]  | `weight`      | The proportion of traffic forwarded to a targetRef, computed as weight/(sum of all weights in targetRefs).                                                                                                                                   |
-| [6]  | `port`        | The port of the referent service.                                                                                                                                                                                                            |
-| [7]  | `backendRef`  | The BackendRef is a reference to a backend (API object within a known namespace) to forward matched requests to. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. Only `TraefikService` is supported. |
-| [8]  | `group`       | Group is the group of the referent. Only `traefik.containo.us` value is supported.                                                                                                                                                           |
-| [9]  | `kind`        | Kind is kind of the referent. Only `TraefikService` value is supported.                                                                                                                                                                      |
-| [10] | `name`        | Name is the name of the referent.                                                                                                                                                                                                            |
-
-### Kind: `TLSRoute`
-
-`TLSRoute` allows mapping TLS requests from a `Gateway` to Kubernetes Services
-
-Register the `TLSRoute` [definition](../../reference/dynamic-configuration/kubernetes-gateway.md#definitions) in the
-Kubernetes cluster before creating `TLSRoute` objects.
-
-!!! info "Declaring TCPRoute"
-
-    ```yaml
-    kind: TLSRoute
-    apiVersion: networking.x-k8s.io/v1alpha1
-    metadata:
-      name: tls-app-1
-      namespace: default
-      labels:                                   # [1]
-        app: tls-app-1
-    spec:
-      rules:                                    # [2]
-        - forwardTo:                            # [3]
-            - serviceName: whoamitcp            # [4]
-              weight: 1                         # [5]
-              port: 8080                        # [6]
-            - backendRef:                       # [7]
-                group: traefik.containo.us      # [8]
-                kind: TraefikService            # [9]
-                name: api@internal              # [10]
-    ```
-
-| Ref  | Attribute     | Description                                                                                                                                                                                                                                  |
-|------|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| [1]  | `labels`      | Labels to match with the `Gateway` labelselector.                                                                                                                                                                                            |
-| [2]  | `rules`       | Rules are a list of TCP matchers and actions.                                                                                                                                                                                                |
-| [3]  | `forwardTo`   | The upstream target(s) where the request should be sent.                                                                                                                                                                                     |
-| [4]  | `serviceName` | The name of the referent service.                                                                                                                                                                                                            |
-| [5]  | `weight`      | The proportion of traffic forwarded to a targetRef, computed as weight/(sum of all weights in targetRefs).                                                                                                                                   |
-| [6]  | `port`        | The port of the referent service.                                                                                                                                                                                                            |
-| [7]  | `backendRef`  | The BackendRef is a reference to a backend (API object within a known namespace) to forward matched requests to. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. Only `TraefikService` is supported. |
-| [8]  | `group`       | Group is the group of the referent. Only `traefik.containo.us` value is supported.                                                                                                                                                           |
-| [9]  | `kind`        | Kind is kind of the referent. Only `TraefikService` value is supported.                                                                                                                                                                      |
-| [10] | `name`        | Name is the name of the referent.                                                                                                                                                                                                            |
+| Ref  | Attribute     | Description                                                                                                                                                                 |
+|------|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [1]  | `labels`      | Labels to match with the `Gateway` labelselector.                                                                                                                           |
+| [2]  | `hostnames`   | A set of hostname that should match against the HTTP Host header to select a HTTPRoute to process the request.                                                              |
+| [3]  | `rules`       | A list of HTTP matchers, filters and actions.                                                                                                                               |
+| [4]  | `matches`     | Conditions used for matching the rule against incoming HTTP requests. Each match is independent, i.e. this rule will be matched if **any** one of the matches is satisfied. |
+| [5]  | `path`        | An HTTP request path matcher. If this field is not specified, a default prefix match on the "/" path is provided.                                                           |
+| [6]  | `type`        | Type of match against the path Value (supported types: `Exact`, `Prefix`).                                                                                                  |
+| [7]  | `value`       | The value of the HTTP path to match against.                                                                                                                                |
+| [8]  | `headers`     | Conditions to select a HTTP route by matching HTTP request headers.                                                                                                         |
+| [9]  | `type`        | Type of match for the HTTP request header match against the `values` (supported types: `Exact`).                                                                            |
+| [10] | `values`      | A map of HTTP Headers to be matched. It MUST contain at least one entry.                                                                                                    |
+| [11] | `forwardTo`   | The upstream target(s) where the request should be sent.                                                                                                                    |
+| [12] | `serviceName` | The name of the referent service.                                                                                                                                           |
+| [13] | `weight`      | The proportion of traffic forwarded to a targetRef, computed as weight/(sum of all weights in targetRefs).                                                                  |
+| [14] | `port`        | The port of the referent service.                                                                                                                                           |

docs/content/routing/providers/kubernetes-ingress.md

@@ -85,33 +85,6 @@ which in turn will create the resulting routers, services, handlers, etc.
                   servicePort: 80
     ```
     
-    ```yaml tab="Ingress Kubernetes v1.19+"
-    kind: Ingress
-    apiVersion: networking.k8s.io/v1
-    metadata:
-      name: myingress
-      annotations:
-        traefik.ingress.kubernetes.io/router.entrypoints: web
-    
-    spec:
-      rules:
-        - host: example.com
-          http:
-            paths:
-              - path: /bar
-                backend:
-                  service:
-                    name:  whoami
-                    port:
-                      number: 80
-              - path: /foo
-                backend:
-                  service:
-                    name:  whoami
-                    port:
-                      number: 80
-    ```
-    
     ```yaml tab="Traefik"
     apiVersion: v1
     kind: ServiceAccount
@@ -139,7 +112,7 @@ which in turn will create the resulting routers, services, handlers, etc.
           serviceAccountName: traefik-ingress-controller
           containers:
             - name: traefik
-              image: traefik:v2.5
+              image: traefik:v2.4
               args:
                 - --entrypoints.web.address=:80
                 - --providers.kubernetesingress
@@ -294,14 +267,6 @@ which in turn will create the resulting routers, services, handlers, etc.
     traefik.ingress.kubernetes.io/service.serversscheme: h2c
     ```
 
-??? info "`traefik.ingress.kubernetes.io/service.serverstransport`"
-
-    See [ServersTransport](../services/index.md#serverstransport) for more information.
-
-    ```yaml
-    traefik.ingress.kubernetes.io/service.serverstransport: foobar@file
-    ```
-
 ??? info "`traefik.ingress.kubernetes.io/service.passhostheader`"
 
     See [pass Host header](../services/index.md#pass-host-header) for more information.
@@ -469,33 +434,6 @@ This way, any Ingress attached to this Entrypoint will have TLS termination by d
                   servicePort: 80
     ```
     
-    ```yaml tab="Ingress Kubernetes v1.19+"
-    kind: Ingress
-    apiVersion: networking.k8s.io/v1
-    metadata:
-      name: myingress
-      annotations:
-        traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    
-    spec:
-      rules:
-        - host: example.com
-          http:
-            paths:
-              - path: /bar
-                backend:
-                  service:
-                    name:  whoami
-                    port:
-                      number: 80
-              - path: /foo
-                backend:
-                  service:
-                    name:  whoami
-                    port:
-                      number: 80
-    ```
-    
     ```yaml tab="Traefik"
     apiVersion: v1
     kind: ServiceAccount
@@ -523,7 +461,7 @@ This way, any Ingress attached to this Entrypoint will have TLS termination by d
           serviceAccountName: traefik-ingress-controller
           containers:
             - name: traefik
-              image: traefik:v2.5
+              image: traefik:v2.4
               args:
                 - --entrypoints.websecure.address=:443
                 - --entrypoints.websecure.http.tls
@@ -675,34 +613,6 @@ For more options, please refer to the available [annotations](#on-ingress).
                   servicePort: 80
     ```
     
-    ```yaml tab="Ingress Kubernetes v1.19+"
-    kind: Ingress
-    apiVersion: networking.k8s.io/v1
-    metadata:
-      name: myingress
-      annotations:
-        traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        traefik.ingress.kubernetes.io/router.tls: true
-    
-    spec:
-      rules:
-        - host: example.com
-          http:
-            paths:
-              - path: /bar
-                backend:
-                  service:
-                    name:  whoami
-                    port:
-                      number: 80
-              - path: /foo
-                backend:
-                  service:
-                    name:  whoami
-                    port:
-                      number: 80
-    ```
-    
     ```yaml tab="Traefik"
     apiVersion: v1
     kind: ServiceAccount
@@ -730,7 +640,7 @@ For more options, please refer to the available [annotations](#on-ingress).
           serviceAccountName: traefik-ingress-controller
           containers:
             - name: traefik
-              image: traefik:v2.5
+              image: traefik:v2.4
               args:
                 - --entrypoints.websecure.address=:443
                 - --providers.kubernetesingress
@@ -822,31 +732,6 @@ For more options, please refer to the available [annotations](#on-ingress).
       tls:
       - secretName: supersecret
     ```
-
-    ```yaml tab="Ingress Kubernetes v1.19+"
-    kind: Ingress
-    apiVersion: networking.k8s.io/v1
-    metadata:
-      name: foo
-      namespace: production
-    
-    spec:
-      rules:
-      - host: example.net
-        http:
-          paths:
-          - path: /bar
-            backend:
-              service:
-                name:  service1
-                port:
-                  number: 80
-      # Only selects which certificate(s) should be loaded from the secret, in order to terminate TLS.
-      # Doesn't enable TLS for that ingress (hence for the underlying router).
-      # Please see the TLS annotations on ingress made for that purpose.
-      tls:
-      - secretName: supersecret
-    ```
       
     ```yaml tab="Secret"
     apiVersion: v1
@@ -892,30 +777,16 @@ and will connect via TLS automatically.
 
 Ingresses can be created that look like the following:
 
-```yaml tab="Ingress"
+```yaml
 apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
  name: cheese
 
 spec:
-  defaultBackend:
-    serviceName: stilton
-    serverPort: 80
-```
-
-```yaml tab="Ingress Kubernetes v1.19+"
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
- name: cheese
-
-spec:
-  defaultBackend:
-    service:
-      name: stilton
-      port:
-        number: 80
+ backend:
+   serviceName: stilton
+   servicePort: 80
 ```
 
 This ingress follows the Global Default Backend property of ingresses.

docs/content/routing/providers/marathon.md

@@ -293,7 +293,7 @@ For example, to change the passHostHeader behavior, you'd add the label `"traefi
 
 You can declare pieces of middleware using labels starting with `traefik.http.middlewares.{middleware-name-of-your-choice}.`, followed by the middleware type/options.
 
-For example, to declare a middleware [`redirectscheme`](../../middlewares/http/redirectscheme.md) named `my-redirect`, you'd write `"traefik.http.middlewares.my-redirect.redirectscheme.scheme": "https"`.
+For example, to declare a middleware [`redirectscheme`](../../middlewares/redirectscheme.md) named `my-redirect`, you'd write `"traefik.http.middlewares.my-redirect.redirectscheme.scheme": "https"`.
 
 More information about available middlewares in the dedicated [middlewares section](../../middlewares/overview.md).
 

docs/content/routing/providers/rancher.md

@@ -299,7 +299,7 @@ you'd add the label `traefik.http.services.{name-of-your-choice}.loadbalancer.pa
 
 You can declare pieces of middleware using labels starting with `traefik.http.middlewares.{name-of-your-choice}.`, followed by the middleware type/options.
 
-For example, to declare a middleware [`redirectscheme`](../../middlewares/http/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
+For example, to declare a middleware [`redirectscheme`](../../middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
 
 More information about available middlewares in the dedicated [middlewares section](../../middlewares/overview.md).
 

docs/content/routing/routers/index.md

@@ -239,7 +239,6 @@ The table below lists all the available matchers:
 | ```Path(`/path`, `/articles/{cat:[a-z]+}/{id:[0-9]+}`, ...)```         | Match exact request path. It accepts a sequence of literal and regular expression paths.                       |
 | ```PathPrefix(`/products/`, `/articles/{cat:[a-z]+}/{id:[0-9]+}`)```   | Match request prefix path. It accepts a sequence of literal and regular expression prefix paths.               |
 | ```Query(`foo=bar`, `bar=baz`)```                                      | Match Query String parameters. It accepts a sequence of key=value pairs.                                       |
-| ```ClientIP(`10.0.0.0/16`, `::1`)```                                   | Match if the request client IP is one of the given IP/CIDR. It accepts IPv4, IPv6 and CIDR formats.            |
 
 !!! important "Non-ASCII Domain Names"
 
@@ -257,10 +256,6 @@ The table below lists all the available matchers:
 
     You can combine multiple matchers using the AND (`&&`) and OR (`||`) operators. You can also use parenthesis.
 
-!!! info "Invert a matcher"
-
-    You can invert a matcher by using the `!` operator.
-
 !!! important "Rule, Middleware, and Services"
 
     The rule is evaluated "before" any middleware has the opportunity to work, and "before" the request is forwarded to the service.
@@ -273,10 +268,6 @@ The table below lists all the available matchers:
     For instance, `PathPrefix: /products` would match `/products` but also `/products/shoes` and `/products/shirts`.
     Since the path is forwarded as-is, your service is expected to listen on `/products`.
 
-!!! info "ClientIP matcher"
-
-    The `ClientIP` matcher will only match the request client IP and does not use the `X-Forwarded-For` header for matching.
-
 ### Priority
 
 To avoid path overlap, routes are sorted, by default, in descending order using rules length. The priority is directly equal to the length of the rule, and so the longest length has the highest priority.
@@ -808,41 +799,6 @@ If you want to limit the router scope to a set of entry points, set the entry po
     Hence, only TLS routers will be able to specify a domain name with that rule.
     However, non-TLS routers will have to explicitly use that rule with `*` (every domain) to state that every non-TLS request will be handled by the router.
 
-### Middlewares
-
-You can attach a list of [middlewares](../../middlewares/overview.md) to each TCP router.
-The middlewares will take effect only if the rule matches, and before connecting to the service.
-
-!!! warning "The character `@` is not allowed to be used in the middleware name."
-
-!!! tip "Middlewares order"
-
-    Middlewares are applied in the same order as their declaration in **router**.
-
-??? example "With a [middleware](../../middlewares/tcp/overview.md) -- using the [File Provider](../../providers/file.md)"
-
-    ```toml tab="TOML"
-    ## Dynamic configuration
-    [tcp.routers]
-      [tcp.routers.my-router]
-        rule = "HostSNI(`*`)"
-        # declared elsewhere
-        middlewares = ["ipwhitelist"]
-        service = "service-foo"
-    ```
-
-    ```yaml tab="YAML"
-    ## Dynamic configuration
-    tcp:
-      routers:
-        my-router:
-          rule: "HostSNI(`*`)"
-          # declared elsewhere
-          middlewares:
-          - ipwhitelist
-          service: service-foo
-    ```
-
 ### Services
 
 You must attach a TCP [service](../services/index.md) per TCP router.
@@ -1037,9 +993,8 @@ So UDP "routers" at this time are pretty much only load-balancers in one form or
 	It basically means that some state is kept about an ongoing communication between a client and a backend,
 	notably so that the proxy knows where to forward a response packet from a backend.
 	As expected, a `timeout` is associated to each of these sessions,
-	so that they get cleaned out if they go through a period of inactivity longer than a given duration. 
-	Timeout can be configured using the `entryPoints.name.udp.timeout` option as described 
-	under [entry points](../entrypoints/#udp-options).
+	so that they get cleaned out if they go through a period of inactivity longer than a given duration (that is hardcoded to 3 seconds for now).
+	Making this timeout configurable will be considered later if we get more usage feedback on this matter.
 
 ### EntryPoints
 

docs/content/routing/services/index.md

@@ -116,7 +116,7 @@ The `url` option point to a specific instance.
 !!! info ""
     Paths in the servers' `url` have no effect.
     If you want the requests to be sent to a specific path on your servers,
-    configure your [`routers`](../routers/index.md) to use a corresponding [middleware](../../middlewares/overview.md) (e.g. the [AddPrefix](../../middlewares/http/addprefix.md) or [ReplacePath](../../middlewares/http/replacepath.md)) middlewares.
+    configure your [`routers`](../routers/index.md) to use a corresponding [middleware](../../middlewares/overview.md) (e.g. the [AddPrefix](../../middlewares/addprefix.md) or [ReplacePath](../../middlewares/replacepath.md)) middlewares.
 
 ??? example "A Service with One Server -- Using the [File Provider](../../providers/file.md)"
 
@@ -167,8 +167,8 @@ For now, only round robin load balancing is supported:
 
 #### Sticky sessions
 
-When sticky sessions are enabled, a `Set-Cookie` header is set on the initial response to let the client know which server handles the first response.
-On subsequent requests, to keep the session alive with the same server, the client should send the cookie with the value set.
+When sticky sessions are enabled, a cookie is set on the initial request and response to let the client know which server handles the first response.
+On subsequent requests, to keep the session alive with the same server, the client should resend the same cookie.
 
 !!! info "Stickiness on multiple levels"
 
@@ -313,8 +313,6 @@ On subsequent requests, to keep the session alive with the same server, the clie
 Configure health check to remove unhealthy servers from the load balancing rotation.
 Traefik will consider your servers healthy as long as they return status codes between `2XX` and `3XX` to the health check requests (carried out every `interval`).
 
-To propagate status changes (e.g. all servers of this service are down) upwards, HealthCheck must also be enabled on the parent(s) of this service.
-
 Below are the available options for the health check mechanism:
 
 - `path` is appended to the server URL to set the health check endpoint.
@@ -707,37 +705,6 @@ spec:
     maxIdleConnsPerHost: 7
 ```
 
-#### `disableHTTP2`
-
-_Optional, Default=false_
-
-`disableHTTP2` disables HTTP/2 for connections with backend servers.
-
-```toml tab="File (TOML)"
-## Dynamic configuration
-[http.serversTransports.mytransport]
-  disableHTTP2 = true
-```
-
-```yaml tab="File (YAML)"
-## Dynamic configuration
-http:
-  serversTransports:
-    mytransport:
-      disableHTTP2: true
-```
-
-```yaml tab="Kubernetes"
-apiVersion: traefik.containo.us/v1alpha1
-kind: ServersTransport
-metadata:
-  name: mytransport
-  namespace: default
-
-spec:
-    disableHTTP2: true
-```
-
 #### `forwardingTimeouts`
 
 `forwardingTimeouts` is about a number of timeouts relevant to when forwarding requests to the backend servers.
@@ -902,84 +869,6 @@ http:
         url = "http://private-ip-server-2/"
 ```
 
-#### Health Check
-
-HealthCheck enables automatic self-healthcheck for this service, i.e. whenever
-one of its children is reported as down, this service becomes aware of it, and
-takes it into account (i.e. it ignores the down child) when running the
-load-balancing algorithm. In addition, if the parent of this service also has
-HealthCheck enabled, this service reports to its parent any status change.
-
-!!! info "All or nothing"
-
-    If HealthCheck is enabled for a given service, but any of its descendants does
-    not have it enabled, the creation of the service will fail.
-
-    HealthCheck on Weighted services can be defined currently only with the [File](../../providers/file.md) provider.
-
-```yaml tab="YAML"
-## Dynamic configuration
-http:
-  services:
-    app:
-      weighted:
-        healthCheck: {}
-        services:
-        - name: appv1
-          weight: 3
-        - name: appv2
-          weight: 1
-
-    appv1:
-      loadBalancer:
-        healthCheck:
-          path: /status
-          interval: 10s
-          timeout: 3s
-        servers:
-        - url: "http://private-ip-server-1/"
-
-    appv2:
-      loadBalancer:
-        healthCheck:
-          path: /status
-          interval: 10s
-          timeout: 3s
-        servers:
-        - url: "http://private-ip-server-2/"
-```
-
-```toml tab="TOML"
-## Dynamic configuration
-[http.services]
-  [http.services.app]
-    [http.services.app.weighted.healthCheck]
-    [[http.services.app.weighted.services]]
-      name = "appv1"
-      weight = 3
-    [[http.services.app.weighted.services]]
-      name = "appv2"
-      weight = 1
-
-  [http.services.appv1]
-    [http.services.appv1.loadBalancer]
-      [http.services.appv1.loadBalancer.healthCheck]
-        path = "/health"
-        interval = "10s"
-        timeout = "3s"
-      [[http.services.appv1.loadBalancer.servers]]
-        url = "http://private-ip-server-1/"
-
-  [http.services.appv2]
-    [http.services.appv2.loadBalancer]
-      [http.services.appv2.loadBalancer.healthCheck]
-        path = "/health"
-        interval = "10s"
-        timeout = "3s"
-      [[http.services.appv2.loadBalancer.servers]]
-        url = "http://private-ip-server-2/"
-```
-
 ### Mirroring (service)
 
 The mirroring is able to mirror requests sent to a service to other services.
@@ -1041,76 +930,6 @@ http:
         url = "http://private-ip-server-2/"
 ```
 
-#### Health Check
-
-HealthCheck enables automatic self-healthcheck for this service, i.e. if the
-main handler of the service becomes unreachable, the information is propagated
-upwards to its parent.
-
-!!! info "All or nothing"
-
-    If HealthCheck is enabled for a given service, but any of its descendants does
-    not have it enabled, the creation of the service will fail.
-
-    HealthCheck on Mirroring services can be defined currently only with the [File](../../providers/file.md) provider.
-
-```yaml tab="YAML"
-## Dynamic configuration
-http:
-  services:
-    mirrored-api:
-      mirroring:
-        healthCheck: {}
-        service: appv1
-        mirrors:
-        - name: appv2
-          percent: 10
-
-    appv1:
-      loadBalancer:
-        healthCheck:
-          path: /status
-          interval: 10s
-          timeout: 3s
-        servers:
-        - url: "http://private-ip-server-1/"
-
-    appv2:
-      loadBalancer:
-        servers:
-        - url: "http://private-ip-server-2/"
-```
-
-```toml tab="TOML"
-## Dynamic configuration
-[http.services]
-  [http.services.mirrored-api]
-    [http.services.mirrored-api.mirroring]
-      [http.services.mirrored-api.mirroring.healthCheck]
-      service = "appv1"
-    [[http.services.mirrored-api.mirroring.mirrors]]
-      name = "appv2"
-      percent = 10
-
-  [http.services.appv1]
-    [http.services.appv1.loadBalancer]
-      [http.services.appv1.loadBalancer.healthCheck]
-        path = "/health"
-        interval = "10s"
-        timeout = "3s"
-      [[http.services.appv1.loadBalancer.servers]]
-        url = "http://private-ip-server-1/"
-
-  [http.services.appv2]
-    [http.services.appv2.loadBalancer]
-      [http.services.appv1.loadBalancer.healthCheck]
-        path = "/health"
-        interval = "10s"
-        timeout = "3s"
-      [[http.services.appv2.loadBalancer.servers]]
-        url = "http://private-ip-server-2/"
-```
-
 ## Configuring TCP Services
 
 ### General

docs/content/user-guides/crd-acme/03-deployments.yml

@@ -26,7 +26,7 @@ spec:
       serviceAccountName: traefik-ingress-controller
       containers:
         - name: traefik
-          image: traefik:v2.5
+          image: traefik:v2.4
           args:
             - --api.insecure
             - --accesslog

docs/content/user-guides/crd-acme/index.md

@@ -43,7 +43,7 @@ First, the definition of the `IngressRoute` and the `Middleware` kinds.
 Also note the RBAC authorization resources; they'll be referenced through the `serviceAccountName` of the deployment, later on.
 
 ```yaml
---8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml"
+--8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition.yml"
 
 ---
 --8<-- "content/reference/dynamic-configuration/kubernetes-crd-rbac.yml"

docs/content/user-guides/crd-acme/k3s.yml

@@ -26,5 +26,5 @@ node:
     - K3S_CLUSTER_SECRET=somethingtotallyrandom
   volumes:
     # this is where you would place a alternative traefik image (saved as a .tar file with
-    # 'docker save'), if you want to use it, instead of the traefik:v2.5 image.
+    # 'docker save'), if you want to use it, instead of the traefik:v2.4 image.
     - /sowewhere/on/your/host/custom-image:/var/lib/rancher/k3s/agent/images

docs/content/user-guides/docker-compose/acme-dns/docker-compose.yml

@@ -3,7 +3,7 @@ version: "3.3"
 services:
 
   traefik:
-    image: "traefik:v2.5"
+    image: "traefik:v2.4"
     container_name: "traefik"
     command:
       #- "--log.level=DEBUG"

docs/content/user-guides/docker-compose/acme-dns/docker-compose_secrets.yml

@@ -13,7 +13,7 @@ secrets:
 services:
 
   traefik:
-    image: "traefik:v2.5"
+    image: "traefik:v2.4"
     container_name: "traefik"
     command:
       #- "--log.level=DEBUG"