Prepare release v2.8.2

Co-authored-by: Kevin Pollet <pollet.kevin@gmail.com>

.github/workflows/build.yaml

@@ -6,7 +6,7 @@ on:
       - '*'
 
 env:
-  GO_VERSION: 1.17
+  GO_VERSION: 1.19
   CGO_ENABLED: 0
   IN_DOCKER: ""
 

.github/workflows/test-unit.yaml

@@ -6,7 +6,7 @@ on:
       - '*'
 
 env:
-  GO_VERSION: 1.17
+  GO_VERSION: 1.19
   IN_DOCKER: ""
 
 jobs:

.github/workflows/validate.yaml

@@ -6,8 +6,8 @@ on:
       - '*'
 
 env:
-  GO_VERSION: 1.17
-  GOLANGCI_LINT_VERSION: v1.46.2
+  GO_VERSION: 1.19
+  GOLANGCI_LINT_VERSION: v1.48.0
   MISSSPELL_VERSION: v0.3.4
   IN_DOCKER: ""
 

.gitignore

@@ -18,3 +18,4 @@ vendor/
 plugins-storage/
 plugins-local/
 traefik_changelog.md
+integration/tailscale.secret

.golangci.toml

@@ -119,6 +119,7 @@
     "interfacer", # Deprecated
     "maligned", # Deprecated
     "golint", # Deprecated
+    "nosnakecase", # Deprecated
     "execinquery", # Not relevant (SQL)
     "sqlclosecheck", # Not relevant (SQL)
     "rowserrcheck", # Not relevant (SQL)
@@ -159,6 +160,7 @@
     "containedctx", # too many false-positive
     "maintidx", # kind of duplicate of gocyclo
     "nonamedreturns", # not relevant
+    "structcheck", # duplicate of unused
   ]
 
 [issues]
@@ -179,7 +181,7 @@
   ]
  [[issues.exclude-rules]]
     path = "(.+)_test.go"
-    linters = ["goconst", "funlen", "godot"]
+    linters = ["goconst", "funlen", "godot", "nosnakecase"]
  [[issues.exclude-rules]]
     path = "integration/.+_test.go"
     text = "Error return value of `cmd\\.Process\\.Kill` is not checked"
@@ -222,3 +224,10 @@
  [[issues.exclude-rules]]
     path = "pkg/server/router/tcp/manager.go"
     text = "Function 'buildEntryPointHandler' is too long (.+)"
+ [[issues.exclude-rules]]
+    path = "pkg/tls/tlsmanager_test.go"
+    text = "SA1019: config.ClientCAs.Subjects has been deprecated since Go 1.18"
+ [[issues.exclude-rules]]
+    path = "pkg/types/tls_test.go"
+    text = "SA1019: tlsConfig.RootCAs.Subjects has been deprecated since Go 1.18"
+

.semaphore/semaphore.yml

@@ -19,13 +19,13 @@ global_job_config:
   prologue:
     commands:
       - curl -sSfL https://raw.githubusercontent.com/ldez/semgo/master/godownloader.sh | sudo sh -s -- -b "/usr/local/bin"
-      - sudo semgo go1.17
+      - sudo semgo go1.19
       - export "GOPATH=$(go env GOPATH)"
       - export "SEMAPHORE_GIT_DIR=${GOPATH}/src/github.com/traefik/${SEMAPHORE_PROJECT_NAME}"
       - export "PATH=${GOPATH}/bin:${PATH}"
       - mkdir -vp "${SEMAPHORE_GIT_DIR}" "${GOPATH}/bin"
       - export GOPROXY=https://proxy.golang.org,direct
-      - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b "${GOPATH}/bin" v1.46.2
+      - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b "${GOPATH}/bin" v1.48.0
       - curl -sSfL https://gist.githubusercontent.com/traefiker/6d7ac019c11d011e4f131bb2cca8900e/raw/goreleaser.sh | bash -s -- -b "${GOPATH}/bin"
       - checkout
       - cache restore traefik-$(checksum go.sum)

CHANGELOG.md

@@ -1,3 +1,36 @@
+## [v2.8.2](https://github.com/traefik/traefik/tree/v2.8.2) (2022-08-11)
+[All Commits](https://github.com/traefik/traefik/compare/v2.8.1...v2.8.2)
+
+**Bug fixes:**
+- **[k8s/ingress,k8s]** Place namespace before name in router key for Ingress ([#9221](https://github.com/traefik/traefik/pull/9221) by [longshine](https://github.com/longshine))
+- **[kv]** Update valkeyrie to a9a70ee ([#9243](https://github.com/traefik/traefik/pull/9243) by [kevinpollet](https://github.com/kevinpollet))
+- **[logs,middleware,tracing]** Remove request dump from IPWhitelist debug log and tracing message ([#9244](https://github.com/traefik/traefik/pull/9244) by [rtribotte](https://github.com/rtribotte))
+- **[metrics]** Control allocation and copy of labelNamesValues type ([#9241](https://github.com/traefik/traefik/pull/9241) by [rtribotte](https://github.com/rtribotte))
+- **[metrics]** Fix service up gauge for Prometheus metrics ([#9197](https://github.com/traefik/traefik/pull/9197) by [juliens](https://github.com/juliens))
+- **[plugins]** Bump paerser to v0.1.6 ([#9224](https://github.com/traefik/traefik/pull/9224) by [ldez](https://github.com/ldez))
+- **[yaml]** Add missing inline tag for YAML serialization ([#9182](https://github.com/traefik/traefik/pull/9182) by [kevinpollet](https://github.com/kevinpollet))
+
+**Documentation:**
+- **[k8s]** Fix wording of default behavior for namespaces option ([#9222](https://github.com/traefik/traefik/pull/9222) by [markormesher](https://github.com/markormesher))
+- **[k8s]** Add getting started guide for Kubernetes ([#9163](https://github.com/traefik/traefik/pull/9163) by [moutoum](https://github.com/moutoum))
+- **[plugins]** Remove Traefik Pilot and add a Traefik Plugins Catalog page ([#9171](https://github.com/traefik/traefik/pull/9171) by [sdelicata](https://github.com/sdelicata))
+- Update Thank You page with proper branding and grammar fixes ([#9203](https://github.com/traefik/traefik/pull/9203) by [tfny](https://github.com/tfny))
+- Update CONTRIBUTING.md to contain all information in one place ([#9192](https://github.com/traefik/traefik/pull/9192) by [tfny](https://github.com/tfny))
+- Update the PR guidelines in Contributing docs ([#9179](https://github.com/traefik/traefik/pull/9179) by [tfny](https://github.com/tfny))
+
+## [v2.8.1](https://github.com/traefik/traefik/tree/v2.8.1) (2022-07-11)
+[All Commits](https://github.com/traefik/traefik/compare/v2.8.0...v2.8.1)
+
+**Bug fixes:**
+- **[kv]** Upgrade valkeyrie to v0.4.1 ([#9161](https://github.com/traefik/traefik/pull/9161) by [moutoum](https://github.com/moutoum))
+- **[middleware,metrics]** Improve performances when Prometheus metrics are enabled ([#9168](https://github.com/traefik/traefik/pull/9168) by [juliens](https://github.com/juliens))
+- **[middleware]** Support forwarded websocket protocol in RedirectScheme ([#9159](https://github.com/traefik/traefik/pull/9159) by [moutoum](https://github.com/moutoum))
+
+**Documentation:**
+- Update the language for advocating page ([#9169](https://github.com/traefik/traefik/pull/9169) by [tfny](https://github.com/tfny))
+- Add callout for anyone using Traefik to manage commercial applications ([#9152](https://github.com/traefik/traefik/pull/9152) by [tomatokoolaid](https://github.com/tomatokoolaid))
+- Update deprecation notices ([#9149](https://github.com/traefik/traefik/pull/9149) by [ddtmachado](https://github.com/ddtmachado))
+
 ## [v2.8.0](https://github.com/traefik/traefik/tree/v2.8.0) (2022-06-29)
 [All Commits](https://github.com/traefik/traefik/compare/v2.8.0-rc1...v2.8.0)
 
@@ -234,7 +267,7 @@ Release canceled.
 - **[webui]** Add a link to service on router detail view ([#8821](https://github.com/traefik/traefik/pull/8821) by [Tchoupinax](https://github.com/Tchoupinax))
 
 **Documentation:**
--  Add a Feature Deprecation page ([#8868](https://github.com/traefik/traefik/pull/8868) by [ddtmachado](https://github.com/ddtmachado))
+- Add a Feature Deprecation page ([#8868](https://github.com/traefik/traefik/pull/8868) by [ddtmachado](https://github.com/ddtmachado))
 
 **Misc:**
 - Merge current v2.6 into master ([#8877](https://github.com/traefik/traefik/pull/8877) by [rtribotte](https://github.com/rtribotte))
@@ -602,7 +635,6 @@ Release canceled.
 - Merge current v2.4 into master ([#7748](https://github.com/traefik/traefik/pull/7748) by [kevinpollet](https://github.com/kevinpollet))
 - Merge current v2.4 into master ([#7728](https://github.com/traefik/traefik/pull/7728) by [mmatur](https://github.com/mmatur))
 
-
 ## [v2.4.14](https://github.com/traefik/traefik/tree/v2.4.14) (2021-08-16)
 [All Commits](https://github.com/traefik/traefik/compare/v2.4.13...v2.4.14)
 
@@ -3418,7 +3450,6 @@ Same changelog as v2.0.3.
 ## [v1.7.0-rc2](https://github.com/traefik/traefik/tree/v1.7.0-rc2) (2018-07-17)
 [All Commits](https://github.com/traefik/traefik/compare/v1.7.0-rc1...v1.7.0-rc2)
 
-
 **Bug fixes:**
 - **[acme,provider]** Create init method on provider interface ([#3580](https://github.com/traefik/traefik/pull/3580) by [Juliens](https://github.com/Juliens))
 - **[acme]** Serve TLS-Challenge certificate in first ([#3605](https://github.com/traefik/traefik/pull/3605) by [nmengin](https://github.com/nmengin))
@@ -4428,7 +4459,7 @@ Same changelog as v2.0.3.
 - **[acme]** Dumpcerts.sh: fixed sed, extracted domain keys ([#2161](https://github.com/traefik/traefik/pull/2161) by [sjawhar](https://github.com/sjawhar))
 - Merge current v1.4 into master  ([#2469](https://github.com/traefik/traefik/pull/2469) by [ldez](https://github.com/ldez))
 - Revert "Merge v1.4.2 into master" ([#2414](https://github.com/traefik/traefik/pull/2414) by [ldez](https://github.com/ldez))
--  Merge v1.4.3 into master ([#2406](https://github.com/traefik/traefik/pull/2406) by [ldez](https://github.com/ldez))
+- Merge v1.4.3 into master ([#2406](https://github.com/traefik/traefik/pull/2406) by [ldez](https://github.com/ldez))
 - Merge v1.4.2 into master ([#2358](https://github.com/traefik/traefik/pull/2358) by [ldez](https://github.com/ldez))
 - Merge v1.4.3 into master ([#2415](https://github.com/traefik/traefik/pull/2415) by [ldez](https://github.com/ldez))
 - Merge v1.4.1 into master  ([#2318](https://github.com/traefik/traefik/pull/2318) by [ldez](https://github.com/ldez))
@@ -5777,7 +5808,7 @@ Same changelog as v2.0.3.
 - Fix k8s watch [\#573](https://github.com/traefik/traefik/pull/573) ([errm](https://github.com/errm))
 - Add requirements.txt for netlify [\#567](https://github.com/traefik/traefik/pull/567) ([emilevauge](https://github.com/emilevauge))
 - Merge v1.0.1 master [\#565](https://github.com/traefik/traefik/pull/565) ([emilevauge](https://github.com/emilevauge))
--  Move webui to FountainJS with Webpack [\#558](https://github.com/traefik/traefik/pull/558) ([micaelmbagira](https://github.com/micaelmbagira))
+- Move webui to FountainJS with Webpack [\#558](https://github.com/traefik/traefik/pull/558) ([micaelmbagira](https://github.com/micaelmbagira))
 - Add global InsecureSkipVerify option to disable certificate checking [\#557](https://github.com/traefik/traefik/pull/557) ([stuart-c](https://github.com/stuart-c))
 - Move version.go in its own package… [\#553](https://github.com/traefik/traefik/pull/553) ([vdemeester](https://github.com/vdemeester))
 - Upgrade libkermit and dependencies [\#552](https://github.com/traefik/traefik/pull/552) ([vdemeester](https://github.com/vdemeester))
@@ -6000,7 +6031,7 @@ Same changelog as v2.0.3.
 - Fix k8s watch [\#573](https://github.com/traefik/traefik/pull/573) ([errm](https://github.com/errm))
 - Add requirements.txt for netlify [\#567](https://github.com/traefik/traefik/pull/567) ([emilevauge](https://github.com/emilevauge))
 - Merge v1.0.1 master [\#565](https://github.com/traefik/traefik/pull/565) ([emilevauge](https://github.com/emilevauge))
--  Move webui to FountainJS with Webpack [\#558](https://github.com/traefik/traefik/pull/558) ([micaelmbagira](https://github.com/micaelmbagira))
+- Move webui to FountainJS with Webpack [\#558](https://github.com/traefik/traefik/pull/558) ([micaelmbagira](https://github.com/micaelmbagira))
 - Add global InsecureSkipVerify option to disable certificate checking [\#557](https://github.com/traefik/traefik/pull/557) ([stuart-c](https://github.com/stuart-c))
 - Move version.go in its own package… [\#553](https://github.com/traefik/traefik/pull/553) ([vdemeester](https://github.com/vdemeester))
 - Upgrade libkermit and dependencies [\#552](https://github.com/traefik/traefik/pull/552) ([vdemeester](https://github.com/vdemeester))
@@ -6162,6 +6193,4 @@ Same changelog as v2.0.3.
 - log info about TOML configuration file using [\#420](https://github.com/traefik/traefik/pull/420) ([cocap10](https://github.com/cocap10))
 - Doc about skipping some integration tests with '-check.f ConsulCatalogSuite' [\#418](https://github.com/traefik/traefik/pull/418) ([samber](https://github.com/samber))
 
-
-
 \* *This Change Log was automatically generated by [gcg](https://github.com/ldez/gcg)*

CODE_OF_CONDUCT.md

@@ -30,18 +30,18 @@ Project maintainers have the right and responsibility to remove, edit, or reject
 
 ## Scope
 
-This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or our community. 
+This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or our community.
 
-Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. 
+Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
 Representation of a project may be further defined and clarified by project maintainers.
 
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at contact@traefik.io
 
-All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. 
+All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances.
 
-The project team is obligated to maintain confidentiality with regard to the reporter of an incident. 
+The project team is obligated to maintain confidentiality with regard to the reporter of an incident.
 
 Further details of specific enforcement policies may be posted separately.
 

CONTRIBUTING.md

@@ -2,8 +2,10 @@
 
 Here are some guidelines that should help to start contributing to the project.
 
-- [Submitting pull Requests](https://github.com/traefik/contributors-guide/blob/master/pr_guidelines.md)
+- [Submitting pull Requests](https://doc.traefik.io/traefik/contributing/submitting-pull-requests/)
 - [Submitting issues](https://doc.traefik.io/traefik/contributing/submitting-issues/)
-- [Submitting security issues](docs/content/contributing/submitting-security-issues.md)
+- [Submitting security issues](https://doc.traefik.io/traefik/contributing/submitting-security-issues/)
+- [Advocating for Traefik](https://doc.traefik.io/traefik/contributing/advocating/)
+- [Triage Process](https://github.com/traefik/contributors-guide/blob/master/issue_triage.md)
 
 If you are willing to become a maintainer of the project, please take a look at the [maintainers guidelines](docs/content/contributing/maintainers-guidelines.md).

Makefile

@@ -14,6 +14,7 @@ TRAEFIK_IMAGE := $(if $(REPONAME),$(REPONAME),"traefik/traefik")
 INTEGRATION_OPTS := $(if $(MAKE_DOCKER_HOST),-e "DOCKER_HOST=$(MAKE_DOCKER_HOST)",-v "/var/run/docker.sock:/var/run/docker.sock")
 DOCKER_BUILD_ARGS := $(if $(DOCKER_VERSION), "--build-arg=DOCKER_VERSION=$(DOCKER_VERSION)",)
 
+# only used when running in docker
 TRAEFIK_ENVS := \
 	-e OS_ARCH_ARG \
 	-e OS_PLATFORM_ARG \
@@ -23,7 +24,7 @@ TRAEFIK_ENVS := \
 	-e CODENAME \
 	-e TESTDIRS \
 	-e CI \
-	-e CONTAINER=DOCKER		# Indicator for integration tests that we are running inside a container.
+	-e IN_DOCKER=true		# Indicator for integration tests that we are running inside a container.
 
 TRAEFIK_MOUNT := -v "$(CURDIR)/dist:/go/src/github.com/traefik/traefik/dist"
 DOCKER_RUN_OPTS := $(TRAEFIK_ENVS) $(TRAEFIK_MOUNT) "$(TRAEFIK_DEV_IMAGE)"
@@ -102,7 +103,7 @@ crossbinary-default-parallel:
 test: build-dev-image
 	-docker network create traefik-test-network --driver bridge --subnet 172.31.42.0/24
 	trap 'docker network rm traefik-test-network' EXIT; \
-	$(if $(IN_DOCKER),$(DOCKER_RUN_TRAEFIK_TEST),) ./script/make.sh generate test-unit binary test-integration
+	$(if $(IN_DOCKER),$(DOCKER_RUN_TRAEFIK_TEST)) ./script/make.sh generate test-unit binary test-integration
 
 ## Run the unit tests
 .PHONY: test-unit
@@ -116,7 +117,7 @@ test-unit: build-dev-image
 test-integration: build-dev-image
 	-docker network create traefik-test-network --driver bridge --subnet 172.31.42.0/24
 	trap 'docker network rm traefik-test-network' EXIT; \
-	$(if $(IN_DOCKER),$(DOCKER_RUN_TRAEFIK_TEST),) ./script/make.sh generate binary test-integration
+	$(if $(IN_DOCKER),$(DOCKER_RUN_TRAEFIK_TEST)) ./script/make.sh generate binary test-integration
 
 ## Pull all images for integration tests
 .PHONY: pull-images

README.md

@@ -10,7 +10,6 @@
 [![Join the community support forum at https://community.traefik.io/](https://img.shields.io/badge/style-register-green.svg?style=social&label=Discourse)](https://community.traefik.io/)
 [![Twitter](https://img.shields.io/twitter/follow/traefik.svg?style=social)](https://twitter.com/intent/follow?screen_name=traefik)
 
-
 Traefik (pronounced _traffic_) is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy.
 Traefik integrates with your existing infrastructure components ([Docker](https://www.docker.com/), [Swarm mode](https://docs.docker.com/engine/swarm/), [Kubernetes](https://kubernetes.io), [Marathon](https://mesosphere.github.io/marathon/), [Consul](https://www.consul.io/), [Etcd](https://coreos.com/etcd/), [Rancher](https://rancher.com), [Amazon ECS](https://aws.amazon.com/ecs), ...) and configures itself automatically and dynamically.
 Pointing Traefik at your orchestrator should be the _only_ configuration step you need.
@@ -65,7 +64,6 @@ _(But if you'd rather configure some of your routes manually, Traefik supports t
 - Exposes a Rest API
 - Packaged as a single binary file (made with :heart: with go) and available as an [official](https://hub.docker.com/r/_/traefik/) docker image
 
-
 ## Supported Backends
 
 - [Docker](https://doc.traefik.io/traefik/providers/docker/) / [Swarm mode](https://doc.traefik.io/traefik/providers/docker/)
@@ -93,6 +91,7 @@ A collection of contributions around Traefik can be found at [https://awesome.tr
 ## Support
 
 To get community support, you can:
+
 - join the Traefik community forum: [![Join the chat at https://community.traefik.io/](https://img.shields.io/badge/style-register-green.svg?style=social&label=Discourse)](https://community.traefik.io/)
 
 If you need commercial support, please contact [Traefik.io](https://traefik.io) by mail: <mailto:support@traefik.io>.
@@ -127,7 +126,6 @@ We are strongly promoting a philosophy of openness and sharing, and firmly stand
 This [document](docs/content/contributing/maintainers-guidelines.md) describes how to be part of the core team as well as various responsibilities and guidelines for Traefik maintainers.
 You can also find more information on our process to review pull requests and manage issues [in this document](docs/content/contributing/maintainers.md).
 
-
 ## Contributing
 
 If you'd like to contribute to the project, refer to the [contributing documentation](CONTRIBUTING.md).

build.Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.17-alpine
+FROM golang:1.19-alpine
 
 RUN apk --no-cache --no-progress add git mercurial bash gcc musl-dev curl tar ca-certificates tzdata \
     && update-ca-certificates \
@@ -13,7 +13,7 @@ RUN mkdir -p /usr/local/bin \
     | tar -xzC /usr/local/bin --transform 's#^.+/##x'
 
 # Download golangci-lint binary to bin folder in $GOPATH
-RUN curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | bash -s -- -b $GOPATH/bin v1.46.2
+RUN curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | bash -s -- -b $GOPATH/bin v1.48.0
 
 # Download misspell binary to bin folder in $GOPATH
 RUN curl -sfL https://raw.githubusercontent.com/client9/misspell/master/install-misspell.sh | bash -s -- -b $GOPATH/bin v0.3.4

docs/content/contributing/advocating.md

@@ -8,8 +8,24 @@ description: "There are many ways to contribute to Traefik Proxy. If you're talk
 Spread the Love & Tell Us about It
 {: .subtitle }
 
-There are many ways to contribute to the project, and there is one that always spark joy: when we see/read about users talking about how Traefik helps them solve their problems.
+Traefik Proxy was started by the community for the community.
+You can contribute to the Traefik community in three main ways: 
 
-If you're talking about Traefik, [let us know](https://traefik.io/submit-my-contribution/) and we'll promote your enthusiasm!
+**Spread the word!** Guides, videos, blog posts, how-to articles, and showing off your network design all help spread the word about Traefik Proxy
+and teach others in the community how to best implement it.
+It always sparks joy when users share how Traefik Proxy helps them solve their problems.
+If you are talking about Traefik Proxy, [let us know](https://traefik.io/submit-my-contribution/) and we will promote your work and reward your enthusiasm!
+If you are giving a talk that includes or is about Traefik Proxy, [let us know](https://traefik.io/submit-my-contribution/) and we will send you swag and stickers for your time at the conference.
+If you have written about Traefik or shared useful information you would like to promote, feel free to add links to the [dedicated wiki page on GitHub](https://github.com/traefik/traefik/wiki/Awesome-Traefik).
 
-Also, if you've written about Traefik or shared useful information you'd like to promote, feel free to add links in the [dedicated wiki page on Github](https://github.com/traefik/traefik/wiki/Awesome-Traefik).
+**Help community members!** Everyone needs a place to share their cool innovations or get help with that pesky bug that only a different pair of eyes seems to be able to see.
+Join our [Community Forum](https://community.traefik.io/) where you can ask questions, help out other users, and share your neat configuration examples or snippets.
+Top contributors will be asked to join the Ambassador program and get unique swag to celebrate!
+
+**Build cool solutions!** Traefik Proxy would be so much better if only it had…
+We love all the wonderful ideas that our users come up with, but we can only build so much.
+Luckily, as an open source community, our users can help by [building awesome features](https://github.com/orgs/traefik/projects/9/views/7), enhancements, or bug fixes.
+We are a big community, so we do need to prioritize a bit.
+That is why we use the tag `contributor/wanted` to let you know which pull requests will make it to the front of the queue for design support and review.
+Feel free to grab one of these and run with it.
+Top contributors get unique swag to celebrate. 

docs/content/contributing/submitting-pull-requests.md

@@ -3,12 +3,228 @@ title: "Traefik Pull Requests Documentation"
 description: "Looking to contribute to Traefik Proxy? This guide will show you the guidelines for submitting a PR in our contributors guide repository."
 ---
 
-# Submitting Pull Requests
+# Before You Submit a Pull Request
 
-A Quick Guide for Efficient Contributions
-{: .subtitle }
+This guide is for contributors who already have a pull request to submit. 
+If you are looking for information on setting up your developer environment 
+and creating code to contribute to Traefik Proxy or related projects, 
+see the [development guide](https://docs.traefik.io/contributing/building-testing/).
 
-So you've decided to improve Traefik? 
-Thank You! 
+Looking for a way to contribute to Traefik Proxy? 
+Check out this list of [Priority Issues](https://github.com/traefik/traefik/labels/contributor%2Fwanted), 
+the [Good First Issue](https://github.com/traefik/traefik/labels/contributor%2Fgood-first-issue) list, 
+or the list of [confirmed bugs](https://github.com/traefik/traefik/labels/kind%2Fbug%2Fconfirmed) waiting to be remedied.
 
-Please review the [guidelines on creating PRs](https://github.com/traefik/contributors-guide/blob/master/pr_guidelines.md) for Traefik in our [contributors guide repository](https://github.com/traefik/contributors-guide).
+## How We Prioritize
+
+We wish we could review every pull request right away. 
+Unfortunately, our team has to prioritize pull requests (PRs) for review 
+(but we are welcoming new [maintainers](https://github.com/traefik/traefik/blob/master/docs/content/contributing/maintainers-guidelines.md) to speed this up, 
+so if you are interested, check it out and apply). 
+
+The PRs we are able to handle fastest are:
+
+* Documentation updates.
+* Bug fixes.
+* Enhancements and Features with a `contributor/wanted` tag.
+
+PRs that take more time to address include:
+
+* Enhancements or Features without the `contributor/wanted` tag.  
+  
+If you have an idea for an enhancement or feature that you would like to build, 
+[create an issue](https://github.com/traefik/traefik/issues/new/choose) for it first 
+and tell us you are interested in writing the PR. 
+If an issue already exists, definitely comment on it to tell us you are interested in creating a PR. 
+
+This will allow us to communicate directly and let you know if it is something we would accept. 
+It also allows us to make sure you have all the information you need during the design phase 
+so that it can be reviewed and merged quickly. 
+  
+If you have questions about the Triage process,
+[read more here](https://github.com/traefik/contributors-guide/blob/master/issue_triage.md).  
+  
+## The Pull Request Submit Process
+
+Merging a PR requires the following steps to be completed before it is merged automatically.
+
+* Make sure your pull request adheres to our best practices. These include:
+    * [Following project conventions](https://github.com/traefik/traefik/blob/master/docs/content/contributing/maintainers-guidelines.md); including using the PR Template.
+    * Make small pull requests.
+    * Solve only one problem at a time.
+    * Comment thoroughly.
+    * Do not open the PR from an organization repository.
+    * Keep "allows edit from maintainer" checked.
+    * Use semantic line breaks for documentation.
+* Pass the validation check.
+* Pass all tests.
+* Receive 3 approving reviews maintainers.
+
+## Pull Request Review Cycle
+
+You can read about our Triage Process [here](https://github.com/traefik/contributors-guide/blob/master/issue_triage.md), 
+but in short, it looks like this:
+
+* We triage every new PR or comment before entering it into the review process.
+    * We ensure that all prerequisites for review have been met.
+    * We check to make sure the use case meets our needs.
+    * We assign reviewers.
+* Design Review.
+    * This takes longer than other parts of the process.
+    * We review that there are no obvious conflicts with our codebase.
+* Code Review.
+    * We review the code in-depth and run tests.
+    * We may ask for changes here.
+    * During code review, we ask that you be reasonably responsive, 
+      if a PR languishes in code review it is at risk of rejection, 
+      or we may take ownership of the PR and the contributor will become a co-author.
+* Merge. 
+    * Success!
+
+!!! note
+
+    Occasionally, we may freeze our codebase when working towards a specific feature or goal that could impact other development. 
+    During this time, your pull request could remain unmerged while the release work is completed.
+
+## Run Local Verifications
+
+You must run these local verifications before you submit your pull request to predict the pass or failure of continuous integration. 
+Your PR will not be reviewed until these are green on the CI.
+
+* `make validate`
+* `make pull-images`
+* `make test`
+
+## The Testing and Merge Workflow
+
+Pull Requests are managed by the bot [Myrmica Lobicornis](https://github.com/traefik/lobicornis). 
+This bot is responsible for verifying GitHub Checks (CI, Tests, etc), mergability, and minimum reviews. 
+In addition, it rebases or merges with the base PR branch if needed. 
+It performs several other housekeeping items 
+and you can read more about those on the [README](https://github.com/traefik/lobicornis) for Lobicornis.
+
+The maintainer giving the final LGTM must add the `status/3-needs-merge` label to trigger the merge bot.
+
+By default, a squash-rebase merge will be carried out.
+
+The status `status/4-merge-in-progress` is only used by the bot.
+
+If the bot is not able to perform the merge, the label `bot/need-human-merge` is added. 
+In such a situation, solve the conflicts/CI/... and then remove the label `bot/need-human-merge`.
+
+To prevent the bot from automatically merging a PR, add the label `bot/no-merge`.
+
+The label `bot/light-review` decreases the number of required LGTM from 3 to 1.
+
+This label can be used when:
+
+* Updating a dependency.
+* Merging branches back into the next version branch.
+* Submitting minor documentation changes.
+* Submitting changelog PRs.
+
+## Why Was My Pull Request Closed?
+
+Traefik Proxy is made by the community for the community, 
+as such the goal is to engage the community to make Traefik the best reverse proxy available. 
+Part of this goal is maintaining a lean codebase and ensuring code velocity. 
+unfortunately, this means that sometimes we will not be able to merge a pull request.
+
+Because we respect the work you did, you will always be told why we are closing your pull request. 
+If you do not agree with our decision, do not worry; closed pull requests are easy to recreate, 
+and little work is lost by closing a pull request that subsequently needs to be reopened.
+
+Your pull request might be closed if:
+
+* Your PR's design conflicts with our existing codebase in such a way that Merging is not an option 
+  and the work needed to make your pull request usable is too high.
+    * To prevent this, make sure you created an issue first
+      and think about including Traefik Proxy maintainers in your design phase to minimize conflicts.
+* Your PR is for an enhancement or feature that we will not use.
+    * Please remember to create an issue for any pull request **before** you create a PR 
+      to ensure that your goal is something we can merge and that you have any design insight you might need from the team.
+* Your PR has been waiting for feedback from the contributor for over 90 days.
+
+## Why is My Pull Request Not Getting Reviewed
+
+A few factors affect how long your pull request might wait for review.
+
+We must prioritize which PRs we focus on. 
+Our first priority is PRs we have identified as having high community engagement and broad applicability. 
+We put our top priorities on our roadmap and you can identify them by the `contributor/wanted` tag. 
+These PRs will enter our review process the fastest. 
+
+Our second priority is bug fixes. 
+Especially for bugs that have already been tagged with `bug/confirmed`. 
+These reviews enter the process quickly.
+
+If your PR does not meet the criteria above, 
+it will take longer for us to review as any PRs that do meet the criteria above will be prioritized. 
+
+Additionally, during the last few weeks of a milestone, we stop reviewing PRs to reduce churn and stabilize. 
+We will resume after the release. 
+
+The second major reason that we deprioritize your PR is that you are not following best practices. 
+
+The most common failures to follow best practices are:
+
+* You did not create an issue for the PR you wish to make. 
+  If you do not create an issue before submitting your PR, 
+  we will not be able to answer any design questions and let you know how likely your PR is to be merged. 
+* You created pull requests that are too large to review.
+    * Break your pull requests up.
+      If you can extract whole ideas from your pull request and send those as pull requests of their own, 
+      you should do that instead. 
+      It is better to have many pull requests addressing one thing than one pull request addressing many things. 
+    * Traefik Proxy is a fast-moving codebase — lock in your changes ASAP with your small pull request, 
+      and make merges be someone else's problem.
+      We want every pull request to be useful on its own, 
+      so use your best judgment on what should be a pull request vs. a commit.
+* You did not comment well.
+    * Comment everything.
+
+Please remember that we are working internationally, cross-culturally, and with different use-cases. 
+Your reviewer will not intuitively understand the problem the same way you do or solve it the same way you would.
+This is why every change you make must be explained and your strategy for coding must also be explained.   
+
+* Your tests were inadequate or absent.
+    * If you do not know how to test your PR, please ask! 
+      We will be happy to help you or suggest appropriate test cases.
+
+If you have already followed the best practices and your PR still has not received a response, 
+here are some things you can do to move the process along:
+
+* If you have fixed all the issues from a review, 
+  remember to re-request a review (using the designated button) to let your reviewer know that you are ready. 
+  You can choose to comment with the changes you made. 
+* Ping `@tfny` if you have not been assigned to a reviewer.
+
+For more information on best practices, try these links:
+
+* [How to Write a Git Commit Message - Chris Beams](https://chris.beams.io/posts/git-commit/)
+* [Distributed Git - Contributing to a Project (Commit Guidelines)](https://git-scm.com/book/en/v2/Distributed-Git-Contributing-to-a-Project)
+* [What’s with the 50/72 rule? - Preslav Rachev](https://preslav.me/2015/02/21/what-s-with-the-50-72-rule/)
+* [A Note About Git Commit Messages - Tim Pope](https://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html)
+
+## It's OK to Push Back
+
+Sometimes reviewers make mistakes. 
+It is OK to push back on changes your reviewer requested. 
+If you have a good reason for doing something a certain way, you are absolutely allowed to debate the merits of a requested change.
+Both the reviewer and reviewee should strive to discuss these issues in a polite and respectful manner.
+
+You might be overruled, but you might also prevail. 
+We are pretty reasonable people.
+
+Another phenomenon of open-source projects (where anyone can comment on any issue) is the dog-pile -
+your pull request gets so many comments from so many people it becomes hard to follow. 
+In this situation, you can ask the primary reviewer (assignee) whether they want you to fork a new pull request 
+to clear out all the comments. 
+You do not have to fix every issue raised by every person who feels like commenting, 
+but you should answer reasonable comments with an explanation.
+
+## Common Sense and Courtesy
+
+No document can take the place of common sense and good taste. 
+Use your best judgment, while you put a bit of thought into how your work can be made easier to review. 
+If you do these things your pull requests will get merged with less friction.

docs/content/contributing/thank-you.md

@@ -8,11 +8,11 @@ description: "Thank you to all those who have contributed! Traefik Proxy is an o
 _You_ Made It
 {: .subtitle}
 
-Traefik truly is an [open-source project](https://github.com/traefik/traefik/),
+Traefik Proxy truly is an [open-source project](https://github.com/traefik/traefik/),
 and wouldn't have become what it is today without the help of our [many contributors](https://github.com/traefik/traefik/graphs/contributors) (at the time of writing this),
-not accounting for people having helped with issues, tests, comments, articles, ... or just enjoying it and letting others know.
+not accounting for people having helped with issues, tests, comments, articles, ... or just enjoy using Traefik Proxy and share with others.
 
-So once again, thank you for your invaluable help on making Traefik such a good product.
+So once again, thank you for your invaluable help in making Traefik such a good product!
 
 !!! question "Where to Go Next?"
     If you want to:

docs/content/deprecation/features.md

@@ -4,9 +4,9 @@ This page is maintained and updated periodically to reflect our roadmap and any
 
 | Feature                                                       | Deprecated | End of Support | Removal |
 |---------------------------------------------------------------|------------|----------------|---------|
-| [Pilot Dashboard (Metrics)](#pilot-dashboard-metrics)         | 2.7        | 2.8            | 2.9     |
-| [Pilot Plugins](#pilot-plugins)                               | 2.7        | 2.8            | 2.9     |
-| [Consul Enterprise Namespaces](#consul-enterprise-namespaces) | 2.8        | TBD            | TBD     |
+| [Pilot Dashboard (Metrics)](#pilot-dashboard-metrics)         | 2.7        | 2.8            | 3.0     |
+| [Pilot Plugins](#pilot-plugins)                               | 2.7        | 2.8            | 3.0     |
+| [Consul Enterprise Namespace](#consul-enterprise-namespace)   | 2.8        | N/A            | 3.0     |
 
 ## Impact
 
@@ -20,7 +20,7 @@ In 2.9, the Pilot platform and all Traefik integration code will be permanently
 Starting on 2.7 the pilot token will not be a requirement anymore.  
 At 2.9, a new plugin catalog home should be available, decoupled from pilot.
 
-### Consul Enterprise Namespaces
+### Consul Enterprise Namespace
 
 Starting on 2.8 the `namespace` option of Consul and Consul Catalog providers is deprecated, 
 please use the `namespaces` options instead.  

docs/content/deprecation/releases.md

@@ -6,7 +6,9 @@ Below is a non-exhaustive list of versions and their maintenance status:
 
 | Version | Release Date | Active Support     | Security Support | 
 |---------|--------------|--------------------|------------------|
-| 2.6     | Jan 24, 2022 |      Yes           |       Yes        |
+| 2.8     | Jun 29, 2022 |      Yes           |       Yes        |
+| 2.7     | May 24, 2022 | Ended Jun 29, 2022 |       No         |
+| 2.6     | Jan 24, 2022 | Ended May 24, 2022 |       No         |
 | 2.5     | Aug 17, 2021 | Ended Jan 24, 2022 |       No         |
 | 2.4     | Jan 19, 2021 | Ended Aug 17, 2021 |       No         |
 | 2.3     | Sep 23, 2020 | Ended Jan 19, 2021 |       No         |

docs/content/getting-started/configuration-overview.md

@@ -93,3 +93,18 @@ All available environment variables can be found [here](../reference/static-conf
 All the configuration options are documented in their related section.
 
 You can browse the available features in the menu, the [providers](../providers/overview.md), or the [routing section](../routing/overview.md) to see them in action.
+
+!!! question "Using Traefik for Business Applications?"
+
+    If you are using Traefik for commercial applications,
+    consider the [Enterprise Edition](https://traefik.io/traefik-enterprise/).
+    You can use it as your:
+
+    - [Kubernetes Ingress Controller](https://traefik.io/solutions/kubernetes-ingress/)
+    - [Load Balancer](https://traefik.io/solutions/docker-swarm-ingress/)
+    - [API Gateway](https://traefik.io/solutions/api-gateway/)
+
+    Traefik Enterprise enables centralized access management,
+    distributed Let's Encrypt,
+    and other advanced capabilities.
+    Learn more in [this 15-minute technical walkthrough](https://info.traefik.io/watch-traefikee-demo).

docs/content/getting-started/install-traefik.md

@@ -179,10 +179,17 @@ And run it:
 
 All the details are available in the [Contributing Guide](../contributing/building-testing.md)
 
-!!! question "Using Traefik for Business?"
+!!! question "Using Traefik for Business Applications?"
 
-    If you're using Traefik for commercial applications, 
-    consider the [Enterprise Edition](https://traefik.io/traefik-enterprise/) of Traefik as your [Kubernetes Ingress](https://traefik.io/solutions/kubernetes-ingress/), 
-    your [Docker Swarm Load Balancer](https://traefik.io/solutions/docker-swarm-ingress/), 
-    or your [API gateway](https://traefik.io/solutions/api-gateway/). 
+    If you are using Traefik for commercial applications,
+    consider the [Enterprise Edition](https://traefik.io/traefik-enterprise/).
+    You can use it as your:
+
+    - [Kubernetes Ingress Controller](https://traefik.io/solutions/kubernetes-ingress/)
+    - [Load Balancer](https://traefik.io/solutions/docker-swarm-ingress/)
+    - [API Gateway](https://traefik.io/solutions/api-gateway/)
+
+    Traefik Enterprise enables centralized access management,
+    distributed Let's Encrypt,
+    and other advanced capabilities.
     Learn more in [this 15-minute technical walkthrough](https://info.traefik.io/watch-traefikee-demo).

docs/content/getting-started/quick-start-with-kubernetes.md

@@ -0,0 +1,317 @@
+---
+title: "Traefik Getting Started With Kubernetes"
+description: "Looking to get started with Traefik Proxy? Read the technical documentation to learn a simple use case that leverages Kubernetes."
+---
+
+# Quick Start
+
+A Simple Use Case of Traefik Proxy and Kubernetes
+{: .subtitle }
+
+This guide is an introduction to using Traefik Proxy in a Kubernetes environment.
+The objective is to learn how to run an application behind a Traefik reverse proxy in Kubernetes.
+It presents and explains the basic blocks required to start with Traefik such as Ingress Controller, Ingresses, Deployments, static, and dynamic configuration.
+
+## Permissions and Accesses
+
+Traefik uses the Kubernetes API to discover running services.
+
+In order to use the Kubernetes API, Traefik needs some permissions.
+This [permission mechanism](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) is based on roles defined by the cluster administrator.
+The role is then bound to an account used by an application, in this case, Traefik Proxy.
+
+The first step is to create the role.
+The [`ClusterRole`](https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1/#ClusterRole) resource enumerates the resources and actions available for the role.
+In a file called `00-role.yml`, put the following `ClusterRole`:
+
+```yaml tab="00-role.yml"
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: traefik-role
+
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - endpoints
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+    resources:
+      - ingresses
+      - ingressclasses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses/status
+    verbs:
+      - update
+```
+
+!!! info "You can find the reference for this file [there](../../reference/dynamic-configuration/kubernetes-crd/#rbac)."
+
+The next step is to create a dedicated service account for Traefik.
+In a file called `00-account.yml`, put the following [`ServiceAccount`](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/service-account-v1/#ServiceAccount) resource:
+
+```yaml tab="00-account.yml"
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: traefik-account
+```
+
+And then, bind the role on the account to apply the permissions and rules on the latter. In a file called `01-role-binding.yml`, put the
+following [`ClusterRoleBinding`](https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-binding-v1/#ClusterRoleBinding) resource:
+
+```yaml tab="01-role-binding.yml"
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: traefik-role-binding
+
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik-role
+subjects:
+  - kind: ServiceAccount
+    name: traefik-account
+    namespace: default # Using "default" because we did not specify a namespace when creating the ClusterAccount.
+```
+
+!!! info "`roleRef` is the Kubernetes reference to the role created in `00-role.yml`."
+
+!!! info "`subjects` is the list of accounts reference."
+
+    In this guide, it only contains the account created in `00-account.yml`
+
+## Deployment and Exposition
+
+!!! info "This section can be managed with the help of the [Traefik Helm chart](../install-traefik/#use-the-helm-chart)."
+
+The [ingress controller](https://traefik.io/glossary/kubernetes-ingress-and-ingress-controller-101/#what-is-a-kubernetes-ingress-controller)
+is a software that runs in the same way as any other application on a cluster.
+To start Traefik on the Kubernetes cluster,
+a [`Deployment`](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/deployment-v1/) resource must exist to describe how to configure
+and scale containers horizontally to support larger workloads.
+
+Start by creating a file called `02-traefik.yml` and paste the following `Deployment` resource:
+
+```yaml tab="02-traefik.yml"
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: traefik-deployment
+  labels:
+    app: traefik
+
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: traefik
+  template:
+    metadata:
+      labels:
+        app: traefik
+    spec:
+      serviceAccountName: traefik-account
+      containers:
+        - name: traefik
+          image: traefik:v2.8
+          args:
+            - --api.insecure
+            - --providers.kubernetesingress
+          ports:
+            - name: web
+              containerPort: 80
+            - name: dashboard
+              containerPort: 8080
+```
+
+The deployment contains an important attribute for customizing Traefik: `args`.
+These arguments are the static configuration for Traefik.
+From here, it is possible to enable the dashboard,
+configure entry points,
+select dynamic configuration providers,
+and [more](../reference/static-configuration/cli.md)...
+
+In this deployment,
+the static configuration enables the Traefik dashboard,
+and uses Kubernetes native Ingress resources as router definitions to route incoming requests.
+
+!!! info "When there is no entry point in the static configuration"
+
+    Traefik creates a default one called `web` using the port `80` routing HTTP requests.
+
+!!! info "When enabling the [`api.insecure`](../../operations/api/#insecure) mode, Traefik exposes the dashboard on the port `8080`."
+
+A deployment manages scaling and then can create lots of containers, called [Pods](https://kubernetes.io/docs/concepts/workloads/pods/).
+Each Pod is configured following the `spec` field in the deployment.
+Given that, a Deployment can run multiple Traefik Proxy Pods,
+a piece is required to forward the traffic to any of the instance:
+namely a [`Service`](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/#Service).
+Create a file called `02-traefik-services.yml` and insert the two `Service` resources:
+
+```yaml tab="02-traefik-services.yml"
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik-dashboard-service
+
+spec:
+  type: LoadBalancer
+  ports:
+    - port: 8080
+      targetPort: dashboard
+  selector:
+    app: traefik
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik-web-service
+
+spec:
+  type: LoadBalancer
+  ports:
+    - targetPort: web
+      port: 80
+  selector:
+    app: traefik
+```
+
+!!! warning "It is possible to expose a service in different ways."
+
+    Depending on your working environment and use case, the `spec.type` might change.
+    It is strongly recommended to understand the available [service types](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) before proceeding to the next step.
+
+It is now time to apply those files on your cluster to start Traefik.
+
+```shell
+kubectl apply -f 00-role.yml \
+              -f 00-account.yml \
+              -f 01-role-binding.yml \
+              -f 02-traefik.yml \
+              -f 02-traefik-services.yml
+```
+
+## Proxying applications
+
+The only part still missing is the business application behind the reverse proxy.
+For this guide, we use the example application [traefik/whoami](https://github.com/traefik/whoami),
+but the principles are applicable to any other application.
+
+The `whoami` application is a simple HTTP server running on port 80 which answers host-related information to the incoming requests.
+As usual, start by creating a file called `03-whoami.yml` and paste the following `Deployment` resource:
+
+```yaml tab="03-whoami.yml"
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: whoami
+  labels:
+    app: whoami
+
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: whoami
+  template:
+    metadata:
+      labels:
+        app: whoami
+    spec:
+      containers:
+        - name: whoami
+          image: traefik/whoami
+          ports:
+            - name: web
+              containerPort: 80
+```
+
+And continue by creating the following `Service` resource in a file called `03-whoami-services.yml`:
+
+```yaml tab="03-whoami-services.yml"
+apiVersion: v1
+kind: Service
+metadata:
+  name: whoami
+
+spec:
+  ports:
+    - name: web
+      port: 80
+      targetPort: web
+      
+  selector:
+    app: whoami
+```
+
+Thanks to the Kubernetes API,
+Traefik is notified when an Ingress resource is created, updated, or deleted.
+This makes the process dynamic.
+The ingresses are, in a way, the [dynamic configuration](../../providers/kubernetes-ingress/) for Traefik.
+
+!!! tip
+
+    Find more information on [ingress controller](https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/),
+    and [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) in the official Kubernetes documentation.
+
+Create a file called `04-whoami-ingress.yml` and insert the `Ingress` resource:
+
+```yaml tab="04-whoami-ingress.yml"
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: whoami-ingress
+spec:
+  rules:
+  - http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: whoami
+            port:
+              name: web
+```
+
+This `Ingress` configures Traefik to redirect any incoming requests starting with `/` to the `whoami:80` service.
+
+At this point, all the configurations are ready.
+It is time to apply those new files:
+
+```shell
+kubectl apply -f 03-whoami.yml \
+              -f 03-whoami-services.yml \
+              -f 04-whoami-ingress.yml
+```
+
+Now you should be able to access the `whoami` application and the Traefik dashboard.
+Load the dashboard on a web browser: [`http://localhost:8080`](http://localhost:8080).
+
+And now access the `whoami` application:
+
+```shell
+curl -v http://localhost/
+```
+
+!!! question "Going further"
+
+    - [Filter the ingresses](../providers/kubernetes-ingress.md#ingressclass) to use with [IngressClass](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class)
+    - Use [IngressRoute CRD](../providers/kubernetes-crd.md)
+    - Protect [ingresses with TLS](../routing/providers/kubernetes-ingress.md#enabling-tls-via-annotations)

docs/content/getting-started/quick-start.md

@@ -113,4 +113,20 @@ IP: 172.27.0.4
 ```
 
 !!! question "Where to Go Next?"
+
     Now that you have a basic understanding of how Traefik can automatically create the routes to your services and load balance them, it is time to dive into [the documentation](/) and let Traefik work for you!
+
+!!! question "Using Traefik for Business Applications?"
+
+    If you are using Traefik for commercial applications,
+    consider the [Enterprise Edition](https://traefik.io/traefik-enterprise/).
+    You can use it as your:
+
+    - [Kubernetes Ingress Controller](https://traefik.io/solutions/kubernetes-ingress/)
+    - [Load Balancer](https://traefik.io/solutions/docker-swarm-ingress/)
+    - [API Gateway](https://traefik.io/solutions/api-gateway/)
+
+    Traefik Enterprise enables centralized access management,
+    distributed Let's Encrypt,
+    and other advanced capabilities.
+    Learn more in [this 15-minute technical walkthrough](https://info.traefik.io/watch-traefikee-demo).

docs/content/https/acme.md

@@ -666,3 +666,18 @@ If Let's Encrypt is not reachable, the following certificates will apply:
 
 !!! important
     For new (sub)domains which need Let's Encrypt authentication, the default Traefik certificate will be used until Traefik is restarted.
+    
+!!! question "Using Traefik for Business Applications?"
+
+    If you are using Traefik for commercial applications,
+    consider the [Enterprise Edition](https://traefik.io/traefik-enterprise/).
+    You can use it as your:
+
+    - [Kubernetes Ingress Controller](https://traefik.io/solutions/kubernetes-ingress/)
+    - [Load Balancer](https://traefik.io/solutions/docker-swarm-ingress/)
+    - [API Gateway](https://traefik.io/solutions/api-gateway/)
+
+    Traefik Enterprise enables centralized access management,
+    distributed Let's Encrypt,
+    and other advanced capabilities.
+    Learn more in [this 15-minute technical walkthrough](https://info.traefik.io/watch-traefikee-demo).

docs/content/https/tls.md

@@ -396,39 +396,6 @@ spec:
   sniStrict: true
 ```
 
-### Prefer Server Cipher Suites
-
-This option allows the server to choose its most preferred cipher suite instead of the client's.
-Please note that this is enabled automatically when `minVersion` or `maxVersion` are set.
-
-```yaml tab="File (YAML)"
-# Dynamic configuration
-
-tls:
-  options:
-    default:
-      preferServerCipherSuites: true
-```
-
-```toml tab="File (TOML)"
-# Dynamic configuration
-
-[tls.options]
-  [tls.options.default]
-    preferServerCipherSuites = true
-```
-
-```yaml tab="Kubernetes"
-apiVersion: traefik.containo.us/v1alpha1
-kind: TLSOption
-metadata:
-  name: default
-  namespace: default
-
-spec:
-  preferServerCipherSuites: true
-```
-
 ### ALPN Protocols
 
 _Optional, Default="h2, http/1.1, acme-tls/1"_

docs/content/middlewares/http/redirectscheme.md

@@ -13,7 +13,6 @@ TODO: add schema
 -->
 
 The RedirectScheme middleware redirects the request if the request scheme is different from the configured scheme.
-The middleware does not work for websocket requests. 
 
 !!! warning "When behind another reverse-proxy"
 

docs/content/migration/v2.md

@@ -473,3 +473,10 @@ In `v2.8`, the `namespace` option of Consul and Consul Catalog providers is depr
 
 In `v2.8`, the `pilot.token` and `pilot.dashboard` options are deprecated.
 Please check our Blog for migration instructions later this year.
+
+## v2.8.2
+
+Since `v2.5.0`, the `PreferServerCipherSuites` is [deprecated and ignored](https://tip.golang.org/doc/go1.17#crypto/tls) by Go,
+in `v2.8.2` the `preferServerCipherSuites` option is also deprecated and ignored in Traefik.
+
+In `v2.8.2`, Traefik now reject certificates signed with the SHA-1 hash function. ([details](https://tip.golang.org/doc/go1.18#sha1))

docs/content/plugins/index.md

@@ -1,54 +1,32 @@
 ---
 title: "Traefik Plugins Documentation"
-description: "Learn how to connect Traefik Proxy with Pilot, a SaaS platform that offers features for metrics, alerts, and plugins. Read the technical documentation."
+description: "Learn how to use Traefik Plugins. Read the technical documentation."
 ---
 
-# Plugins and Traefik Pilot
+# Traefik Plugins and the Plugin Catalog
 
-Traefik Pilot is a software-as-a-service (SaaS) platform that connects to Traefik to extend its capabilities.
-It offers a number of features to enhance observability and control of Traefik through a global control plane and dashboard, including:
+Plugins are a powerful feature for extending Traefik with custom features and behaviors.
+The [Plugin Catalog](https://plugins.traefik.io/) is a software-as-a-service (SaaS) platform that provides an exhaustive list of the existing plugins.
 
-* Metrics for network activity of Traefik proxies and groups of proxies
-* Alerts for service health issues and security vulnerabilities
-* Plugins that extend the functionality of Traefik
+??? note "Plugin Catalog Access"
+    You can reach the [Plugin Catalog](https://plugins.traefik.io/) from the Traefik Dashboard using the `Plugins` menu entry.
 
-!!! important "Learn More About Traefik Pilot"
-    This section is intended only as a brief overview for Traefik users who are not familiar with Traefik Pilot. 
-    To explore all that Traefik Pilot has to offer, please consult the [Traefik Pilot Documentation](https://doc.traefik.io/traefik-pilot/)
+To add a new plugin to a Traefik instance, you must change that instance's static configuration.
+Each plugin's **Install** section provides a static configuration example.
+Many plugins have their own section in the Traefik dynamic configuration.
 
-!!! Note "Prerequisites"
-    Traefik Pilot is compatible with Traefik Proxy 2.3 or later.
-
-## Connecting to Traefik Pilot
-
-To connect your Traefik proxies to Traefik Pilot, login or create an account at the [Traefik Pilot homepage](https://pilot.traefik.io) and choose **Register New Traefik Instance**.
-
-To complete the connection, Traefik Pilot will issue a token that must be added to your Traefik static configuration, according to the instructions provided by the Traefik Pilot dashboard.
-For more information, consult the [Quick Start Guide](https://doc.traefik.io/traefik-pilot/connecting/)
-
-Health and security alerts for registered Traefik instances can be enabled from the Preferences in your [Traefik Pilot Profile](https://pilot.traefik.io/profile).
-
-## Plugins
-
-Plugins are available to any Traefik proxies that are connected to Traefik Pilot.
-They are a powerful feature for extending Traefik with custom features and behaviors.
-
-You can browse community-contributed plugins from the catalog in the [Traefik Pilot Dashboard](https://pilot.traefik.io/plugins).
-
-To add a new plugin to a Traefik instance, you must modify that instance's static configuration.
-The code to be added is provided for you when you choose **Install the Plugin** from the Traefik Pilot dashboard.
-To learn more about Traefik plugins, consult the [documentation](https://doc.traefik.io/traefik-pilot/plugins/overview/).
+To learn more about Traefik plugins, consult the [documentation](https://plugins.traefik.io/install).
 
 !!! danger "Experimental Features"
-    Plugins can potentially modify the behavior of Traefik in unforeseen ways.
+    Plugins can change the behavior of Traefik in unforeseen ways.
     Exercise caution when adding new plugins to production Traefik instances.
 
 ## Build Your Own Plugins
 
-Traefik users can create their own plugins and contribute them to the Traefik Pilot catalog to share them with the community.
+Traefik users can create their own plugins and share them with the community using the Plugin Catalog.
 
-Traefik plugins are loaded dynamically. 
+Traefik will load plugins dynamically.
 They need not be compiled, and no complex toolchain is necessary to build them. 
 The experience of implementing a Traefik plugin is comparable to writing a web browser extension.
 
-To learn more and see code for example Traefik plugins, please see the [developer documentation](https://doc.traefik.io/traefik-pilot/plugins/plugin-dev/).
+To learn more about Traefik plugin creation, please refer to the [developer documentation](https://plugins.traefik.io/create).

docs/content/providers/docker.md

@@ -714,3 +714,18 @@ providers:
 ```bash tab="CLI"
 --providers.docker.tls.insecureSkipVerify=true
 ```
+
+!!! question "Using Traefik for Business Applications?"
+
+    If you are using Traefik for commercial applications,
+    consider the [Enterprise Edition](https://traefik.io/traefik-enterprise/).
+    You can use it as your:
+
+    - [Kubernetes Ingress Controller](https://traefik.io/solutions/kubernetes-ingress/)
+    - [Load Balancer](https://traefik.io/solutions/docker-swarm-ingress/)
+    - [API Gateway](https://traefik.io/solutions/api-gateway/)
+
+    Traefik Enterprise enables centralized access management,
+    distributed Let's Encrypt,
+    and other advanced capabilities.
+    Learn more in [this 15-minute technical walkthrough](https://info.traefik.io/watch-traefikee-demo).

docs/content/providers/kubernetes-crd.md

@@ -160,7 +160,7 @@ providers:
 _Optional, Default: []_
 
 Array of namespaces to watch.
-If left empty, watches all namespaces if the value of `namespaces`.
+If left empty, Traefik watches all namespaces.
 
 ```yaml tab="File (YAML)"
 providers:

docs/content/providers/kubernetes-gateway.md

@@ -193,7 +193,7 @@ providers:
 _Optional, Default: []_
 
 Array of namespaces to watch.
-If left empty, watches all namespaces if the value of `namespaces`.
+If left empty, Traefik watches all namespaces.
 
 ```yaml tab="File (YAML)"
 providers:

docs/content/providers/kubernetes-ingress.md

@@ -201,7 +201,7 @@ providers:
 _Optional, Default: []_
 
 Array of namespaces to watch.
-If left empty, watches all namespaces if the value of `namespaces`.
+If left empty, Traefik watches all namespaces.
 
 ```yaml tab="File (YAML)"
 providers:
@@ -501,3 +501,18 @@ providers:
 
 To learn more about the various aspects of the Ingress specification that Traefik supports,
 many examples of Ingresses definitions are located in the test [examples](https://github.com/traefik/traefik/tree/v2.8/pkg/provider/kubernetes/ingress/fixtures) of the Traefik repository.
+
+!!! question "Using Traefik for Business Applications?"
+
+    If you are using Traefik for commercial applications,
+    consider the [Enterprise Edition](https://traefik.io/traefik-enterprise/).
+    You can use it as your:
+
+    - [Kubernetes Ingress Controller](https://traefik.io/solutions/kubernetes-ingress/)
+    - [Load Balancer](https://traefik.io/solutions/docker-swarm-ingress/)
+    - [API Gateway](https://traefik.io/solutions/api-gateway/)
+
+    Traefik Enterprise enables centralized access management,
+    distributed Let's Encrypt,
+    and other advanced capabilities.
+    Learn more in [this 15-minute technical walkthrough](https://info.traefik.io/watch-traefikee-demo).

docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml

@@ -1783,9 +1783,10 @@ spec:
                   VersionTLS13. Default: VersionTLS10.'
                 type: string
               preferServerCipherSuites:
-                description: PreferServerCipherSuites defines whether the server chooses
-                  a cipher suite among his own instead of among the client's. It is
-                  enabled automatically when minVersion or maxVersion are set.
+                description: 'PreferServerCipherSuites defines whether the server
+                  chooses a cipher suite among his own instead of among the client''s.
+                  It is enabled automatically when minVersion or maxVersion is set.
+                  Deprecated: https://github.com/golang/go/issues/45430'
                 type: boolean
               sniStrict:
                 description: SniStrict defines whether Traefik allows connections
@@ -1904,8 +1905,8 @@ spec:
     schema:
       openAPIV3Schema:
         description: 'TraefikService is the CRD implementation of a Traefik Service.
-          TraefikService object allows to:  - Apply weight to Services on load-balancing  -
-          Mirror traffic on services More info: https://doc.traefik.io/traefik/v2.8/routing/providers/kubernetes-crd/#kind-traefikservice'
+          TraefikService object allows to: - Apply weight to Services on load-balancing
+          - Mirror traffic on services More info: https://doc.traefik.io/traefik/v2.8/routing/providers/kubernetes-crd/#kind-traefikservice'
         properties:
           apiVersion:
             description: 'APIVersion defines the versioned schema of this representation

docs/content/reference/dynamic-configuration/traefik.containo.us_tlsoptions.yaml

@@ -89,9 +89,10 @@ spec:
                   VersionTLS13. Default: VersionTLS10.'
                 type: string
               preferServerCipherSuites:
-                description: PreferServerCipherSuites defines whether the server chooses
-                  a cipher suite among his own instead of among the client's. It is
-                  enabled automatically when minVersion or maxVersion are set.
+                description: 'PreferServerCipherSuites defines whether the server
+                  chooses a cipher suite among his own instead of among the client''s.
+                  It is enabled automatically when minVersion or maxVersion is set.
+                  Deprecated: https://github.com/golang/go/issues/45430'
                 type: boolean
               sniStrict:
                 description: SniStrict defines whether Traefik allows connections

docs/content/reference/dynamic-configuration/traefik.containo.us_traefikservices.yaml

@@ -20,8 +20,8 @@ spec:
     schema:
       openAPIV3Schema:
         description: 'TraefikService is the CRD implementation of a Traefik Service.
-          TraefikService object allows to:  - Apply weight to Services on load-balancing  -
-          Mirror traffic on services More info: https://doc.traefik.io/traefik/v2.8/routing/providers/kubernetes-crd/#kind-traefikservice'
+          TraefikService object allows to: - Apply weight to Services on load-balancing
+          - Mirror traffic on services More info: https://doc.traefik.io/traefik/v2.8/routing/providers/kubernetes-crd/#kind-traefikservice'
         properties:
           apiVersion:
             description: 'APIVersion defines the versioned schema of this representation

docs/content/routing/entrypoints.md

@@ -967,3 +967,18 @@ entryPoints:
 entrypoints.foo.address=:8000/udp
 entrypoints.foo.udp.timeout=10s
 ```
+
+!!! question "Using Traefik for Business Applications?"
+
+    If you are using Traefik for commercial applications,
+    consider the [Enterprise Edition](https://traefik.io/traefik-enterprise/).
+    You can use it as your:
+
+    - [Kubernetes Ingress Controller](https://traefik.io/solutions/kubernetes-ingress/)
+    - [Load Balancer](https://traefik.io/solutions/docker-swarm-ingress/)
+    - [API Gateway](https://traefik.io/solutions/api-gateway/)
+
+    Traefik Enterprise enables centralized access management,
+    distributed Let's Encrypt,
+    and other advanced capabilities.
+    Learn more in [this 15-minute technical walkthrough](https://info.traefik.io/watch-traefikee-demo).

docs/content/routing/routers/index.md

@@ -1321,3 +1321,18 @@ There must be one (and only one) UDP [service](../services/index.md) referenced
 Services are the target for the router.
 
 !!! important "UDP routers can only target UDP services (and not HTTP or TCP services)."
+
+!!! question "Using Traefik for Business Applications?"
+
+    If you are using Traefik for commercial applications,
+    consider the [Enterprise Edition](https://traefik.io/traefik-enterprise/).
+    You can use it as your:
+
+    - [Kubernetes Ingress Controller](https://traefik.io/solutions/kubernetes-ingress/)
+    - [Load Balancer](https://traefik.io/solutions/docker-swarm-ingress/)
+    - [API Gateway](https://traefik.io/solutions/api-gateway/)
+
+    Traefik Enterprise enables centralized access management,
+    distributed Let's Encrypt,
+    and other advanced capabilities.
+    Learn more in [this 15-minute technical walkthrough](https://info.traefik.io/watch-traefikee-demo).

docs/content/routing/services/index.md

@@ -1645,3 +1645,18 @@ udp:
       [[udp.services.appv2.loadBalancer.servers]]
         address = "private-ip-server-2:8080/"
 ```
+
+!!! question "Using Traefik for Business Applications?"
+
+    If you are using Traefik for commercial applications,
+    consider the [Enterprise Edition](https://traefik.io/traefik-enterprise/).
+    You can use it as your:
+
+    - [Kubernetes Ingress Controller](https://traefik.io/solutions/kubernetes-ingress/)
+    - [Load Balancer](https://traefik.io/solutions/docker-swarm-ingress/)
+    - [API Gateway](https://traefik.io/solutions/api-gateway/)
+
+    Traefik Enterprise enables centralized access management,
+    distributed Let's Encrypt,
+    and other advanced capabilities.
+    Learn more in [this 15-minute technical walkthrough](https://info.traefik.io/watch-traefikee-demo).

docs/mkdocs.yml

@@ -66,7 +66,9 @@ nav:
   - 'Welcome': 'index.md'
   - 'Getting Started':
       - 'Concepts' : 'getting-started/concepts.md'
-      - 'Quick Start': 'getting-started/quick-start.md'
+      - 'Quick Start':
+          - 'Docker': 'getting-started/quick-start.md'
+          - 'Kubernetes': 'getting-started/quick-start-with-kubernetes.md'
       - 'Configuration Introduction': 'getting-started/configuration-overview.md'
       - 'Install Traefik': 'getting-started/install-traefik.md'
       - 'Frequently Asked Questions': 'getting-started/faq.md'
@@ -138,7 +140,7 @@ nav:
         - 'InFlightConn': 'middlewares/tcp/inflightconn.md'
         - 'IpWhitelist': 'middlewares/tcp/ipwhitelist.md'
   - 'Traefik Hub': 'traefik-hub/index.md'
-  - 'Plugins & Traefik Pilot': 'plugins/index.md'
+  - 'Plugins & Plugin Catalog': 'plugins/index.md'
   - 'Operations':
       - 'CLI': 'operations/cli.md'
       - 'Dashboard' : 'operations/dashboard.md'

docs/readme.md

@@ -8,7 +8,6 @@
 | mkdocs-material   | [documentation][mkdocs-material]    | [Sources][mkdocs-material-src]    |
 | pymdown-extensions| [documentation][pymdown-extensions] | [Sources][pymdown-extensions-src] |
 
-
 [mkdocs]: https://www.mkdocs.org "Mkdocs"
 [mkdocs-src]: https://github.com/mkdocs/mkdocs "Mkdocs - Sources"
 

docs/scripts/netlify-run.sh

@@ -1,16 +0,0 @@
-#!/bin/bash
-#
-# This script is run in netlify environment to build and validate
-# the website for documentation
-
-CURRENT_DIR="$(cd "$(dirname "${0}")" && pwd -P)"
-
-#### Build website
-# Provide the URL for this deployment to Mkdocs
-echo "${DEPLOY_PRIME_URL}" > "${CURRENT_DIR}/../CNAME"
-sed -i "s#site_url:.*#site_url: ${DEPLOY_PRIME_URL}#" "${CURRENT_DIR}/../mkdocs.yml"
-
-# Build
-mkdocs build
-
-exit 0

exp.Dockerfile

@@ -12,7 +12,7 @@ RUN yarn install
 RUN yarn build
 
 # BUILD
-FROM golang:1.17-alpine as gobuild
+FROM golang:1.19-alpine as gobuild
 
 RUN apk --no-cache --no-progress add git mercurial bash gcc musl-dev curl tar ca-certificates tzdata \
     && update-ca-certificates \

go.mod

@@ -1,13 +1,13 @@
 module github.com/traefik/traefik/v2
 
-go 1.17
+go 1.19
 
 require (
-	github.com/BurntSushi/toml v1.0.0
+	github.com/BurntSushi/toml v1.1.0
 	github.com/ExpediaDotCom/haystack-client-go v0.0.0-20190315171017-e7edbdf53a61
 	github.com/Masterminds/sprig/v3 v3.2.2
 	github.com/abbot/go-http-auth v0.0.0-00010101000000-000000000000
-	github.com/aws/aws-sdk-go v1.39.0
+	github.com/aws/aws-sdk-go v1.44.47
 	github.com/cenkalti/backoff/v4 v4.1.1
 	github.com/compose-spec/compose-go v1.0.3
 	github.com/containous/alice v0.0.0-20181107144136-d83ebdd94cbd
@@ -36,8 +36,8 @@ require (
 	github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d
 	github.com/instana/go-sensor v1.38.3
 	github.com/klauspost/compress v1.14.2
-	github.com/kvtools/valkeyrie v0.4.0
-	github.com/lucas-clemente/quic-go v0.27.0
+	github.com/kvtools/valkeyrie v0.4.2-0.20220810161836-a9a70ee3f199
+	github.com/lucas-clemente/quic-go v0.28.1
 	github.com/mailgun/ttlmap v0.0.0-20170619185759-c1c17f74874f
 	github.com/miekg/dns v1.1.47
 	github.com/mitchellh/copystructure v1.0.0
@@ -49,14 +49,14 @@ require (
 	github.com/patrickmn/go-cache v2.1.0+incompatible
 	github.com/pires/go-proxyproto v0.6.1
 	github.com/pmezard/go-difflib v1.0.0
-	github.com/prometheus/client_golang v1.11.0
+	github.com/prometheus/client_golang v1.12.2-0.20220704083116-e8f91604d835
 	github.com/prometheus/client_model v0.2.0
 	github.com/rancher/go-rancher-metadata v0.0.0-20200311180630-7f4c936a06ac
 	github.com/sirupsen/logrus v1.8.1
-	github.com/stretchr/testify v1.7.1
+	github.com/stretchr/testify v1.8.0
 	github.com/stvp/go-udp-testing v0.0.0-20191102171040-06b61409b154
-	github.com/traefik/paerser v0.1.5
-	github.com/traefik/yaegi v0.13.0
+	github.com/traefik/paerser v0.1.6
+	github.com/traefik/yaegi v0.14.1
 	github.com/uber/jaeger-client-go v2.30.0+incompatible
 	github.com/uber/jaeger-lib v2.2.0+incompatible
 	github.com/unrolled/render v1.0.2
@@ -67,13 +67,14 @@ require (
 	go.elastic.co/apm v1.13.1
 	go.elastic.co/apm/module/apmot v1.13.1
 	golang.org/x/mod v0.4.2
-	golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4
+	golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e
+	golang.org/x/text v0.3.7
 	golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11
 	golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2
 	google.golang.org/grpc v1.38.0
 	gopkg.in/DataDog/dd-trace-go.v1 v1.38.1
 	gopkg.in/fsnotify.v1 v1.4.7
-	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
+	gopkg.in/yaml.v3 v3.0.1
 	k8s.io/api v0.22.1
 	k8s.io/apiextensions-apiserver v0.21.3
 	k8s.io/apimachinery v0.22.1
@@ -134,6 +135,7 @@ require (
 	github.com/cpu/goacmedns v0.1.1 // indirect
 	github.com/deepmap/oapi-codegen v1.8.2 // indirect
 	github.com/dgraph-io/ristretto v0.1.0 // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
 	github.com/distribution/distribution/v3 v3.0.0-20210316161203-a01c71e2477e // indirect
 	github.com/dnsimple/dnsimple-go v0.70.1 // indirect
@@ -155,8 +157,9 @@ require (
 	github.com/fsnotify/fsnotify v1.5.1 // indirect
 	github.com/fvbommel/sortorder v1.0.1 // indirect
 	github.com/go-errors/errors v1.0.1 // indirect
-	github.com/go-logfmt/logfmt v0.5.0 // indirect
+	github.com/go-logfmt/logfmt v0.5.1 // indirect
 	github.com/go-logr/logr v0.4.0 // indirect
+	github.com/go-redis/redis/v8 v8.11.5 // indirect
 	github.com/go-resty/resty/v2 v2.1.1-0.20191201195748-d7b97669fe48 // indirect
 	github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect
 	github.com/go-zookeeper/zk v1.0.2 // indirect
@@ -227,8 +230,9 @@ require (
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/marten-seemann/qpack v0.2.1 // indirect
 	github.com/marten-seemann/qtls-go1-16 v0.1.5 // indirect
-	github.com/marten-seemann/qtls-go1-17 v0.1.1 // indirect
-	github.com/marten-seemann/qtls-go1-18 v0.1.1 // indirect
+	github.com/marten-seemann/qtls-go1-17 v0.1.2 // indirect
+	github.com/marten-seemann/qtls-go1-18 v0.1.2 // indirect
+	github.com/marten-seemann/qtls-go1-19 v0.1.0-beta.1 // indirect
 	github.com/mattn/go-colorable v0.1.11 // indirect
 	github.com/mattn/go-isatty v0.0.14 // indirect
 	github.com/mattn/go-shellwords v1.0.12 // indirect
@@ -256,7 +260,7 @@ require (
 	github.com/nrdcg/namesilo v0.2.1 // indirect
 	github.com/nrdcg/porkbun v0.1.1 // indirect
 	github.com/nxadm/tail v1.4.8 // indirect
-	github.com/onsi/ginkgo v1.16.4 // indirect
+	github.com/onsi/ginkgo v1.16.5 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
 	github.com/opencontainers/runc v1.0.2 // indirect
@@ -266,8 +270,8 @@ require (
 	github.com/philhofer/fwd v1.1.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pquerna/otp v1.3.0 // indirect
-	github.com/prometheus/common v0.26.0 // indirect
-	github.com/prometheus/procfs v0.6.0 // indirect
+	github.com/prometheus/common v0.35.0 // indirect
+	github.com/prometheus/procfs v0.7.3 // indirect
 	github.com/sacloud/libsacloud v1.36.2 // indirect
 	github.com/sanathkr/go-yaml v0.0.0-20170819195128-ed9d249f429b // indirect
 	github.com/santhosh-tekuri/jsonschema v1.2.4 // indirect
@@ -281,7 +285,7 @@ require (
 	github.com/spf13/cast v1.3.1 // indirect
 	github.com/spf13/cobra v1.2.1 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/stretchr/objx v0.3.0 // indirect
+	github.com/stretchr/objx v0.4.0 // indirect
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.287 // indirect
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/dnspod v1.0.287 // indirect
 	github.com/theupdateframework/notary v0.6.1 // indirect
@@ -297,9 +301,9 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	go.elastic.co/apm/module/apmhttp v1.13.1 // indirect
 	go.elastic.co/fastjson v1.1.0 // indirect
-	go.etcd.io/etcd/api/v3 v3.5.0 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.5.0 // indirect
-	go.etcd.io/etcd/client/v3 v3.5.0 // indirect
+	go.etcd.io/etcd/api/v3 v3.5.4 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.5.4 // indirect
+	go.etcd.io/etcd/client/v3 v3.5.4 // indirect
 	go.opencensus.io v0.23.0 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
@@ -307,20 +311,18 @@ require (
 	go.uber.org/zap v1.18.1 // indirect
 	golang.org/x/crypto v0.0.0-20220427172511-eb4f295cb31f // indirect
 	golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 // indirect
-	golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602 // indirect
+	golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/sys v0.0.0-20220307203707-22a9840ba4d7 // indirect
+	golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e // indirect
 	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
-	golang.org/x/text v0.3.7 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 	google.golang.org/api v0.44.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.62.0 // indirect
 	gopkg.in/ns1/ns1-go.v2 v2.6.2 // indirect
-	gopkg.in/redis.v5 v5.2.9 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect

go.sum

@@ -55,7 +55,6 @@ github.com/AlecAivazis/survey/v2 v2.2.3 h1:utJR2X4Ibp2fBxdjalQUiMFf3zfQNjA15YE8+
 github.com/AlecAivazis/survey/v2 v2.2.3/go.mod h1:9FJRdMdDm8rnT+zHVbvQT2RTSTLq0Ttd6q3Vl2fahjk=
 github.com/Azure/azure-sdk-for-go v16.2.1+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-sdk-for-go v19.1.1+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
-github.com/Azure/azure-sdk-for-go v32.4.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-sdk-for-go v40.3.0+incompatible h1:NthZg3psrLxvQLN6rVm07pZ9mv2wvGNaBNGQ3fnPvLE=
 github.com/Azure/azure-sdk-for-go v40.3.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
@@ -114,8 +113,8 @@ github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbt
 github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUMfuitfgcfuo=
 github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v1.0.0 h1:dtDWrepsVPfW9H/4y7dDgFc2MBUSeJhlaDtK13CxFlU=
-github.com/BurntSushi/toml v1.0.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/BurntSushi/toml v1.1.0 h1:ksErzDEI1khOiGPgpwuI7x2ebx/uXQNw7xJpn9Eq1+I=
+github.com/BurntSushi/toml v1.1.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/DataDog/datadog-agent/pkg/obfuscate v0.0.0-20211129110424-6491aa3bf583 h1:3nVO1nQyh64IUY6BPZUpMYMZ738Pu+LsMt3E0eqqIYw=
 github.com/DataDog/datadog-agent/pkg/obfuscate v0.0.0-20211129110424-6491aa3bf583/go.mod h1:EP9f4GqaDJyP1F5jTNMtzdIpw3JpNs3rMSJOnYywCiw=
@@ -140,7 +139,6 @@ github.com/HdrHistogram/hdrhistogram-go v1.1.2/go.mod h1:yDgFjdqOqDEKOvasDdhWNXY
 github.com/Knetic/govaluate v3.0.1-0.20171022003610-9aa49832a739+incompatible/go.mod h1:r7JcOSlj0wfOMncg0iLm8Leh48TZaKVeNIfJntJ2wa0=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
 github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/semver/v3 v3.1.1 h1:hLg3sBzpNErnxhQtUy/mmLR2I9foDujNK030IGemrRc=
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
@@ -235,14 +233,13 @@ github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:l
 github.com/aws/aws-lambda-go v1.13.3/go.mod h1:4UKl9IzQMoD+QF79YdCuzCwp8VbmG4VAQwij/eHl5CU=
 github.com/aws/aws-sdk-go v1.15.11/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZoCYDt7FT0=
 github.com/aws/aws-sdk-go v1.15.90/go.mod h1:es1KtYUFs7le0xQ3rOihkuoVD90z7D0fR2Qm4S00/gU=
-github.com/aws/aws-sdk-go v1.16.23/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.25.37/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.25.41/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.34.9/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
 github.com/aws/aws-sdk-go v1.34.28/go.mod h1:H7NKnBqNVzoTJpGfLrQkkD+ytBA93eiDYi/+8rV9s48=
-github.com/aws/aws-sdk-go v1.39.0 h1:74BBwkEmiqBbi2CGflEh34l0YNtIibTjZsibGarkNjo=
-github.com/aws/aws-sdk-go v1.39.0/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
+github.com/aws/aws-sdk-go v1.44.47 h1:uyiNvoR4wfZ8Bp4ghgbyzGFIg5knjZMUAd5S9ba9qNU=
+github.com/aws/aws-sdk-go v1.44.47/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
 github.com/aws/aws-sdk-go-v2 v1.0.0/go.mod h1:smfAbmpW+tcRVuNUjo3MOArSZmW72t62rkCzc2i0TWM=
 github.com/aws/aws-sdk-go-v2/config v1.0.0/go.mod h1:WysE/OpUgE37tjtmtJd8GXgT8s1euilE5XtUkRNUQ1w=
@@ -299,7 +296,6 @@ github.com/cenkalti/backoff/v4 v4.1.1 h1:G2HAfAmvm/GcKan2oOQpBXOd2tT2G57ZnZGWa1P
 github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/certifi/gocertifi v0.0.0-20180118203423-deb3ae2ef261/go.mod h1:GJKEexRPVJrBSOjoqN5VNOIKJ5Q3RViH6eu3puDRwx4=
-github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.0/go.mod h1:dgIUBU3pDso/gPgZ1osOZ0iQf77oPR28Tjxl5dIMyVM=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -518,6 +514,7 @@ github.com/dgrijalva/jwt-go v0.0.0-20170104182250-a601269ab70c/go.mod h1:E3ru+11
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2 h1:tdlZCpZ/P9DhczCTSixgIKmwPv6+wP5DGjqLYw5SUiA=
 github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/digitalocean/godo v1.1.1/go.mod h1:h6faOIcZ8lWIwNQ+DN7b3CgX4Kwby5T+nbpNqkUIozU=
@@ -686,11 +683,13 @@ github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2
 github.com/go-kit/kit v0.10.1-0.20200915143503-439c4d2ed3ea h1:CnEQOUv4ilElSwFB9g/lVmz206oLE4aNZDYngIY1Gvg=
 github.com/go-kit/kit v0.10.1-0.20200915143503-439c4d2ed3ea/go.mod h1:xUsJbQ/Fp4kEt7AFgCuvyX4a71u8h9jB8tj/ORgOZ7o=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
+github.com/go-kit/log v0.2.0/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
 github.com/go-ldap/ldap/v3 v3.1.3/go.mod h1:3rbOH3jRS2u6jg2rJnKAMLE/xQyCKIveG2Sa/Cohzb8=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-logfmt/logfmt v0.5.0 h1:TrB8swr/68K7m9CcGut2g3UOihhbcbiMAYiuTXdEih4=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
+github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
+github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
 github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
 github.com/go-logr/logr v0.4.0 h1:K7/B1jt6fIBQVd4Owv2MqGQClcgf0R266+7C/QjRcLc=
@@ -721,6 +720,8 @@ github.com/go-playground/validator/v10 v10.4.1/go.mod h1:nlOn6nFhuKACm19sB/8EGNn
 github.com/go-redis/redis v6.15.9+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
 github.com/go-redis/redis/v7 v7.1.0/go.mod h1:JDNMw23GTyLNC4GZu9njt15ctBQVn7xjRfnwdHj/Dcg=
 github.com/go-redis/redis/v8 v8.0.0/go.mod h1:isLoQT/NFSP7V67lyvM9GmdvLdyZ7pEhsXvvyQtnQTo=
+github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
+github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
 github.com/go-resty/resty/v2 v2.1.1-0.20191201195748-d7b97669fe48 h1:JVrqSeQfdhYRFk24TvhTZWU0q8lfCojxZQFi3Ou7+uY=
 github.com/go-resty/resty/v2 v2.1.1-0.20191201195748-d7b97669fe48/go.mod h1:dZGr0i9PLlaaTD4H/hoZIDjQ+r6xq8mgbRzHZf7f2J8=
 github.com/go-sql-driver/mysql v1.3.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
@@ -739,7 +740,6 @@ github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3a
 github.com/go-zookeeper/zk v1.0.2 h1:4mx0EYENAdX/B/rbunjlt5+4RTA/a9SMHBRuSKdGxPM=
 github.com/go-zookeeper/zk v1.0.2/go.mod h1:nOB03cncLtlp4t+UAkGSV+9beXP/akpekBwL+UX1Qcw=
 github.com/gobs/pretty v0.0.0-20180724170744-09732c25a95b h1:/vQ+oYKu+JoyaMPDsv5FzwuL2wwWBgBbtj/YLCi4LuA=
-github.com/gobs/pretty v0.0.0-20180724170744-09732c25a95b/go.mod h1:Xo4aNUOrJnVruqWQJBtW6+bTBDTniY8yZum5rF3b5jw=
 github.com/gobuffalo/attrs v0.0.0-20190224210810-a9411de4debd/go.mod h1:4duuawTqi2wkkpB4ePgWMaai6/Kc6WEz83bhFwpHzj0=
 github.com/gobuffalo/depgen v0.0.0-20190329151759-d478694a28d3/go.mod h1:3STtPUQYuzV0gBVOY3vy6CfMm/ljR4pABfrTeHNLHUY=
 github.com/gobuffalo/depgen v0.1.0/go.mod h1:+ifsuy7fhi15RWncXQQKjWS9JPkdah5sZvtHc2RXGlg=
@@ -866,7 +866,6 @@ github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/go-containerregistry v0.0.0-20191015185424-71da34e4d9b3/go.mod h1:ZXFeSndFcK4vB1NR4voH1Zm38K7ViUNiYtfIBDxrwf0=
-github.com/google/go-github v17.0.0+incompatible h1:N0LgJ1j65A7kfXrZnUDaYCs/Sf4rEjNlfyDHW9dolSY=
 github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ=
 github.com/google/go-github/v28 v28.1.1 h1:kORf5ekX5qwXO2mGzXXOjMe/g6ap8ahVe0sBEulhSxo=
 github.com/google/go-github/v28 v28.1.1/go.mod h1:bsqJWQX05omyWVmc00nEUql9mhQyv38lDZ8kPZcQVoM=
@@ -908,7 +907,6 @@ github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/gax-go v2.0.0+incompatible h1:j0GKcs05QVmm7yesiZq2+9cxHkNK9YM6zKx4D2qucQU=
 github.com/googleapis/gax-go v2.0.0+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
 github.com/googleapis/gax-go/v2 v2.0.3/go.mod h1:LLvjysVCY1JZeum8Z6l8qUty8fiNwE08qbEPm1M08qg=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
@@ -1265,7 +1263,6 @@ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORN
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/pty v1.1.3/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/pty v1.1.4/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -1275,8 +1272,8 @@ github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kvtools/valkeyrie v0.4.0 h1:0lfG8XpxL28YCOUmSiFsyvgTSDxEQzQOtgvZrJ3sIm8=
-github.com/kvtools/valkeyrie v0.4.0/go.mod h1:rNvw3wTLExfPgqcn+y6bpBZP8MYULZ4X1SAa2zEDg2o=
+github.com/kvtools/valkeyrie v0.4.2-0.20220810161836-a9a70ee3f199 h1:SF+ZjtFyUPxkkCLYowtWzTeEMeziEKdW0Qhg9siq9b8=
+github.com/kvtools/valkeyrie v0.4.2-0.20220810161836-a9a70ee3f199/go.mod h1:6gM2lOTGIFQxcIioo3/EEeOS0knFB8+AFKydVIN/nAU=
 github.com/kylelemons/go-gypsy v0.0.0-20160905020020-08cad365cd28/go.mod h1:T/T7jsxVqf9k/zYOqbgNAsANsjxTd1Yq3htjDhQ1H0c=
 github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
 github.com/labbsr0x/bindman-dns-webhook v1.0.2 h1:I7ITbmQPAVwrDdhd6dHKi+MYJTJqPCK0jE6YNBAevnk=
@@ -1312,8 +1309,8 @@ github.com/liquidweb/liquidweb-go v1.6.3/go.mod h1:SuXXp+thr28LnjEw18AYtWwIbWMHS
 github.com/lithammer/dedent v1.1.0/go.mod h1:jrXYCQtgg0nJiN+StA2KgR7w6CiQNv9Fd/Z9BP0jIOc=
 github.com/looplab/fsm v0.1.0 h1:Qte7Zdn/5hBNbXzP7yxVU4OIFHWXBovyTT2LaBTyC20=
 github.com/looplab/fsm v0.1.0/go.mod h1:m2VaOfDHxqXBBMgc26m6yUOwkFn8H2AlJDE+jd/uafI=
-github.com/lucas-clemente/quic-go v0.27.0 h1:v6WY87q9zD4dKASbG8hy/LpzAVNzEQzw8sEIeloJsc4=
-github.com/lucas-clemente/quic-go v0.27.0/go.mod h1:AzgQoPda7N+3IqMMMkywBKggIFo2KT6pfnlrQ2QieeI=
+github.com/lucas-clemente/quic-go v0.28.1 h1:Uo0lvVxWg5la9gflIF9lwa39ONq85Xq2D91YNEIslzU=
+github.com/lucas-clemente/quic-go v0.28.1/go.mod h1:oGz5DKK41cJt5+773+BSO9BXDsREY4HLf7+0odGAPO0=
 github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI=
 github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
@@ -1343,10 +1340,12 @@ github.com/marten-seemann/qpack v0.2.1 h1:jvTsT/HpCn2UZJdP+UUB53FfUUgeOyG5K1ns0O
 github.com/marten-seemann/qpack v0.2.1/go.mod h1:F7Gl5L1jIgN1D11ucXefiuJS9UMVP2opoCp2jDKb7wc=
 github.com/marten-seemann/qtls-go1-16 v0.1.5 h1:o9JrYPPco/Nukd/HpOHMHZoBDXQqoNtUCmny98/1uqQ=
 github.com/marten-seemann/qtls-go1-16 v0.1.5/go.mod h1:gNpI2Ol+lRS3WwSOtIUUtRwZEQMXjYK+dQSBFbethAk=
-github.com/marten-seemann/qtls-go1-17 v0.1.1 h1:DQjHPq+aOzUeh9/lixAGunn6rIOQyWChPSI4+hgW7jc=
-github.com/marten-seemann/qtls-go1-17 v0.1.1/go.mod h1:C2ekUKcDdz9SDWxec1N/MvcXBpaX9l3Nx67XaR84L5s=
-github.com/marten-seemann/qtls-go1-18 v0.1.1 h1:qp7p7XXUFL7fpBvSS1sWD+uSqPvzNQK43DH+/qEkj0Y=
-github.com/marten-seemann/qtls-go1-18 v0.1.1/go.mod h1:mJttiymBAByA49mhlNZZGrH5u1uXYZJ+RW28Py7f4m4=
+github.com/marten-seemann/qtls-go1-17 v0.1.2 h1:JADBlm0LYiVbuSySCHeY863dNkcpMmDR7s0bLKJeYlQ=
+github.com/marten-seemann/qtls-go1-17 v0.1.2/go.mod h1:C2ekUKcDdz9SDWxec1N/MvcXBpaX9l3Nx67XaR84L5s=
+github.com/marten-seemann/qtls-go1-18 v0.1.2 h1:JH6jmzbduz0ITVQ7ShevK10Av5+jBEKAHMntXmIV7kM=
+github.com/marten-seemann/qtls-go1-18 v0.1.2/go.mod h1:mJttiymBAByA49mhlNZZGrH5u1uXYZJ+RW28Py7f4m4=
+github.com/marten-seemann/qtls-go1-19 v0.1.0-beta.1 h1:7m/WlWcSROrcK5NxuXaxYD32BZqe/LEEnBrWcH/cOqQ=
+github.com/marten-seemann/qtls-go1-19 v0.1.0-beta.1/go.mod h1:5HTDWtVudo/WFsHKRNuOhWlbdjrfs5JHrYb0wIJqGpI=
 github.com/matryer/moq v0.0.0-20190312154309-6cfb0558e1bd/go.mod h1:9ELz6aaclSIGnZBoaSLZ3NAl1VTufbOrXBPvtcy6WiQ=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
@@ -1391,7 +1390,6 @@ github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3N
 github.com/miekg/dns v1.1.25/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
 github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
-github.com/miekg/dns v1.1.45/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME=
 github.com/miekg/dns v1.1.47 h1:J9bWiXbqMbnZPcY8Qi2E3EWIBsIm6MZzzJB9VRg5gL8=
 github.com/miekg/dns v1.1.47/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME=
 github.com/miekg/pkcs11 v1.0.3 h1:iMwmD7I5225wv84WxIG/bmxz9AXjWvTWIbM/TYHvWtw=
@@ -1525,8 +1523,9 @@ github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108
 github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
 github.com/onsi/ginkgo v1.14.1/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
 github.com/onsi/ginkgo v1.16.2/go.mod h1:CObGmKUOKaSC0RjmoAK7tKyn4Azo5P2IWuoMnvwxz1E=
-github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
 github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
+github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
+github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
 github.com/onsi/ginkgo/v2 v2.0.0/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
 github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
 github.com/onsi/gomega v0.0.0-20151007035656-2152b45fa28a/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
@@ -1653,8 +1652,11 @@ github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQ
 github.com/prometheus/client_golang v1.3.0/go.mod h1:hJaj2vgQTGQmVCsAACORcieXFeDPbaTKGT+JTgUa3og=
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_golang v1.11.0 h1:HNkLOAEQMIDv/K+04rukrLx6ch7msSRwf3/SASFAGtQ=
 github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
+github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
+github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
+github.com/prometheus/client_golang v1.12.2-0.20220704083116-e8f91604d835 h1:sYuFGkrz0PtewSFk0Bg7p7jjiiklc6FUIWz+mFGQfD0=
+github.com/prometheus/client_golang v1.12.2-0.20220704083116-e8f91604d835/go.mod h1:RjnYTcBFM8s+WRft6oBqj4p5OgXJASPw5UFiI7w+GSs=
 github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
@@ -1674,8 +1676,10 @@ github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+
 github.com/prometheus/common v0.7.0/go.mod h1:DjGbpBbp5NYNiECxcL/VnbXCCaQpKd3tt26CguLLsqA=
 github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
-github.com/prometheus/common v0.26.0 h1:iMAkS2TDoNWnKM+Kopnx/8tnEStIfpYA0ur0xQzzhMQ=
 github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
+github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
+github.com/prometheus/common v0.35.0 h1:Eyr+Pw2VymWejHqCugNaQXkAi6KayVNxaHeu6khmFBE=
+github.com/prometheus/common v0.35.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
 github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20180725123919-05ee40e3a273/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
@@ -1690,12 +1694,12 @@ github.com/prometheus/procfs v0.0.5/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDa
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
-github.com/prometheus/procfs v0.6.0 h1:mxy4L2jP6qMonqmq+aTtOx1ifVWUgG/TAmntgbh3xv4=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+github.com/prometheus/procfs v0.7.3 h1:4jVXhlkAyzOScmCkXBTOLRLTz8EeU+eyjrwB/EPq0VU=
+github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/qri-io/jsonpointer v0.1.0/go.mod h1:DnJPaYgiKu56EuDp8TU5wFLdZIcAnb/uH9v37ZaMV64=
 github.com/qri-io/jsonschema v0.1.1/go.mod h1:QpzJ6gBQ0GYgGmh7mDQ1YsvvhSgE4rYj0k8t5MBOmUY=
-github.com/rainycape/memcache v0.0.0-20150622160815-1031fa0ce2f2/go.mod h1:7tZKcyumwBO6qip7RNQ5r77yrssm9bfCowcLEBcU5IA=
 github.com/rancher/go-rancher-metadata v0.0.0-20200311180630-7f4c936a06ac h1:wBGhHdXKICZmvAPWS8gQoMyOWDH7QAi9bU4Z1nDWnFU=
 github.com/rancher/go-rancher-metadata v0.0.0-20200311180630-7f4c936a06ac/go.mod h1:67sLWL17mVlO1HFROaTBmU71NB4R8UNCesFHhg0f6LQ=
 github.com/rboyer/safeio v0.2.1/go.mod h1:Cq/cEPK+YXFn622lsQ0K4KsPZSPtaptHHEldsy7Fmig=
@@ -1709,7 +1713,6 @@ github.com/rogpeppe/go-internal v1.1.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFR
 github.com/rogpeppe/go-internal v1.2.2/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1 h1:/FiVV8dS/e+YqF2JvO3yXRFbBLTIuSDkuC7aBOAvL+k=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
 github.com/rs/zerolog v1.4.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
 github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
@@ -1784,14 +1787,12 @@ github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic
 github.com/skratchdot/open-golang v0.0.0-20160302144031-75fb7ed4208c/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/assertions v1.0.1 h1:voD4ITNjPL5jjBfgR/r8fPIIBrliWrWHeiJApdr3r4w=
-github.com/smartystreets/assertions v1.0.1/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
 github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9 h1:hp2CYQUINdZMHdvTdXtPOY2ainKl4IoMcpAXEf2xj3Q=
 github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9/go.mod h1:SnhjPscd9TpLiy1LpzGSKh3bXCfxxXuqd9xmQJy3slM=
 github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/smartystreets/gunit v1.0.4 h1:tpTjnuH7MLlqhoD21vRoMZbMIi5GmBsAJDFyF67GhZA=
-github.com/smartystreets/gunit v1.0.4/go.mod h1:EH5qMBab2UclzXUcpR8b93eHsIlp9u+pDQIRp5DZNzQ=
 github.com/softlayer/softlayer-go v0.0.0-20180806151055-260589d94c7d/go.mod h1:Cw4GTlQccdRGSEf6KiMju767x0NEHE0YIVPJSaXjlsw=
 github.com/softlayer/softlayer-go v1.0.3 h1:9FONm5xzQ9belQtbdryR6gBg4EF6hX6lrjNKi0IvZkU=
 github.com/softlayer/softlayer-go v1.0.3/go.mod h1:6HepcfAXROz0Rf63krk5hPZyHT6qyx2MNvYyHof7ik4=
@@ -1844,8 +1845,9 @@ github.com/stretchr/objx v0.0.0-20180129172003-8a3f7159479f/go.mod h1:HFkY916IF+
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
-github.com/stretchr/objx v0.3.0 h1:NGXK3lHquSN08v5vWalVI/L8XU9hdzE/G6xsrze47As=
 github.com/stretchr/objx v0.3.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/objx v0.4.0 h1:M2gUjqZET1qApGOWNSnZ49BAIMX4F/1plDv3+l31EJ4=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v0.0.0-20180303142811-b89eecf5ca5d/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.1/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
@@ -1855,8 +1857,9 @@ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81P
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1 h1:5TQK59W5E3v0r2duFAb7P95B6hEeOyEnHRa8MjYSMTY=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stvp/go-udp-testing v0.0.0-20191102171040-06b61409b154 h1:XGopsea1Dw7ecQ8JscCNQXDGYAKDiWjDeXnpN/+BY9g=
 github.com/stvp/go-udp-testing v0.0.0-20191102171040-06b61409b154/go.mod h1:7jxmlfBCDBXRzr0eAQJ48XC1hBu1np4CS5+cHEYfwpc=
 github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
@@ -1900,10 +1903,10 @@ github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea h1:SXhTLE6pb6eld/
 github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea/go.mod h1:WPnis/6cRcDZSUvVmezrxJPkiO87ThFYsoUiMwWNDJk=
 github.com/tonistiigi/vt100 v0.0.0-20190402012908-ad4c4a574305 h1:y/1cL5AL2oRcfzz8CAHHhR6kDDfIOT0WEyH5k40sccM=
 github.com/tonistiigi/vt100 v0.0.0-20190402012908-ad4c4a574305/go.mod h1:gXOLibKqQTRAVuVZ9gX7G9Ykky8ll8yb4slxsEMoY0c=
-github.com/traefik/paerser v0.1.5 h1:crit7KzQ9PUWGCYu+H2acwyr7ZKb3RQDSn6iJCtxBhE=
-github.com/traefik/paerser v0.1.5/go.mod h1:Fuwl9DWJfGpZPPwZY6djYIF0vhvzhLmCizn6P66UeLY=
-github.com/traefik/yaegi v0.13.0 h1:dNwyGNSLHuRw5xswpbuW1TlzzGDciiK6uAighR1tMsc=
-github.com/traefik/yaegi v0.13.0/go.mod h1:RuCwD8/wsX7b6KoQHOaIFUfuH3gQIK4KWnFFmJMw5VA=
+github.com/traefik/paerser v0.1.6 h1:UqqAW0M3r+aF7DibUVwO1PiZ8cXLsUkpFv5hhxPCscA=
+github.com/traefik/paerser v0.1.6/go.mod h1:Dk3Bfz6Zyj13/S8pJyRdx/FNvXlsVRVbtp0UK4ZSiA0=
+github.com/traefik/yaegi v0.14.1 h1:t0ssyzeZCWTFGd/JnVuDxH/slMQfYg+2CDD4dLW/rU0=
+github.com/traefik/yaegi v0.14.1/go.mod h1:AVRxhaI2G+nUsaM1zyktzwXn69G3t/AuTDrCiTds9p0=
 github.com/transip/gotransip/v6 v6.6.1 h1:nsCU1ErZS5G0FeOpgGXc4FsWvBff9GPswSMggsC4564=
 github.com/transip/gotransip/v6 v6.6.1/go.mod h1:pQZ36hWWRahCUXkFWlx9Hs711gLd8J4qdgLdRzmtY+g=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926 h1:G3dpKMzFDjgEh2q1Z7zUUtKa8ViPtH+ocF0bE0g00O8=
@@ -2017,18 +2020,18 @@ go.elastic.co/fastjson v1.1.0 h1:3MrGBWWVIxe/xvsbpghtkFoPciPhOCmjsR/HfwEeQR4=
 go.elastic.co/fastjson v1.1.0/go.mod h1:boNGISWMjQsUPy/t6yqt2/1Wx4YNPSe+mZjlyw9vKKI=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
-go.etcd.io/bbolt v1.3.4/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.etcd.io/etcd v0.0.0-20191023171146-3cf2f69b5738/go.mod h1:dnLIgRNXwCJa5e+c6mIZCrds/GIG4ncV9HhK5PX7jPg=
-go.etcd.io/etcd v0.5.0-alpha.5.0.20200910180754-dd1b699fc489 h1:1JFLBqwIgdyHN1ZtgjTBwO+blA6gVOmZurpiMEsETKo=
 go.etcd.io/etcd v0.5.0-alpha.5.0.20200910180754-dd1b699fc489/go.mod h1:yVHk9ub3CSBatqGNg7GRmsnfLWtoW60w4eDYfh7vHDg=
-go.etcd.io/etcd/api/v3 v3.5.0 h1:GsV3S+OfZEOCNXdtNkBSR7kgLobAa/SO6tCxRa0GAYw=
 go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
-go.etcd.io/etcd/client/pkg/v3 v3.5.0 h1:2aQv6F436YnN7I4VbI8PPYrBhu+SmrTaADcf8Mi/6PU=
+go.etcd.io/etcd/api/v3 v3.5.4 h1:OHVyt3TopwtUQ2GKdd5wu3PmmipR4FTwCqoEjSyRdIc=
+go.etcd.io/etcd/api/v3 v3.5.4/go.mod h1:5GB2vv4A4AOn3yk7MftYGHkUfGtDHnEraIjym4dYz5A=
 go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
+go.etcd.io/etcd/client/pkg/v3 v3.5.4 h1:lrneYvz923dvC14R54XcA7FXoZ3mlGZAgmwhfm7HqOg=
+go.etcd.io/etcd/client/pkg/v3 v3.5.4/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
 go.etcd.io/etcd/client/v2 v2.305.0/go.mod h1:h9puh54ZTgAKtEbut2oe9P4L/oqKCVB6xsXlzd7alYQ=
-go.etcd.io/etcd/client/v3 v3.5.0 h1:62Eh0XOro+rDwkrypAGDfgmNh5Joq+z+W9HZdlXMzek=
-go.etcd.io/etcd/client/v3 v3.5.0/go.mod h1:AIKXXVX/DQXtfTEqBryiLTUXwON+GuvO6Z7lLS/oTh0=
+go.etcd.io/etcd/client/v3 v3.5.4 h1:p83BUL3tAYS0OT/r0qglgc3M1JjhM0diV8DSWAhVXv4=
+go.etcd.io/etcd/client/v3 v3.5.4/go.mod h1:ZaRkVgBZC+L+dLCjTcF1hRXpgZXQPOvnA/Ak/gq3kiY=
 go.mongodb.org/mongo-driver v1.5.1/go.mod h1:gRXCHX4Jo7J0IJ1oDQyUxF7jfy19UfxniMS4xxMmUqw=
 go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
 go.opencensus.io v0.18.0/go.mod h1:vKdFvxhtzZ9onBp9VKHK8z/sRpBMnKAsufL7wlDrCOA=
@@ -2230,11 +2233,14 @@ golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1/go.mod h1:9tjilg8BloeKEkVJvy
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20210510120150-4163338589ed/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210520170846-37e1c6afe023/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211020060615-d418f374d309/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4 h1:HVyaeDAYux4pnY+D/SiwmLOR36ewZ4iGQIIrtnuCjFA=
-golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e h1:TsQ7F31D3bUCLeqPT0u+yjp1guoArKaNKmCr22PYgTQ=
+golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/oauth2 v0.0.0-20180724155351-3d292e4d0cdc/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -2249,8 +2255,10 @@ golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602 h1:0Ja1LBD+yisY6RWM/BH7TJVXWsSjs2VwBSmvSX4HdBc=
 golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b h1:clP8eMhB30EHdc0bd2Twtq6kgU7yl5ub2cQLSdrv1Dg=
+golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
 golang.org/x/perf v0.0.0-20180704124530-6e6d33e29852/go.mod h1:JLpeXjPJfIyPr5TlbXLkXWLhP8nz10XfvxElABhCtcw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -2389,10 +2397,12 @@ golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211103235746-7861aae1554b/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220307203707-22a9840ba4d7 h1:8IVLkfbr2cLhv0a/vKq4UFUcJym8RmDoDboxCFWEjYE=
-golang.org/x/sys v0.0.0-20220307203707-22a9840ba4d7/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e h1:CsOuNlbOuf0mzxJIefr6Q4uAUetRUwZE4qt7VfzP+xo=
+golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -2417,7 +2427,6 @@ golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxb
 golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20201208040808-7e3f01d25324/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20210611083556-38a9dc6acbc6/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11 h1:GZokNIeuVkl3aZHJchRrr13WCsols02MLUcz1U9is6M=
 golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -2656,8 +2665,9 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
+google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/DataDog/dd-trace-go.v1 v1.38.1 h1:nAKgcpJLXRHF56cKCP3bN8gTTQmmNAZFEblbyGKhKTo=
 gopkg.in/DataDog/dd-trace-go.v1 v1.38.1/go.mod h1:GBhK4yaMJ1h329ivtKAqRNe1EZ944UnZwtz5lh7CnJc=
 gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
@@ -2706,8 +2716,6 @@ gopkg.in/ns1/ns1-go.v2 v2.6.2 h1:tC+gRSN6fmnb9l9cVrIysXyuRO0wV6cZrjDqlMB0gGc=
 gopkg.in/ns1/ns1-go.v2 v2.6.2/go.mod h1:GMnKY+ZuoJ+lVLL+78uSTjwTz2jMazq6AfGKQOYhsPk=
 gopkg.in/olivere/elastic.v3 v3.0.75/go.mod h1:yDEuSnrM51Pc8dM5ov7U8aI/ToR3PG0llA8aRv2qmw0=
 gopkg.in/olivere/elastic.v5 v5.0.84/go.mod h1:LXF6q9XNBxpMqrcgax95C6xyARXWbbCXUrtTxrNrxJI=
-gopkg.in/redis.v5 v5.2.9 h1:MNZYOLPomQzZMfpN3ZtD1uyJ2IDonTTlxYiV/pEApiw=
-gopkg.in/redis.v5 v5.2.9/go.mod h1:6gtv0/+A4iM08kdRfocWYB3bLX2tebpNtfKlFT6H4mY=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
 gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
@@ -2729,8 +2737,9 @@ gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gorm.io/driver/mysql v1.0.1/go.mod h1:KtqSthtg55lFp3S5kUXqlGaelnWpKitn4k1xZTnoiPw=
 gorm.io/driver/postgres v1.0.0/go.mod h1:wtMFcOzmuA5QigNsgEIb7O5lhvH1tHAF1RbWmLWV4to=
 gorm.io/driver/sqlserver v1.0.4/go.mod h1:ciEo5btfITTBCj9BkoUVDvgQbUdLWQNqdFY5OGuGnRg=
@@ -2812,7 +2821,6 @@ k8s.io/klog v0.2.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
 k8s.io/klog v0.3.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
 k8s.io/klog v0.3.1/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
 k8s.io/klog v0.4.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
-k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
 k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
 k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
 k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
@@ -2853,7 +2861,6 @@ sigs.k8s.io/controller-runtime v0.9.6/go.mod h1:q6PpkM5vqQubEKUKOM6qr06oXGzOBcCb
 sigs.k8s.io/controller-tools v0.6.2/go.mod h1:oaeGpjXn6+ZSEIQkUe/+3I40PNiDYp9aeawbt3xTgJ8=
 sigs.k8s.io/gateway-api v0.4.0 h1:07IJkTt21NetZTHtPKJk2I4XIgDN4BAlTIq1wK7V11o=
 sigs.k8s.io/gateway-api v0.4.0/go.mod h1:r3eiNP+0el+NTLwaTfOrCNXy8TukC+dIM3ggc+fbNWk=
-sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e h1:4Z09Hglb792X0kfOBBJUPFEyvVfQWrYT/l8h5EKA6JQ=
 sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.3/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
@@ -2863,7 +2870,6 @@ sigs.k8s.io/structured-merge-diff/v4 v4.1.2/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZa
 sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
 sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
-software.sslmate.com/src/go-pkcs12 v0.0.0-20210415151418-c5206de65a78/go.mod h1:B7Wf0Ya4DHF9Yw+qfZuJijQYkWicqDa+79Ytmmq3Kjg=
 sourcegraph.com/sourcegraph/appdash v0.0.0-20190731080439-ebfcffb1b5c0/go.mod h1:hI742Nqp5OhwiqlzhgfbWU4mW4yO10fP+LoT9WOswdU=
 sourcegraph.com/sourcegraph/go-diff v0.5.0/go.mod h1:kuch7UrkMzY0X+p9CRK03kfuPQ2zzQcaEFbx8wA8rck=
 sourcegraph.com/sqs/pbtypes v0.0.0-20180604144634-d3ebe8f20ae4/go.mod h1:ketZ/q3QxT9HOBeFhu6RdvsftgpsbFHBF5Cas6cDKZ0=

integration/consul_test.go

@@ -2,6 +2,7 @@ package integration
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"fmt"
 	"net"
@@ -36,6 +37,7 @@ func (s *ConsulSuite) setupStore(c *check.C) {
 
 	consul.Register()
 	kv, err := valkeyrie.NewStore(
+		context.Background(),
 		store.CONSUL,
 		[]string{consulAddr},
 		&store.Config{
@@ -105,7 +107,7 @@ func (s *ConsulSuite) TestSimpleConfiguration(c *check.C) {
 	}
 
 	for k, v := range data {
-		err := s.kvClient.Put(k, []byte(v), nil)
+		err := s.kvClient.Put(context.Background(), k, []byte(v), nil)
 		c.Assert(err, checker.IsNil)
 	}
 

integration/etcd_test.go

@@ -2,6 +2,7 @@ package integration
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"net"
 	"net/http"
@@ -35,6 +36,7 @@ func (s *EtcdSuite) SetUpSuite(c *check.C) {
 	var err error
 	s.etcdAddr = net.JoinHostPort(s.getComposeServiceIP(c, "etcd"), "2379")
 	s.kvClient, err = valkeyrie.NewStore(
+		context.Background(),
 		store.ETCDV3,
 		[]string{s.etcdAddr},
 		&store.Config{
@@ -101,7 +103,7 @@ func (s *EtcdSuite) TestSimpleConfiguration(c *check.C) {
 	}
 
 	for k, v := range data {
-		err := s.kvClient.Put(k, []byte(v), nil)
+		err := s.kvClient.Put(context.Background(), k, []byte(v), nil)
 		c.Assert(err, checker.IsNil)
 	}
 

integration/fixtures/https/clientca/README.md

@@ -1,9 +1,38 @@
 # This is how the certs were created
 
+Password: traefik
+
 ```bash
+# ca1.example.com
+# Country Name (2 letter code) [AU]:.
+# State or Province Name (full name) [Some-State]:.
+# Locality Name (eg, city) []:.
+# Organization Name (eg, company) [Internet Widgits Pty Ltd]:.
+# Organizational Unit Name (eg, section) []:.
+# Common Name (e.g. server FQDN or YOUR name) []:ca1.example.com
+# Email Address []:.
 openssl req -new -newkey rsa:2048 -x509 -days 3650 -extensions v3_ca -keyout ca1.pem -out ca1.crt
+
+# ca2.example.com
+# Country Name (2 letter code) [AU]:.
+# State or Province Name (full name) [Some-State]:.
+# Locality Name (eg, city) []:.
+# Organization Name (eg, company) [Internet Widgits Pty Ltd]:.
+# Organizational Unit Name (eg, section) []:.
+# Common Name (e.g. server FQDN or YOUR name) []:ca2.example.com
+# Email Address []:.
 openssl req -new -newkey rsa:2048 -x509 -days 3650 -extensions v3_ca -keyout ca2.pem -out ca2.crt
+
+# ca3.example.com
+# Country Name (2 letter code) [AU]:.
+# State or Province Name (full name) [Some-State]:.
+# Locality Name (eg, city) []:.
+# Organization Name (eg, company) [Internet Widgits Pty Ltd]:.
+# Organizational Unit Name (eg, section) []:.
+# Common Name (e.g. server FQDN or YOUR name) []:ca3.example.com
+# Email Address []:.
 openssl req -new -newkey rsa:2048 -x509 -days 3650 -extensions v3_ca -keyout ca3.pem -out ca3.crt
+
 openssl rsa -in ca1.pem -out ca1.key
 openssl rsa -in ca2.pem -out ca2.key
 openssl rsa -in ca3.pem -out ca3.key
@@ -14,8 +43,58 @@ openssl genrsa -out client1.key 2048
 openssl genrsa -out client2.key 2048
 openssl genrsa -out client3.key 2048
 
+# Country Name (2 letter code) [AU]:.
+# State or Province Name (full name) [Some-State]:.
+# Locality Name (eg, city) []:.
+# Organization Name (eg, company) [Internet Widgits Pty Ltd]:.
+# Organizational Unit Name (eg, section) []:.
+# Common Name (e.g. server FQDN or YOUR name) []:clien1.example.com
+# Email Address []:.
+# 
+# Please enter the following 'extra' attributes
+# to be sent with your certificate request
+# A challenge password []:
+#
+# Issuer
+#   CN = ca1.example.com
+# Subject
+#   CN = clien1.example.com
 openssl req -key client1.key -new -out client1.csr
+
+# Country Name (2 letter code) [AU]:.
+# State or Province Name (full name) [Some-State]:.
+# Locality Name (eg, city) []:.
+# Organization Name (eg, company) [Internet Widgits Pty Ltd]:.
+# Organizational Unit Name (eg, section) []:.
+# Common Name (e.g. server FQDN or YOUR name) []:client2.example.com
+# Email Address []:.
+# 
+# Please enter the following 'extra' attributes
+# to be sent with your certificate request
+# A challenge password []:
+#
+# Issuer
+#   CN = ca2.example.com
+# Subject
+#   CN = client2.example.com
 openssl req -key client2.key -new -out client2.csr
+
+# Country Name (2 letter code) [AU]:.
+# State or Province Name (full name) [Some-State]:.
+# Locality Name (eg, city) []:.
+# Organization Name (eg, company) [Internet Widgits Pty Ltd]:.
+# Organizational Unit Name (eg, section) []:.
+# Common Name (e.g. server FQDN or YOUR name) []:client3.example.com
+# Email Address []:.
+# 
+# Please enter the following 'extra' attributes
+# to be sent with your certificate request
+# A challenge password []:
+#
+# Issuer
+#   CN = ca3.example.com
+# Subject
+#   CN = client3.example.com
 openssl req -key client3.key -new -out client3.csr
 
 openssl x509 -req -days 3650 -in client1.csr -CA ca1.crt -CAkey ca1.key -CAcreateserial -out client1.crt

integration/fixtures/https/clientca/ca1.crt

@@ -1,20 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIIDMjCCAhqgAwIBAgIJAKXHiSnQw6LqMA0GCSqGSIb3DQEBBQUAMBoxGDAWBgNV
-BAMTD2NhMS5leGFtcGxlLmNvbTAeFw0xNjA2MTgxMzAyNDdaFw0yNjA2MTYxMzAy
-NDdaMBoxGDAWBgNVBAMTD2NhMS5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEB
-BQADggEPADCCAQoCggEBAL9ZNf1Pqu30i/DUyAAbEVFfCvGEmN9hfGAK44IrBqfC
-1ziW2Lfg2AkswNIC/T6M+lcoN0ftPhJpnP2Cdz9U/gF9FMd/XAGY/SOiun7wC8so
-qdab7CMDlHP1c/XiL7lGEdm9RfynLcJ5JJn2X7mXwEZTviFtiJVmaoAl3TVNy3MZ
-ZyfjNac9sA5idpX66TpVO9tE1gu71nRkBvTEzO/IYv8rcWQmogvH7DN3UurP3RUK
-weij01rekG3OOOXUlQgZO6mhuvrKes9Xoc901bmTkOgTq7wIFf2AZozU4wy6kZfM
-0sdzmjMpuEr7oROepvtzFiVyNIEGDJ3QvEEY4QJaFvcCAwEAAaN7MHkwHQYDVR0O
-BBYEFFyJ/cSOOvcsfu+WLZbi/u3t8W/uMEoGA1UdIwRDMEGAFFyJ/cSOOvcsfu+W
-LZbi/u3t8W/uoR6kHDAaMRgwFgYDVQQDEw9jYTEuZXhhbXBsZS5jb22CCQClx4kp
-0MOi6jAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQCOBLJJF0esBVLX
-xmj0xa0TREXTxco40e/fmUU1cGYgl1UCCZI7MLDcl6k6Km9Sbp/LCpZx88mtLwGY
-wUss2mQ058kqiUrpb/U8xEbglLrRtsp1y8z7lood/8ru39zj1/9X4MFyqNi6390I
-zxZNf2QauUS1TMxgv6UhVE52JaAL+sn2hqA6IaSYeT9NFzFsulCr29mxlIC9SzUr
-Mbqri9LKX5aciy78+hQBKdXoJ5raRwttBvULabOrLhZdyvvL6QfcdgRV+JOT7vKn
-htQahWSKoqhdpM6Q2pXP42/MyuKXFB5Nk8fnFiIoXH0Bs9vlPLOvToM2jYJ+LlDd
-85qbL4eP
+MIIDFTCCAf2gAwIBAgIUd9ORKqy5CUX4DnPlEEZ/d+IiUvYwDQYJKoZIhvcNAQEL
+BQAwGjEYMBYGA1UEAwwPY2ExLmV4YW1wbGUuY29tMB4XDTIyMDgwODEyNTQwMVoX
+DTMyMDgwNTEyNTQwMVowGjEYMBYGA1UEAwwPY2ExLmV4YW1wbGUuY29tMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8AxPNLi5i9HrE2EdUgrKNIaLHaZP
+44hVkqbt6eKlTTs2u9TUNQM+DFPOHhZ5vyRCEthNv1gXhIY0K7qcJZd8Ot1+h+Yo
+sEoSU3i4WCeYhG5QWgcRmxPsZ40HGd943HkyFPE3MIAkviZ2oLxoU7Iw3F8Ly2n+
+5oFJOlPrIMKYF4JmMpa5WqHwjAZBkNa9avrjXmNaPHTB0a7DRCeq+qackoaseTJ2
+X0wfFSZsd4d0anyhYKaUlJGe8bSukkyXKzl//15zWf9TBtCf+gi38Iprn5jpr8hj
+We0o7393UmXwQyKvPZds46p3l4Lx0PRcqf867pBtbpTVJiLVr48G462aPQIDAQAB
+o1MwUTAdBgNVHQ4EFgQURvvnzmb0HYP3fSIlUKBTuUljwJ0wHwYDVR0jBBgwFoAU
+Rvvnzmb0HYP3fSIlUKBTuUljwJ0wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
+AQsFAAOCAQEAcBY+kp7Rn4pfJXKCusgaLQ21SKuZXecnZeXYUn8TwUgfjL+oNVzh
+ftQq6kD+CaYXFwAzYMi43nbJevMULqsH3R14ZTeE2zBKu+u4Q+qYQEPfVV59OfQj
+FxlS9yhmOnQK3FofDNbBXMpV50Zbadgq3uYL+2DiO/bTpZ2zM7jaBJkv6PRhgXM0
+lw9Qg9lhQWShWocMXlSS5QTddNlDBLxWI70GARS1Qj6bjhF4WMV04/aAd+m7tVgD
+ygfs3+y3lvfZxloUDoatVs6sM/03MgZFwSPNWryRzMol3162pPnm6B2PtWsCcJvu
+YnXB6GI9cjYqjofBUQL/OgWBqgyghUbtMQ==
 -----END CERTIFICATE-----

integration/fixtures/https/clientca/ca1.key

@@ -1,27 +1,27 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEAv1k1/U+q7fSL8NTIABsRUV8K8YSY32F8YArjgisGp8LXOJbY
-t+DYCSzA0gL9Poz6Vyg3R+0+Emmc/YJ3P1T+AX0Ux39cAZj9I6K6fvALyyip1pvs
-IwOUc/Vz9eIvuUYR2b1F/KctwnkkmfZfuZfARlO+IW2IlWZqgCXdNU3LcxlnJ+M1
-pz2wDmJ2lfrpOlU720TWC7vWdGQG9MTM78hi/ytxZCaiC8fsM3dS6s/dFQrB6KPT
-Wt6Qbc445dSVCBk7qaG6+sp6z1ehz3TVuZOQ6BOrvAgV/YBmjNTjDLqRl8zSx3Oa
-Mym4SvuhE56m+3MWJXI0gQYMndC8QRjhAloW9wIDAQABAoIBAGJ9g8mn6R5kImfK
-zksno4lTt2lLS/im0AMLd8E3bkyJgIgTNOeopupKC9HNUhaRMAYOoC24kpudmv3t
-2n1RvRB9FmX9SxlTavCdwQq3egqPGqRpS2lWXWI2dAKa8t+VjniZ8N00G9yeyFUr
-OGhqEMDiN9oy6/uiZK0jUDIwocjS5FZMBh+epM7/CnKj3uvqarmFXKcJ4ni28ww4
-RPrXDm+VvXa30/hK8q8Eo3C3u39TMvNEaRqMP/zqRY89fbpd1+Okno79dugFhz7D
-r/Jae9z4ChFBXegDmA/OkWOdLY5LyvwvpJpONjD/5wImY1OAJlFTg7S+2FcSVvCF
-diUJ7/ECgYEA9pHYlJsWAo/izRUVhKRtBAVVjnlidxExuvOGNXpyPjZd5ruXochu
-J6tAKA0rSE4RsISFVCrkQmjDgjyKa2D+o/hsTTlW3yrD4TSLI8/MrDtfCw9XRqeE
-KqfeqT79Hh0icnsUVYH4eoND9CKuJ/B9NcdyUqRPm7Pnrx07SnhGHd8CgYEAxqqy
-MPIDO2dadRqUIhWwMPIBegkZC1eeuv4pNEyukZc4+pXRshKXhvhmvz5NgsaSsKxZ
-O6FgqzgTceLEubVYF4hvy1TC+3Fc/PFvh4Fo3SKjtiJRJjRREDWBu6hl16Cw/83j
-k6Im//8WD1ri9iFf8RjrBwYH1xHqGTkNEUHl+ekCgYEAzlIWD6uCDFzIJGGLIvXP
-fvjTsadivE039r7Fw8QVCnfFtUetxyOHAUysH5d9a0BgTvtk8Zv+ao9tYXI1RUrh
-aOV8AlaDmbQYOj8UWsAL/OalTgTlO+r6jhLwH2DkvqkUZQUWa8KY4DMszoGihysW
-KsUcpYh2UMyGhqKINXVU/rMCgYEAqJxbG9trDtHLHjRuoPcTUJc01aQ/EzdMSpxH
-0FF8n6he/Z6GGMJaxHyyh4GTO3jZKwU7vrZaWzb+mdvC53KXz3FGoKXRzqIKL8uh
-wrn8jCJIG97ITMp+OmmPL/veY8HIN3NAwR4QR5jx2hpjIk51JSTm5FEj+k8EBmA7
-TPhG/XECgYA9e9B0jgR2aFSAWzpGMZYPW+NdGQlySv94AJmfF8U5J7PmU2BojvVn
-bhWNSQk2LI/mTjLgB+liYtLqFGkgIrJdbBOQ8hKSBPGQltSR0Dvf0ZK/0F1hqDTW
-m3AUvPZthNMNJIYkTav5a246tyKkmg11nUQsgoqdxCrEiLyv48PFnw==
+MIIEpAIBAAKCAQEA8AxPNLi5i9HrE2EdUgrKNIaLHaZP44hVkqbt6eKlTTs2u9TU
+NQM+DFPOHhZ5vyRCEthNv1gXhIY0K7qcJZd8Ot1+h+YosEoSU3i4WCeYhG5QWgcR
+mxPsZ40HGd943HkyFPE3MIAkviZ2oLxoU7Iw3F8Ly2n+5oFJOlPrIMKYF4JmMpa5
+WqHwjAZBkNa9avrjXmNaPHTB0a7DRCeq+qackoaseTJ2X0wfFSZsd4d0anyhYKaU
+lJGe8bSukkyXKzl//15zWf9TBtCf+gi38Iprn5jpr8hjWe0o7393UmXwQyKvPZds
+46p3l4Lx0PRcqf867pBtbpTVJiLVr48G462aPQIDAQABAoIBAGCZQ4J+18QJbKT2
+zrrGNsreXbtHwxxYL799R354Q3cJ3iPGKMNQk7aYPvjiqImfyKsWumrGw2gELZhv
+VwjVpht2KMX9e+A9XpSSnvRysrCQR+uCrrYOVXLyUKo7wMJQTzQYQdJVrvOKPPDA
+AOe1bG4yHWf1NquB2XsMbDFZvaSvgHafm5ZGs535TB9hejJ5CvWGaX98RC5lBIsk
+VMQkRh5A7kynUhcb2ITajaIzNpYtGYaY4arpSrXJ64cmykNC69uviVvYnH6LMnSo
+iwBpgooopK0PsDqfQiqpoo9QwvYUfmv0OooDjeilTUkLWsmn7lPkzaWaHOSC0bLJ
++04zzo0CgYEA+BSoMb/JD/VbTo1nOyYMGC+KPc2auyl3OwwzFIjRNhY7gTKnSxjK
+a4k4mjtbOqVG6xQawmyP4wdgMgzndjD+gyKArG5QIUrwjtk2NBoW2FCkcUGEv8L/
+qhrPcgSKAWPz8rgfSP+veIWPuMQfgngFwFlYL9q9YV512gD0kNUOkjsCgYEA97YC
+T3EfxwsLalzjdjuy/ria0lnZJVqFX0/py2Qlf8bNpM9YvAe7llJxrMxF7AEunAt3
+mVCQBXuvSBpnC/ii/vkUl2lPscukawP2tx6i/nxIzjkgCAOcceRspJrBCFggRykf
+C6ZrHJ2wQ+2eGOvL4EEvkSjfujoBoA/8bpS9hecCgYBVJNnZQUajuIUe/78neNZ7
+0o0yywdJJ2EpnfVGHfMYCidgH191kcufftgzbx3Pkfw2II9SnWoA9H4aj309fnFL
+1qKtC6tq0cqgbIKC/VVL5tmZmXATVLzkyBDcxBwNgB2w92qdZkv2JHkAZCegYssu
+ijuPKRcIfSAbs2o87zLyEwKBgQCd4tjeIdCLYbLI/KPOvIZ+bNPht3r8oBHaimkO
+RqrQIrr4jWCVmKgsTChAZ4M5xhcbRwPYKM1jcU5rushrjPL3aXOCfpFZVd9ahpA+
+b7ycUENnjmmoMgUJYvsMf8cBton8UW2EU3J6Ltgms9HNOJ4eNe5Hq7HOVSKsDwRq
+x0t1iQKBgQDSbmsLFg91TqG3iBRY58vcJFxSUZWBSYn0v5TJBcoJn7ryPIwgNDSH
+gcJKB0N7P7tR8fmkeCNFYixuUhUhMQRgsJ+alOoHzOI/TkD0dUXECHykppy2oxVY
+/rpxpjrhEqzM0TovTXTTQzvHKgJraAdEurDTJk0zPAwsoF+kwpRGZg==
 -----END RSA PRIVATE KEY-----

integration/fixtures/https/clientca/ca1.srl

@@ -1 +1 @@
-83E81F36599F4400
+83E81F36599F4402

integration/fixtures/https/clientca/ca1and2.crt

@@ -1,40 +1,38 @@
 -----BEGIN CERTIFICATE-----
-MIIDMjCCAhqgAwIBAgIJAKXHiSnQw6LqMA0GCSqGSIb3DQEBBQUAMBoxGDAWBgNV
-BAMTD2NhMS5leGFtcGxlLmNvbTAeFw0xNjA2MTgxMzAyNDdaFw0yNjA2MTYxMzAy
-NDdaMBoxGDAWBgNVBAMTD2NhMS5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEB
-BQADggEPADCCAQoCggEBAL9ZNf1Pqu30i/DUyAAbEVFfCvGEmN9hfGAK44IrBqfC
-1ziW2Lfg2AkswNIC/T6M+lcoN0ftPhJpnP2Cdz9U/gF9FMd/XAGY/SOiun7wC8so
-qdab7CMDlHP1c/XiL7lGEdm9RfynLcJ5JJn2X7mXwEZTviFtiJVmaoAl3TVNy3MZ
-ZyfjNac9sA5idpX66TpVO9tE1gu71nRkBvTEzO/IYv8rcWQmogvH7DN3UurP3RUK
-weij01rekG3OOOXUlQgZO6mhuvrKes9Xoc901bmTkOgTq7wIFf2AZozU4wy6kZfM
-0sdzmjMpuEr7oROepvtzFiVyNIEGDJ3QvEEY4QJaFvcCAwEAAaN7MHkwHQYDVR0O
-BBYEFFyJ/cSOOvcsfu+WLZbi/u3t8W/uMEoGA1UdIwRDMEGAFFyJ/cSOOvcsfu+W
-LZbi/u3t8W/uoR6kHDAaMRgwFgYDVQQDEw9jYTEuZXhhbXBsZS5jb22CCQClx4kp
-0MOi6jAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQCOBLJJF0esBVLX
-xmj0xa0TREXTxco40e/fmUU1cGYgl1UCCZI7MLDcl6k6Km9Sbp/LCpZx88mtLwGY
-wUss2mQ058kqiUrpb/U8xEbglLrRtsp1y8z7lood/8ru39zj1/9X4MFyqNi6390I
-zxZNf2QauUS1TMxgv6UhVE52JaAL+sn2hqA6IaSYeT9NFzFsulCr29mxlIC9SzUr
-Mbqri9LKX5aciy78+hQBKdXoJ5raRwttBvULabOrLhZdyvvL6QfcdgRV+JOT7vKn
-htQahWSKoqhdpM6Q2pXP42/MyuKXFB5Nk8fnFiIoXH0Bs9vlPLOvToM2jYJ+LlDd
-85qbL4eP
+MIIDFTCCAf2gAwIBAgIUd9ORKqy5CUX4DnPlEEZ/d+IiUvYwDQYJKoZIhvcNAQEL
+BQAwGjEYMBYGA1UEAwwPY2ExLmV4YW1wbGUuY29tMB4XDTIyMDgwODEyNTQwMVoX
+DTMyMDgwNTEyNTQwMVowGjEYMBYGA1UEAwwPY2ExLmV4YW1wbGUuY29tMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8AxPNLi5i9HrE2EdUgrKNIaLHaZP
+44hVkqbt6eKlTTs2u9TUNQM+DFPOHhZ5vyRCEthNv1gXhIY0K7qcJZd8Ot1+h+Yo
+sEoSU3i4WCeYhG5QWgcRmxPsZ40HGd943HkyFPE3MIAkviZ2oLxoU7Iw3F8Ly2n+
+5oFJOlPrIMKYF4JmMpa5WqHwjAZBkNa9avrjXmNaPHTB0a7DRCeq+qackoaseTJ2
+X0wfFSZsd4d0anyhYKaUlJGe8bSukkyXKzl//15zWf9TBtCf+gi38Iprn5jpr8hj
+We0o7393UmXwQyKvPZds46p3l4Lx0PRcqf867pBtbpTVJiLVr48G462aPQIDAQAB
+o1MwUTAdBgNVHQ4EFgQURvvnzmb0HYP3fSIlUKBTuUljwJ0wHwYDVR0jBBgwFoAU
+Rvvnzmb0HYP3fSIlUKBTuUljwJ0wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
+AQsFAAOCAQEAcBY+kp7Rn4pfJXKCusgaLQ21SKuZXecnZeXYUn8TwUgfjL+oNVzh
+ftQq6kD+CaYXFwAzYMi43nbJevMULqsH3R14ZTeE2zBKu+u4Q+qYQEPfVV59OfQj
+FxlS9yhmOnQK3FofDNbBXMpV50Zbadgq3uYL+2DiO/bTpZ2zM7jaBJkv6PRhgXM0
+lw9Qg9lhQWShWocMXlSS5QTddNlDBLxWI70GARS1Qj6bjhF4WMV04/aAd+m7tVgD
+ygfs3+y3lvfZxloUDoatVs6sM/03MgZFwSPNWryRzMol3162pPnm6B2PtWsCcJvu
+YnXB6GI9cjYqjofBUQL/OgWBqgyghUbtMQ==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIIDMjCCAhqgAwIBAgIJAKjhXgiuPQexMA0GCSqGSIb3DQEBBQUAMBoxGDAWBgNV
-BAMTD2NhMi5leGFtcGxlLmNvbTAeFw0xNjA2MTgxMzAzMjJaFw0yNjA2MTYxMzAz
-MjJaMBoxGDAWBgNVBAMTD2NhMi5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEB
-BQADggEPADCCAQoCggEBAMx8S4U3tdeMGn1NEUNWCmD7pIYUCUhtORrn2rqF5b2M
-ZQJZXAIfWJ7KrGjn8W7KPx8/V2FREHF1Z6v1fpB2rfCIFo97HszhQEt6lduKup2j
-09ItpFjec7RahwaMksYDwl4PaxgKe2OYdLFJ/QIv8+I01vWPXFmHgZkBHQWhR5nV
-TvGM6MU834e+PXxCXfcaC8VYpbHYKYxHmM5Sxa5V9WlppBBshB0OL+KrCPXwPqHl
-StZPkG2p2qJUjCZ38uDx605RYaORZ0eDhrKj4M3lJzOTTcC4I77BzTb74+GcRT+R
-lJMrWrS22jNZONnawBdbTWIFM4PzaqVvE7qVwZK1M5UCAwEAAaN7MHkwHQYDVR0O
-BBYEFPooSq3ZvoyIzRQ96/dwUC0LDBvRMEoGA1UdIwRDMEGAFPooSq3ZvoyIzRQ9
-6/dwUC0LDBvRoR6kHDAaMRgwFgYDVQQDEw9jYTIuZXhhbXBsZS5jb22CCQCo4V4I
-rj0HsTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQCvRgu11LrF7G9X
-yuvUwBZJ8FgjAMPwXQIAYg47tlvD9ZDiZgXVulWOm6aHpT520MjNO9f0oKpsrSsh
-7bsO4GSkbTPgGekbw4P3JtXAvlBEB5uabpdmF37Pg9s7dU/MeXCElzWF+yLVAo7o
-Hj1UlENxh08FzlErNw6Djy2FZAADeSZ3LmHUl+50rrp5/DxrEhkHFm8dTTjFVPnK
-KrnYLM8R7+v2Ysk6hTy4kwyiTKVZurK7ELRvS0RxWhtbVCXJ2HS1lv/LgEH1hyIP
-SwvyZ25JhcGrBAL/jpzTxdDEGsPfUSVfrUhrhDWxg0dzY+ptwdTWHqxyR2YKmOgU
-dKYIz/nK
+MIIDFTCCAf2gAwIBAgIUIWnDZc2Ul/6Jjwl1ebxLY2X2WW0wDQYJKoZIhvcNAQEL
+BQAwGjEYMBYGA1UEAwwPY2EyLmV4YW1wbGUuY29tMB4XDTIyMDgwODEyNTUwOFoX
+DTMyMDgwNTEyNTUwOFowGjEYMBYGA1UEAwwPY2EyLmV4YW1wbGUuY29tMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0u67vlS3M+Camru1bEbatPmfJaya
+Ovjr0tRzRGzos4V2x4S/j5FSM9a5K2aOaR8LzGlVqAzbBrweY0JJ4BeHmC8istkq
+0PPyVYb8w3oLyORwIOF+MxMoHyAGUgzQCPe4uSiqEU3nCtKQlw+MtDuMRYRQMh/M
+45AmUot4ZirAmkZd7UmC6HTPFMHVTmLaquvmuLV17278zKN+g8d2HRQRaSGBLVF4
+mScwulQJdpoDWdRljpa6oe6pzXjzMqcNwQd8j9zJefs6HFo1xw8DzJUO86PIPzG6
+ZLRlOUvM/D30LBwQLXEDaGxy0Lu9z8q02JX0n0/S++tOXPVB+8Q5hNtTiQIDAQAB
+o1MwUTAdBgNVHQ4EFgQUZxCwBVEPiTUcnU6bSGQaALZdPP8wHwYDVR0jBBgwFoAU
+ZxCwBVEPiTUcnU6bSGQaALZdPP8wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
+AQsFAAOCAQEAeVbg19gee+RkL8KMRshCllk2PSnAm6GqSqopAzaJqQg26r+rPWdK
+LAelyB6h/UegXzFY7D59jURoAES29Bftje+OCxVoeYVamDj/1cqqdspmTdBfGj8e
+25ys++7fl0DLTmGbpLjDFkVw52o8KF56EdZ26ZSHVCqurQACF6BmSed23NasA1VL
+a7HErJv78gR0vIDIsJfxFic2ssEkuAOL1vVTf6sJtc/mD5Q7R/inDsn2kl/7/sfo
+JRMsUvqT9glNKnrr5vLPwJGhEcS5WgpWdsFD0elB3GoHYJen8EoHYZ+gANPa2rSu
+AiwDPiHEPM9AFUZA9MQMfzsXobZP7WElWg==
 -----END CERTIFICATE-----

integration/fixtures/https/clientca/ca2.crt

@@ -1,20 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIIDMjCCAhqgAwIBAgIJAKjhXgiuPQexMA0GCSqGSIb3DQEBBQUAMBoxGDAWBgNV
-BAMTD2NhMi5leGFtcGxlLmNvbTAeFw0xNjA2MTgxMzAzMjJaFw0yNjA2MTYxMzAz
-MjJaMBoxGDAWBgNVBAMTD2NhMi5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEB
-BQADggEPADCCAQoCggEBAMx8S4U3tdeMGn1NEUNWCmD7pIYUCUhtORrn2rqF5b2M
-ZQJZXAIfWJ7KrGjn8W7KPx8/V2FREHF1Z6v1fpB2rfCIFo97HszhQEt6lduKup2j
-09ItpFjec7RahwaMksYDwl4PaxgKe2OYdLFJ/QIv8+I01vWPXFmHgZkBHQWhR5nV
-TvGM6MU834e+PXxCXfcaC8VYpbHYKYxHmM5Sxa5V9WlppBBshB0OL+KrCPXwPqHl
-StZPkG2p2qJUjCZ38uDx605RYaORZ0eDhrKj4M3lJzOTTcC4I77BzTb74+GcRT+R
-lJMrWrS22jNZONnawBdbTWIFM4PzaqVvE7qVwZK1M5UCAwEAAaN7MHkwHQYDVR0O
-BBYEFPooSq3ZvoyIzRQ96/dwUC0LDBvRMEoGA1UdIwRDMEGAFPooSq3ZvoyIzRQ9
-6/dwUC0LDBvRoR6kHDAaMRgwFgYDVQQDEw9jYTIuZXhhbXBsZS5jb22CCQCo4V4I
-rj0HsTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQCvRgu11LrF7G9X
-yuvUwBZJ8FgjAMPwXQIAYg47tlvD9ZDiZgXVulWOm6aHpT520MjNO9f0oKpsrSsh
-7bsO4GSkbTPgGekbw4P3JtXAvlBEB5uabpdmF37Pg9s7dU/MeXCElzWF+yLVAo7o
-Hj1UlENxh08FzlErNw6Djy2FZAADeSZ3LmHUl+50rrp5/DxrEhkHFm8dTTjFVPnK
-KrnYLM8R7+v2Ysk6hTy4kwyiTKVZurK7ELRvS0RxWhtbVCXJ2HS1lv/LgEH1hyIP
-SwvyZ25JhcGrBAL/jpzTxdDEGsPfUSVfrUhrhDWxg0dzY+ptwdTWHqxyR2YKmOgU
-dKYIz/nK
+MIIDFTCCAf2gAwIBAgIUIWnDZc2Ul/6Jjwl1ebxLY2X2WW0wDQYJKoZIhvcNAQEL
+BQAwGjEYMBYGA1UEAwwPY2EyLmV4YW1wbGUuY29tMB4XDTIyMDgwODEyNTUwOFoX
+DTMyMDgwNTEyNTUwOFowGjEYMBYGA1UEAwwPY2EyLmV4YW1wbGUuY29tMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0u67vlS3M+Camru1bEbatPmfJaya
+Ovjr0tRzRGzos4V2x4S/j5FSM9a5K2aOaR8LzGlVqAzbBrweY0JJ4BeHmC8istkq
+0PPyVYb8w3oLyORwIOF+MxMoHyAGUgzQCPe4uSiqEU3nCtKQlw+MtDuMRYRQMh/M
+45AmUot4ZirAmkZd7UmC6HTPFMHVTmLaquvmuLV17278zKN+g8d2HRQRaSGBLVF4
+mScwulQJdpoDWdRljpa6oe6pzXjzMqcNwQd8j9zJefs6HFo1xw8DzJUO86PIPzG6
+ZLRlOUvM/D30LBwQLXEDaGxy0Lu9z8q02JX0n0/S++tOXPVB+8Q5hNtTiQIDAQAB
+o1MwUTAdBgNVHQ4EFgQUZxCwBVEPiTUcnU6bSGQaALZdPP8wHwYDVR0jBBgwFoAU
+ZxCwBVEPiTUcnU6bSGQaALZdPP8wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
+AQsFAAOCAQEAeVbg19gee+RkL8KMRshCllk2PSnAm6GqSqopAzaJqQg26r+rPWdK
+LAelyB6h/UegXzFY7D59jURoAES29Bftje+OCxVoeYVamDj/1cqqdspmTdBfGj8e
+25ys++7fl0DLTmGbpLjDFkVw52o8KF56EdZ26ZSHVCqurQACF6BmSed23NasA1VL
+a7HErJv78gR0vIDIsJfxFic2ssEkuAOL1vVTf6sJtc/mD5Q7R/inDsn2kl/7/sfo
+JRMsUvqT9glNKnrr5vLPwJGhEcS5WgpWdsFD0elB3GoHYJen8EoHYZ+gANPa2rSu
+AiwDPiHEPM9AFUZA9MQMfzsXobZP7WElWg==
 -----END CERTIFICATE-----

integration/fixtures/https/clientca/ca2.key

@@ -1,27 +1,27 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEAzHxLhTe114wafU0RQ1YKYPukhhQJSG05GufauoXlvYxlAllc
-Ah9YnsqsaOfxbso/Hz9XYVEQcXVnq/V+kHat8IgWj3sezOFAS3qV24q6naPT0i2k
-WN5ztFqHBoySxgPCXg9rGAp7Y5h0sUn9Ai/z4jTW9Y9cWYeBmQEdBaFHmdVO8Yzo
-xTzfh749fEJd9xoLxVilsdgpjEeYzlLFrlX1aWmkEGyEHQ4v4qsI9fA+oeVK1k+Q
-banaolSMJnfy4PHrTlFho5FnR4OGsqPgzeUnM5NNwLgjvsHNNvvj4ZxFP5GUkyta
-tLbaM1k42drAF1tNYgUzg/NqpW8TupXBkrUzlQIDAQABAoIBAGFMg2LQL2Zw8+nL
-UfuIZUfgdViXEBO2ZQW4bQtzyu12cFm9y1n3MGPebEs+klL1STPFH/7eY8SY6MuZ
-9K8oyXs6RgHfw7gZNk6z9bqROFrqKVBJB3qB3uxiZv1mxjASednn3D2EP1IUqPHz
-EsCHsLRiECaoIHk5USFMtlKHe1pmmsvQrQX7EV9Qg0VSGvQlgxc/Pcg/WeB6uT6u
-CS2serWpUE2dBUTJisnUuL7F5/3JbPEPbUG4eeTcO8IafvgdOgFEc5qUlYCFFai0
-fvjSabXrJO9QE1Huw0gyC/5FHlVr5x4aJ8NzPKcMRYqn7jpdwA0eyLyBo/KtPIbJ
-6s0PFAECgYEA98cKuyaBXpPyG7/Y0C89Mzlt5+Qr0fpPksH6GEelPJVdhrdXP32W
-66ROgCVZpf2pQeCCHfXyWdZQwEdSf+8ee1DJMSNgIm4Usqp6yIDS0iZ7pPWz0KSI
-un/dm3lRE7hFMIQfbNf3rA0WD8Ani3c76eZruwQ5DNdXNOM+z1DN38UCgYEA00V4
-6UOCcA3romkXuIyeyh/tuJ6K1J3ApUxA+E42f4raSMSMgnlAwpL0Wmt11bBOmToi
-UAtwFcTfJRJSOvfmM/nd66592FAV/D4xcDIiNGh4xNDi8LSKmSj0WRYPU3YjkdFN
-SwI48LmQKMfj3P8fClazKsdcDccfO4pyhEK98ZECgYEAt8QZw1/1hw22/Lm2tgCz
-JTCswNXLYjqBldjkAenxNROaf/WucdpVeoMr7YLGEIQnakJ2fn4QtmxrC5BaMaRJ
-OTBbZ2RTQnXeR/yEf/x7X31HKrtIF7BP7/Ixi8PYTAXY2vjCzdkHScWS3S+opJlU
-CE/rCpNBNLLpbMI1rVDCv/kCgYEAkP3/sg67yQ00prx7JBOVsl/hNK/R1YMCQC8p
-838x1axEjGYfjDeM4zwZaKiRMPsTpgMIo2iGHtqCzh1Zw9B38znLPMD+6uJjhD5m
-jXpKkS8VmvVEmi89Y0mBEFacZAoS9TLwWccHruWa8vHkBror4luIEJbLLUV3wNQO
-LYjkdJECgYBcIjZ1iQiOmFL8lm/JlPOs2JcT33fjnubreHkiG42dZFN2S8D5MdU5
-JBP6IVVllPmbptw9T4wcw+bjVa0LQtQMGZLMxdx5nJp5dmFE0Pj8MjLpLy641Vlx
-5sv2O+eRpt4yCiuHcuvDrKPGTyM2YqF7ilQwSC5Cfki155InnU2QUg==
+MIIEpAIBAAKCAQEA0u67vlS3M+Camru1bEbatPmfJayaOvjr0tRzRGzos4V2x4S/
+j5FSM9a5K2aOaR8LzGlVqAzbBrweY0JJ4BeHmC8istkq0PPyVYb8w3oLyORwIOF+
+MxMoHyAGUgzQCPe4uSiqEU3nCtKQlw+MtDuMRYRQMh/M45AmUot4ZirAmkZd7UmC
+6HTPFMHVTmLaquvmuLV17278zKN+g8d2HRQRaSGBLVF4mScwulQJdpoDWdRljpa6
+oe6pzXjzMqcNwQd8j9zJefs6HFo1xw8DzJUO86PIPzG6ZLRlOUvM/D30LBwQLXED
+aGxy0Lu9z8q02JX0n0/S++tOXPVB+8Q5hNtTiQIDAQABAoIBAQCVRaORd0xLJzji
+JdKnNKFUD49jzvk6oKvrALQuCVDIsruzSKt0A2iEDQHvx90iYXktCKI4khhydLCg
+l+nF74Di3wCURwF47BpkEmpQP8+VNKxxaIKxzG3JURWH/U8/+Wc9iZyJMHNAAnGW
+pcdySO3kyFUkk8KgjIPCSLdEvh6dTcQEjWmyFQAl5DCZZZ6wbs39EFGLtFXO/27D
+nkrEyMZh1Lo5QbQjYyqhz3iJVenrc1yc2iubF+0N7iZk3xuMNhMMvbSN6YfcTYn4
+FaH4XwG0OdFUMzXeI9wEen+VA30uD464ovxbtpQrDOx7bZAHUy8nGp2zyflrvv7p
+A8KparFtAoGBAOn21mp2qfo4XihkeawQ3i/eV3b4Aqfcl+sBq0AnOlTUfdCARGx2
+ciNXgHRwODoAqWf5PtDxzH3fc4EUQWDDgpxVJNMA2yOpCwzgNePzvdv3iTBkB1My
+uplkh7pXRkLGv+qyDgy+On8xrHPhBBxMWogT57MXlmy4YYDEjAwGU+ErAoGBAObM
+kxB/tZF0VbrZCpTdnjPBH6tR+w2IUSMkgvx3YRc9Lx5TYK+TFmMkDjG/enr88rYA
+kMe6qBzfajfGZKhlaHyG/0rxnuvpJHUjD0XSpF97z6uzETjADMLcE6O48AT6cxZw
+irpO4eZG0haobSsGlka6K9bMG3KGy75NHNAIdbwbAoGATMhZbe8rsZa2MANpevK+
+OG97vOt/058trE6L6S32ksh50eeGjSICK18YJR5/FWoKLrk5yFDSj6y5t27yVdNU
+FgJLZ4QsZvOfUMZ0aS8g7AO83ki1rrRDUPwRHzJtOJUJfviYa84yXHPs6Mq8Ep1s
+SKRfsgLXty57sUrPu1KITKkCgYEA5Ix8rX/pywoKwyaeheAYA2Qg+kQKedIdltFX
+LK8C5EJgYIVsXzEmoDJaJAVbQmMt7fENbdt3EnBi/KxnjSIun/IG6K3wE+khgyWe
+wCPhRfSTJ5IBYdM8T9IjWKOQez2Prg7wMaJfrOtAq9NJl6vEMHG3a9Ne8sBtDhvK
+hm96NzUCgYBhgRVgTdkRN/mtvwwpCM6+uCKqcLxfzaP8WBPNjCpAnHUhtjTzIu6d
+rV4KmY4YwP2hpPerHTAFFF0xIGmK8LFf8yYgHZfGmU4RyXkcXPy5V/W+9HoL3BZJ
+taP552nYQgjHYS8a1b0S1KOZdi9aD1XkUAr4yYY4XjtQOAnxxV00ng==
 -----END RSA PRIVATE KEY-----

integration/fixtures/https/clientca/ca2.srl

@@ -1 +1 @@
-9EAC6D05226C2216
+9EAC6D05226C2217

integration/fixtures/https/clientca/ca3.crt

@@ -1,20 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIIDMjCCAhqgAwIBAgIJAK/JGxwwmv1jMA0GCSqGSIb3DQEBBQUAMBoxGDAWBgNV
-BAMTD2NhMy5leGFtcGxlLmNvbTAeFw0xNjA2MTgxMzAzNTNaFw0yNjA2MTYxMzAz
-NTNaMBoxGDAWBgNVBAMTD2NhMy5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEB
-BQADggEPADCCAQoCggEBAO0B9iUp5w0m1NWC9QYWhxSE/emmmKcx99DWnzKZoIbj
-TSRQtyhx+9c2z1dYAFZQpdVRSKQFn1IO8s51wlIc01KLFflz4EvSfAKZiAnkOOez
-wzVQ8JWgKfOJV/ZctFPo4xtdhQmO1+U+YgSfU0ASEhHvHbIPTUJNRTfkJsGygq4q
-/p9uA1TsjM4bh6AkiD1OlGjp0lbkzn3LLYpXWvgGsuejsdVkJS5pn2NKjkqVhhEg
-g7hKKqm8Nc3mb+vGhw/fNppN/xeOswpMPaW77LppyFoDd/OmqqWrbzn2Fqw1nELh
-zfo7AkKPyRm8eU3wSTIdmaXx1R5qPjqEmYrrDZ2HXa8CAwEAAaN7MHkwHQYDVR0O
-BBYEFMR6dBZAeGgkxwSC/62xGwLEdXCdMEoGA1UdIwRDMEGAFMR6dBZAeGgkxwSC
-/62xGwLEdXCdoR6kHDAaMRgwFgYDVQQDEw9jYTMuZXhhbXBsZS5jb22CCQCvyRsc
-MJr9YzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQB3VgvPnLEEfbj4
-Z61q8oKneklZV+WpDyWSodI6M1l/0pXJCTDRROJ37KaQHLJRQo+rMJiYKvQkCU+y
-9JhLdRdMEzy++9hIWiNbDiy3BNMUiQOS1234WVFBosQ6uXNhXbL/Anl4xgiFFRZG
-FehjPo0XRvxmBHnrnE1Rce0EmU/1bwVglu8e7mG5bs0gQrXTRlTkxvucyi+B6npF
-2vuzxj4q+KgeEYURxCt95JoULtMY2c0VifcdweYDO/2sYEhOVi1N+PhPvZxJD6vR
-CxIuT6K3nRe58b1J/f7TH/dvURIb1mVG8+EDQVqa1bzH3JfytsIVG5VL1hppQlgZ
-Y0G4haMn
+MIIDFTCCAf2gAwIBAgIUE2XAk+pNqunIIlDljfERtUQU22UwDQYJKoZIhvcNAQEL
+BQAwGjEYMBYGA1UEAwwPY2EzLmV4YW1wbGUuY29tMB4XDTIyMDgwODEyNTUzNloX
+DTMyMDgwNTEyNTUzNlowGjEYMBYGA1UEAwwPY2EzLmV4YW1wbGUuY29tMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArrtum7YU8772bC1PwTYoydk7dj0Z
+Ku0JQ/rNnesN/PG7vUmdidz5s0j181MSdogyT6tf/w0derMVwBtu1SR1eF1i0Cm2
+5MCEAn8rAz+S2DpLitM+VrgqjJUEzyAhQyGT0nXWXObU2Y483fvC59iJklKGYje7
+ezP7cfMJwOO0Ox4NRNY05qKWoLjwWvn7gGSrXeeuoJgwTpPe+aZOEi/Hf05jb4UZ
+KvJCd0SGrk4NU5PmXL7x6NjskXBDwM9hgRTvKM8J9chLqcAoq1bHJUGdIshDY190
+ReRxMSMskF3VNkTWUiOgDdRTsD8DwB4LLXPPImntwOPGo+JmIDaLAMVtZwIDAQAB
+o1MwUTAdBgNVHQ4EFgQU8DqrLr9VwRwdc5T6L2JdkFQu6/wwHwYDVR0jBBgwFoAU
+8DqrLr9VwRwdc5T6L2JdkFQu6/wwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
+AQsFAAOCAQEAplcU42Wu+cLahP5bfvDFfLR9DkSwKZH1GizByMT7g0AqfZdvGL18
+vmV8K/SRd0VKsfrjmOHtgkEM9xbESyIAWZmPNcSu+oQOr52TKSh5p3IXn53KT+Z2
+7xM0yWXSRj9UERmuA3SXYjBRUnFp6GGelsOGRjT4nExIWanGif7U3oYVle9hBucH
+5eLn+nhEausv2vGI18Lx4N25/7ieIryWcwlkvGtRl0rB5Pcp75BnSOFeN7DXhNLm
+zmBD5SQHLDBBnVNI9/JQm414yL7o0/NHQzoGLnvCCJYUk8i1IxwFgS5XC9aQrI+H
+0r/OlDjA9zI+n9QpmYPhjAoNnNeUgCg58w==
 -----END CERTIFICATE-----

integration/fixtures/https/clientca/ca3.key

@@ -1,27 +1,27 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEA7QH2JSnnDSbU1YL1BhaHFIT96aaYpzH30NafMpmghuNNJFC3
-KHH71zbPV1gAVlCl1VFIpAWfUg7yznXCUhzTUosV+XPgS9J8ApmICeQ457PDNVDw
-laAp84lX9ly0U+jjG12FCY7X5T5iBJ9TQBISEe8dsg9NQk1FN+QmwbKCrir+n24D
-VOyMzhuHoCSIPU6UaOnSVuTOfcstilda+Aay56Ox1WQlLmmfY0qOSpWGESCDuEoq
-qbw1zeZv68aHD982mk3/F46zCkw9pbvsumnIWgN386aqpatvOfYWrDWcQuHN+jsC
-Qo/JGbx5TfBJMh2ZpfHVHmo+OoSZiusNnYddrwIDAQABAoIBAD87j71YkaFro8sX
-NmIabo2l8cx9uyqYZUKdkDnCzRZP3Iv80PEEgClqISVvgB+HQsdH+XZxXZFaFaPJ
-vT+FG0hhfUphhQ0VqipTZf0lm50N094MqzNwWOD12rcLAr2EW9s4Nz9WkflCjIop
-K9/jMlkAj86q0HUJApen0kNJah4nLPnkqKC9BQipGe2goERHA5N8MS/k/ODJrOzI
-qdD77wE5oov5sIePsGp3zCKNw89qoVTfkH8eYos6lPsAibYfgm5z7LwEtfe0ZizG
-myQfAYZx3Orl2eNxAb0c1dw+hNYKfeNAwn6h4J8AKuBHawZMb2ztlTj0ZludrhQC
-VuwAcrkCgYEA9sFsszjoSO8pXDnbaQ8UNGwy+C1t0fcZIOxIebKPcfipGio0R9vr
-SXEEfRQb+YdIFkQpe4hwAHt1Q75zh8z+oOTq8EHprxAwI9bzgyaEIHtGibvs99XT
-iWSPtL274CISiwSL8NzMl/orD6sDhmJqiXhwtf2SDubUJu3gz13CeRsCgYEA9eMM
-CYiOc4wLxKqyCqe3R86vnBFVauxp9eq9XTLvD+XoGqOksXupP8rE0jx26ILmKiQZ
-z99MGJoQicEpo+BW3L9wr6OJQZSrs+NqWCxlmFRJL+p3sw53B4zjgYaimNl5KH4G
-8pn7XbyRXtqhSBQ2kuNrkVI4SNxdEi1K+PoZ6v0CgYEAkwVcRsy5WftloVW3rTkW
-yMVO+R/YNyoLBtrBtAD4BugpmTVcQRR/dBqqmfvJTzuTb/Dc5oW8dg0ZKWvoWhmB
-/Utn0A71tSDoDfKc1J+2ScQpmxclceUtTMdl+EK0Fi827S2gU7q7DDI6RfOW/hLV
-d2MThNu4krhl32wMboFmxdECgYACwAhZbvKQ7kcPaw1Uuy18mx4xs6vt5zkELBz0
-Fua/mcWvzpa/+W8aLI1pAI4f6Z7jZ8X2Ijw6pjZ7I/LwR0kRbP64qC6X0i7dczS0
-ScLVIlQzOf8evJGuPvAoebYF2aDWSBqRyhEaqkpB8lYNdVRq7io81NuWTQipdGI7
-SKjTjQKBgBNSbDUWS2CAc+fsM/fBvYHKgrigVcKyvWwvb5LRXpWgPQH4LbqhG4uA
-g/mFTB5B1UBg9exN/dX6uegREdRA1/X+jRAzCqXYTFESo0/UrJhJQZ3waFKJ5PZK
-WChrSl6Lg5IMF2jYP5W0HwzbPPgRGibyELYBS5gZdAZpHgZToXeT
+MIIEpQIBAAKCAQEArrtum7YU8772bC1PwTYoydk7dj0ZKu0JQ/rNnesN/PG7vUmd
+idz5s0j181MSdogyT6tf/w0derMVwBtu1SR1eF1i0Cm25MCEAn8rAz+S2DpLitM+
+VrgqjJUEzyAhQyGT0nXWXObU2Y483fvC59iJklKGYje7ezP7cfMJwOO0Ox4NRNY0
+5qKWoLjwWvn7gGSrXeeuoJgwTpPe+aZOEi/Hf05jb4UZKvJCd0SGrk4NU5PmXL7x
+6NjskXBDwM9hgRTvKM8J9chLqcAoq1bHJUGdIshDY190ReRxMSMskF3VNkTWUiOg
+DdRTsD8DwB4LLXPPImntwOPGo+JmIDaLAMVtZwIDAQABAoIBAGG+fdhjGgNkHstS
+6ZuGpXiMqaOx+AM4SAecJCuj0tZdj40KwjLdx10Qgm1UWi6ub557mp69gnEh/xfR
+AMYAuCnV67HQs/vw6afP5YrSpF2K9rk5BFVUfpDXx7HqIlFAVkXUH08m3Yi59bij
+3lr9ma+dtIj67ki0QoNy1lDtz+OFNkwOcga+Z5hMphJIBjL0kxO5AFPYdm6D4qBU
+vpryujop5N0nCiN9FMtsGTDSBR4Ytz1gTYnYTc+1cLZ+u3/+x7hMVoEhFzaR0RQN
+1KXJE/1kwlz4kIBpgYcI0+Rh/kfQ1RWXgLej1NOex5d4RB7a2wH/Kg70JdPzwGKk
+kk8rhzECgYEA3CtpwO267FNGqghk0BEp0J07PLvcQjeRR1rCxRYXb/9xMEtW6p7e
+OEaVT9P8yXs4hWExWcQIIUsyK01men97lSbV+5JOT93KZwQpeLUV0QwhE0srZ43M
+dCAQEOIy7yyvW4DnB4AWduRHiSkiS3eHpe393YqoSrYmkp3jzDz90YkCgYEAyysH
+gfb175iLtfc0Lkww+TW/khmE8BK8AEy9SktgZ3Ey+jzEkgkrGjLNDg1jjbzC/uZ0
+OBQ9QwRbb0iZ/DVOMI6CoK1RBP7ddyV7+Ie/TGyCchBZGshn2/3umiALo3Tzv+Oh
+7fes5Aq19r5zpB7QEdkXc4A297pM9NXvzgnFO28CgYEAm5t3R+r9dK+6vsvl7IRk
+6FNoHZmsp4Q8gpDsHX1qnTaN2hM1X+deqamBOAVcoU4ceXBi/82j7VwHHkG7DxLw
+1k63Z/FUte/McJipcu2ReMk4yzkSeULn4J8Um8ozM4WCfoqRPmTR+7+Fq7RNz8aw
+MZ8OELlCDmPEyVUcPipRPfkCgYEAtNtlH4icfeEp3Z5l0SD6J551HrWg5aWHviyS
+BOT8uJjIbIJT6jxHJlc6utuoV7BFVWwI4TMDJflm+7WBfkZliEwUdLxUd0H6G+o+
+ZYtR+9JMfQWYjIMCEZAHKySDt8qQga09pPzp50axnSkFAIB9cKX0flkQlY4+m2Um
+yB9id/kCgYEAn3f8W70IS+IB/B1p4v38FFF6MRLcaio7G1favMw8mZU/k0B4a0yh
+fMHANkv0XQHvpw+KBbikK3hvQF4iaBE62mMaULKaJ/D7npzyJpYrgIkx1dYiqL5O
+KnMLaUmTpvyksSztyaPSytoQCKV03XeIUGGAPq8KpDZOB0oy1arFIL8=
 -----END RSA PRIVATE KEY-----

integration/fixtures/https/clientca/ca3.srl

@@ -1 +1 @@
-813218563E2DA0DE
+813218563E2DA0DF

integration/fixtures/https/clientca/client1.crt

@@ -1,17 +1,17 @@
 -----BEGIN CERTIFICATE-----
-MIICszCCAZsCCQCD6B82WZ9D/jANBgkqhkiG9w0BAQUFADAaMRgwFgYDVQQDEw9j
-YTEuZXhhbXBsZS5jb20wHhcNMTYwNjE4MTMzODQ0WhcNMjYwNjE2MTMzODQ0WjAd
-MRswGQYDVQQDExJjbGllbjEuZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUA
-A4IBDwAwggEKAoIBAQDH75aclHoZkQfmeH3XpapxyF2/K73SpesY8Y8I3B33WnQc
-vIy5y554pPJMtGH3ZwiN6ifo3TBEs/2WjSOWYwxfXh3utllYArApelSgUrI7SBkw
-0MqVm9NG+X9cCTeWsCf+nldHOCnCARuyBEpLeRDPVlNmfgdNK2ar0KqqEPnN5UV+
-k968nAuqSDtRL7Yl7R/uxEq4MglM/ocxOpGIrLTFh1eclPVaQ/dNsEJpkrnYQlFZ
-aI1sWDzWoqtpAO15PgBBNnkW9EJGrF8dAds64U2jYBZLMKuHwvuERkEgOKEdUrB3
-uu1dWJxS5BCumWM1C3xs6qsLeonWxZ5GXjjWObZNAgMBAAEwDQYJKoZIhvcNAQEF
-BQADggEBAJKME0zm/0eokmXMCLJhKYgm8hDKOHKRFRZl7vwy9SC9cwhdlhcPEeeP
-5M+dXQCtEQWgo7phoJX8nBipZ/Y0lsvDD/I3XucIkUlbOW4rk18L83nBIN4paKzW
-I4CMJ6FQ72thP7L7wC/lzp3+qUCxmcpGjw9pkU3b1pQPkxBfOvfGtRFMG6E5+xj/
-MtL3owJzpIH2f7vtmIszBPcgFWpvB0Sq0eJ+TwuC1huvcnmP+YZ7Iz0JhsSRw+pU
-yiO9ByItBbGfK8x+DfUwCVsCL7vNscpjvTCgT3x2FNvS+XmiHZmZtpRGJPzvdI0m
-Bd615VD5z+SoG/SiemqDGmt2Ank/zcI=
+MIICszCCAZsCCQCD6B82WZ9EAjANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDDA9j
+YTEuZXhhbXBsZS5jb20wHhcNMjIwODA4MTMwMzMwWhcNMzIwODA1MTMwMzMwWjAd
+MRswGQYDVQQDDBJjbGllbjEuZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQDqLbCPwvQFGcxCDL4Q/ccmd4OsHYkFNuGt6teqGPuFBphx
+7BUdPB3Q8A4SK5pX4m8YbXQeB563Q1PWW3Sx4sDtZA+vmkq5bOaFXnrDULGHAwAX
+4SiLcqISKOnO/Bu8h2L8LOjL5eGJUKON0zfSP5/NHS0kDG5auiTfsStzWJd99kxj
+CZKsSHfxzWwPQRPle6g0UHF2n+ezF2D+dXQorkECsVyAUB5vaN2lX6e6Sb3r0j/C
+UaqMrnVKzTQDaQxzi2R2BnRZ22VaA4dDVk9ZCnm4VbFHLjPIroyIbxF7yqhY2E6y
+GkyxLo4squP1xm85pM/aNbCCejZuuOKOywmOn8TbAgMBAAEwDQYJKoZIhvcNAQEL
+BQADggEBAESVbNkdM6p3MJ6Mvf3Wkm3wRXvdEx5RZo1VKqpNDga1MvNqdN5GBMH+
+dmzMHuIgFAIuBbpdDqf1qkOTYm8ZuJib6fbUym6KeRY4VfHiYhB12OC4m9szXU7W
+/9/KkNrZ+mufslqpILkeH3gTyV21q5OWw8c2DESTOhRwpTb3n4Wl4H1p5c/2Q4CA
+2p0wgeF/ccAf50cmWMVL3Itg5IuuTMxfsobk/yukiYzjSfOuyC6QxxrbHYnX4QmT
+smMwpA3fqbMOE5ix0HiW1oBfMENtKltcJ2VyGAVItVq+/yrOFIjgJwSQGZygeN+G
+lCkaLE7P3IOohkZc/Oo7rlaImVQ+wMc=
 -----END CERTIFICATE-----

integration/fixtures/https/clientca/client1.csr

@@ -1,15 +1,15 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIICYjCCAUoCAQAwHTEbMBkGA1UEAxMSY2xpZW4xLmV4YW1wbGUuY29tMIIBIjAN
-BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx++WnJR6GZEH5nh916Wqcchdvyu9
-0qXrGPGPCNwd91p0HLyMucueeKTyTLRh92cIjeon6N0wRLP9lo0jlmMMX14d7rZZ
-WAKwKXpUoFKyO0gZMNDKlZvTRvl/XAk3lrAn/p5XRzgpwgEbsgRKS3kQz1ZTZn4H
-TStmq9CqqhD5zeVFfpPevJwLqkg7US+2Je0f7sRKuDIJTP6HMTqRiKy0xYdXnJT1
-WkP3TbBCaZK52EJRWWiNbFg81qKraQDteT4AQTZ5FvRCRqxfHQHbOuFNo2AWSzCr
-h8L7hEZBIDihHVKwd7rtXVicUuQQrpljNQt8bOqrC3qJ1sWeRl441jm2TQIDAQAB
-oAAwDQYJKoZIhvcNAQEFBQADggEBAEZ67vahAVydtW6LTXFI0cVY88vqunCWpOzz
-UgJAzUnWG84CGDiyezj/llv/Nq3YbEEpBuxp/prOEwrJXAi/+tjx7wCh2iLJDqo2
-aNRUiAvR/XZgafxq4NUrAze70u7BWR3QX+XSaxmIEEX1z1KJDGTfY6tYpCZNlUr+
-/Hl6MXwlpWX0WR26zIrjx5u0dEsY4pviN6NxTZRQJxbQO1H1wHr6poVngOhIdErp
-h2ZcqvTcASTkIEdKR6R8E2iYklgxIHNLWKaHZ6aBqW7lW17WKNSiGPfPVAtFhUTk
-tBmgdVreAwMj+AdaweBVt0uBqb/9UKhqNThEnh4kJn1I0pMJzP4=
+MIICYjCCAUoCAQAwHTEbMBkGA1UEAwwSY2xpZW4xLmV4YW1wbGUuY29tMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6i2wj8L0BRnMQgy+EP3HJneDrB2J
+BTbhrerXqhj7hQaYcewVHTwd0PAOEiuaV+JvGG10Hgeet0NT1lt0seLA7WQPr5pK
+uWzmhV56w1CxhwMAF+Eoi3KiEijpzvwbvIdi/Czoy+XhiVCjjdM30j+fzR0tJAxu
+Wrok37Erc1iXffZMYwmSrEh38c1sD0ET5XuoNFBxdp/nsxdg/nV0KK5BArFcgFAe
+b2jdpV+nukm969I/wlGqjK51Ss00A2kMc4tkdgZ0WdtlWgOHQ1ZPWQp5uFWxRy4z
+yK6MiG8Re8qoWNhOshpMsS6OLKrj9cZvOaTP2jWwgno2brjijssJjp/E2wIDAQAB
+oAAwDQYJKoZIhvcNAQELBQADggEBACOz/5DF2ViRsYPDIaffzBKcnqSDI5Z8k3C4
+TsWukD2PywYErdDFx6lqcIk5u66JK+wEPDHkLgdIqy/NjSbgKwOOpRheOX8QtD4C
+VVK92T0lmFBcITLToxKnaRvX8udLiQQgmGdJ2XHNSkbkOkdRsGJX6iD1s9TcQ4cY
+NV2s7M2HlOxyQH4bXcYyeH0YKHep0mdKssh17ppRRQ4kClubderZqulCCAjXvrpV
+hM0/qqPBQd6MO0bWccSBUkl0+ZhWCIxaYEEaTKTsAVeoErT+5qufLgpKVGnYsXS0
+hl3KU4E/NcyRl2gUy+T9467r2OdfojW1swxFpj6i2Kf1HKtsxqs=
 -----END CERTIFICATE REQUEST-----

integration/fixtures/https/clientca/client1.key

@@ -1,27 +1,27 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIEpQIBAAKCAQEAx++WnJR6GZEH5nh916Wqcchdvyu90qXrGPGPCNwd91p0HLyM
-ucueeKTyTLRh92cIjeon6N0wRLP9lo0jlmMMX14d7rZZWAKwKXpUoFKyO0gZMNDK
-lZvTRvl/XAk3lrAn/p5XRzgpwgEbsgRKS3kQz1ZTZn4HTStmq9CqqhD5zeVFfpPe
-vJwLqkg7US+2Je0f7sRKuDIJTP6HMTqRiKy0xYdXnJT1WkP3TbBCaZK52EJRWWiN
-bFg81qKraQDteT4AQTZ5FvRCRqxfHQHbOuFNo2AWSzCrh8L7hEZBIDihHVKwd7rt
-XVicUuQQrpljNQt8bOqrC3qJ1sWeRl441jm2TQIDAQABAoIBAQCtD942uu7VooxM
-GpATUfsvclhzWdF9vNC7TpyY9q+ZpFpNZYgKaw5JL73sV1dVZ4IoFT9mec+GKKag
-4pqjWikjg7w1HPJJFEqYHKOUAwDz/3yOnKw+xBslnGF5sSDE9sYnx7eUljDPFVZ7
-yOrmWW0Li5W1afG4ApFkt8KCYx9X8E0Mren2nfqoobM2l2LKFcF1Xs+M0iUAOoeN
-ojS/NTvxjZibm92CMblp7x6e51y+oq3TJFoUwFSAj3U26jyubL5sYpJeAeTxyZg6
-Y+UcEGmCpW5gsZSvRxvNxzCS4bCl9KOZXvyFtcVswHppfTynba6x8hDF7LkfJS7H
-z/Ut+e+hAoGBAO2d2M2316eBpwP7x99DQSFpg7E/emdcfdRuHDEonBeJr2X2Fw0a
-O/ZtUxcccovy4wrJcqiZsmjqetRUZ6ymsOaaASsPG21ChegFjm9D6+ZtejHpbuo3
-8HQ//LW7hqoiRQh3ODihfYCTwwxIIuwAdUzoxpM9Yu57Zg7reYuNh48LAoGBANdn
-c003ay1cq1fuuDJKENj10UZGotRdBxt+X1A7MhpMAqSaYJ+V2XOXpuMbIiX/qDfF
-M4hcQhJygoCozNzsynztyIjpGtl57AG95igOi2Hah0OOMt/1Z9UwaukIaHHo8Tyk
-sPZYoxBTstZcdsyHnGdU6n90SA9oYLBB89E3AocHAoGBAITR27M6FTCLl2jxn0qc
-FFbx3OwB2JDYMXnBxr5vvbimfMWYpk/rnyLi/zQG8bxqmyCXdCDsML7WeqwfNgha
-8L0lzotcGW+cZK9KE9D7/WvDPC+UFSyU8jJ45fBLjz2ghEf0JBf7pORvM/K0i9ix
-dN/1qbH5+Ufm8Chc1Yb9KI37AoGAAbxDoYugwWzNtJenxD/0gsr4NKi9Bxj4xa/u
-9KaFcNDL9KeJv79lURkXrxy42bWFlW1xTNfxcFSb2I2DmQQPXZJM202FedsRm7H7
-+LalSNSJ4nFy13sSqxUIx3fZ35EQ4HwzMMjmB2ulNTTpgBxXlj2I5h35tqYQoVrm
-q/jVfGECgYEAkU0L9bp1NPMzXgVJ2Os1VPSzoOywUQfx4NCJhTA1oZR+20JFsQBN
-b6g0q6xean0xDuXjDRrjPET5V/GPOQ7stAPTLtqN42XPuRcFzSNj7Skh+ALTP5JS
-bNZgBMwxQsbS89bUjRTDlRK/isuNIyUn0Zn7QlEsZEvJw0cNR3wPOc4=
+MIIEpQIBAAKCAQEA6i2wj8L0BRnMQgy+EP3HJneDrB2JBTbhrerXqhj7hQaYcewV
+HTwd0PAOEiuaV+JvGG10Hgeet0NT1lt0seLA7WQPr5pKuWzmhV56w1CxhwMAF+Eo
+i3KiEijpzvwbvIdi/Czoy+XhiVCjjdM30j+fzR0tJAxuWrok37Erc1iXffZMYwmS
+rEh38c1sD0ET5XuoNFBxdp/nsxdg/nV0KK5BArFcgFAeb2jdpV+nukm969I/wlGq
+jK51Ss00A2kMc4tkdgZ0WdtlWgOHQ1ZPWQp5uFWxRy4zyK6MiG8Re8qoWNhOshpM
+sS6OLKrj9cZvOaTP2jWwgno2brjijssJjp/E2wIDAQABAoIBAQCMX8kH1DAcYqN7
+MFI6szVOzLOEV8wL8SME8tJGZ2VWD2cQWxkpBiFFXrDAmZySc+xucyX43k54woYd
+54KjIy7M3n88nzuNvUbNyZ3DOLrCGL1UkyaPuK6IPjgxWBR0RZ/DVFRT7T/t5QW1
+fVhn0rXC6WtmwYDhJ9X0tSo7oW5mFTl5PvF8SG5W2AKjmgnub+NsUO+MGVHqoD+l
+Rl2WIkX8tA1ZtHlcr21KoyPq53mRGThwPbhwUmoNeJdSYoQi6iqYQUVl9EufGgcp
+QLZ40/qle2M6Lo9RrBNlDLUWg7zSTCiBgkVNax6gJeUffqIZJ0laz8/KEJVCLLrZ
+xZwW9/6hAoGBAPv3RCF4F76kXuH2gsW95joLp0sV8XEG4GSWAKhQEMA2oYnnKnFO
+zy+LxZ8e/nRG9DK59KKwn1luX2s5TNokt+S+7MbRUiCPCULW1yzD/QFLmIA2UOkD
+8b3As29xmBSi7bulwgX0NAVEXT83pq4CY5SmmrIcZ0BvtYItYrIA5X7rAoGBAO3t
+hKnh/EZvRQUQsOxpKrD1PKG/WpOoi4DCyaKgS1EDDDFPdBNdB25KSj+rrIldbbde
+2V+wP+ozHrOfxguT4R1xpgTipD/t0tJA0vBX2M0VegI1arCgScxDl08nvpMtEFUK
+H8lCQ5c98IPESKD3l8D4plXEGRPqNnCBad4l1bXRAoGBAKgjL9a5wfaYzywwiMGV
+4E05u5BSe0R2V0UoCBZJH3R0wEU6+kqUUZOjzONLFnfXZVt4VbQ+8ocGLSxrF0q2
+l/RQJ8bgpdJOQNrWbM5Vlr7HiGN+W22zER0Tu2mRvu9+be/7Q8cfV5twLF1kMJkL
+xRHMP4y9gXUxVkkhKiwohvyzAoGASLbHTZgIHoqRAGxKdeXqKyy3vAMcLnZbNB3T
+u8TbX8XbqxJKOkS7KaTArlbMIysPhfQR4OGflvbKkkDpKM6oBPSftWyCoBsRzDoN
+fXCLjJncsOIcWiCSjT+29XUDFD24eRTgBAUhXQ6L++k3/SHOGiajxyBoPaLdwmJ6
+tW7AspECgYEAhk0jBX8R9cAXXuXs89vkMMFNlDSA+FgeQJrTEh/Rl8Shvfq9dZGB
++QrCGMWPJLB/bK6xU5pARkA2arLY+3+fX+OvuOSSk3nV2lf72HHlkd1Lt8nnoTO2
+Wd9Lh6UaZt+sYsOOH35RgIMmAc6Lm1RC0JOamidqfk1LmY/pG03oAJA=
 -----END RSA PRIVATE KEY-----

integration/fixtures/https/clientca/client2.crt

@@ -1,17 +1,17 @@
 -----BEGIN CERTIFICATE-----
-MIICtDCCAZwCCQCerG0FImwiFjANBgkqhkiG9w0BAQUFADAaMRgwFgYDVQQDEw9j
-YTIuZXhhbXBsZS5jb20wHhcNMTYwNjE4MTgxNDUxWhcNMjYwNjE2MTgxNDUxWjAe
-MRwwGgYDVQQDExNjbGllbnQyLmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEA9LaFxeiG1qpBTUIEl2vxvojOSWR1xkayaGtGsXBuqucf
-wifulsVC7dw+t7lW42pWutIuR98iflAZ9+tFX7TsEITNIyV64ePn9TF935LW2DFm
-AFkqYdZcTJ4qOkdsbbiHznlaIDPbMhIZFd9L8NEhrDTHuTtCav3g5B5V4okJfeNh
-iSpKm3WLHP6lFwG1RISLhHTCeIMFxer49iHiQ+A33TV2l0bQGcv4e1+OoRsXGKGs
-3oY6RJZ0GqzjeYqoybsLGBvZPPd2e8nH3RZac66XHMexsHHTV7L2tpWZm+JunMRg
-hMXONc0b3V9mbUdrjHY/aGDPADEevZA4LLztGUc3VQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4IBAQCFo6IXUznH/iSuJtWrMtMkJTEg7o2qKRDgFApzw1J2URdvyYery15w
-6FddKFvkYhNLFl9Nb3Z8HLxruZrrItqwjR2kIG9lW00uxnwIcgwTibmwDQL5nr7m
-1cWzelhY/TVwBpLXRMg1YOXU8NRkT1VjkTUCpyIETI8b+wed67MkrofOadaY+FUL
-gk1F3yDKz35UYIKnlxKwvrdySE8WFza0PmiXQDtTG1moTpe1BDEK1b60vhfudMBK
-9vhE8kTooF01+su9gLUcrjVknI9H5PHtXID7FDiZ/disIAaWqSQLuvg/Kvb/cAFd
-PwTKgnJQVcTKXkz2leJ6fsvzYwlANob1
+MIICtDCCAZwCCQCerG0FImwiFzANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDDA9j
+YTIuZXhhbXBsZS5jb20wHhcNMjIwODA4MTMzODE4WhcNMzIwODA1MTMzODE4WjAe
+MRwwGgYDVQQDDBNjbGllbnQyLmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAtWkvtUsFBD7REZmm8pUK0ZqOdIIpA5PJgqrrLQ6AOSJ9
+Z7RQq7BJv8f520FjswIQH4o9PdGYjm9JLSfiRto6hmwB/51BT9Km+WkdT+UNBGu6
+uK7dTbN3BUpei+dbzGxdmBagufQrlK9fkjIF80ZZXmE0c5weLUrhW+E0CPiFeJeH
+oyJf9QcLu2GVmS0Yf3izsBhb0c6JxVG9ZDYiM+EspJZOf5ziSB5D4eEBwvYOzU7l
+SwJBdfSYd91oLy2BSvgCgaSRJroANhD+PwBN8Jop7KIQ/bFgg7J/JFfZEWnh3GIC
+OZsFUbfy+bk66HReoWdr7+0FsWUL7z7YFRuykJFPtQIDAQABMA0GCSqGSIb3DQEB
+CwUAA4IBAQBHutUEmIdT2ZoLYs+S9eXYQlOe8R2ayPBnQTr+Hbb7YRSIeSAJUU/y
+eY3GsPJp3nYa0gWMap6yb2n6pAdLXwqq75rnu82ktf1Y0dx3LBO7VOZ1LwIsn/QH
+bDuH0RdWTGRkS0Bgnd/sSzalxMwHHl23rc0OQVtM4moxeOGs6UxgSZPpTc6nr7sr
+D8wbIMLZjcIiyT+bQ94gVA2d90k50VuG78F0BOJ6DVbpfZQM33tDdiLuxWaR3vAg
+dLZs0oscCGuIDUqW2vJ7jCzWqTOybsWLIzjSeOBQjOWKtofFgCt9JaccaAHeNVqC
+6PYAQLes0qApVjAf0X0lcNrac9rUZame
 -----END CERTIFICATE-----

integration/fixtures/https/clientca/client2.csr

@@ -1,15 +1,15 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIICYzCCAUsCAQAwHjEcMBoGA1UEAxMTY2xpZW50Mi5leGFtcGxlLmNvbTCCASIw
-DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPS2hcXohtaqQU1CBJdr8b6Izklk
-dcZGsmhrRrFwbqrnH8In7pbFQu3cPre5VuNqVrrSLkffIn5QGffrRV+07BCEzSMl
-euHj5/Uxfd+S1tgxZgBZKmHWXEyeKjpHbG24h855WiAz2zISGRXfS/DRIaw0x7k7
-Qmr94OQeVeKJCX3jYYkqSpt1ixz+pRcBtUSEi4R0wniDBcXq+PYh4kPgN901dpdG
-0BnL+HtfjqEbFxihrN6GOkSWdBqs43mKqMm7Cxgb2Tz3dnvJx90WWnOulxzHsbBx
-01ey9raVmZvibpzEYITFzjXNG91fZm1Ha4x2P2hgzwAxHr2QOCy87RlHN1UCAwEA
-AaAAMA0GCSqGSIb3DQEBBQUAA4IBAQDHvJVKkKIqCWrJ9sZWQEYBaki76woJMjFW
-Ihyd12mzNfUW25hqfk7stablqu+CM/DhwOqLkxQleGAlp0BFo1wBOUDOgfrH5NVS
-9lAl7L/roEyRGH6V5/Hsbwi8zDsGOzWCuZk/gNGIZpB1c3TRXBUHsdqpz9FReDZf
-0HRD/7CH8hl96ZQTqhHE6+ysHzBB/4CuqbXVtTEhH52FdzCOpt5X0D6Pl/3lNlVd
-gMHAssoEa5E00XtjeJdxXuIKYbGLgldj6v+hHFX7k9UNveAXgYBbGtUQ9gA+uEf/
-qosVPEyvULj3aCJ8BSBulzPlhl9rNa/8Q1qUmzyCj28j3E4I22Oo
+MIICYzCCAUsCAQAwHjEcMBoGA1UEAwwTY2xpZW50Mi5leGFtcGxlLmNvbTCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALVpL7VLBQQ+0RGZpvKVCtGajnSC
+KQOTyYKq6y0OgDkifWe0UKuwSb/H+dtBY7MCEB+KPT3RmI5vSS0n4kbaOoZsAf+d
+QU/SpvlpHU/lDQRruriu3U2zdwVKXovnW8xsXZgWoLn0K5SvX5IyBfNGWV5hNHOc
+Hi1K4VvhNAj4hXiXh6MiX/UHC7thlZktGH94s7AYW9HOicVRvWQ2IjPhLKSWTn+c
+4kgeQ+HhAcL2Ds1O5UsCQXX0mHfdaC8tgUr4AoGkkSa6ADYQ/j8ATfCaKeyiEP2x
+YIOyfyRX2RFp4dxiAjmbBVG38vm5Ouh0XqFna+/tBbFlC+8+2BUbspCRT7UCAwEA
+AaAAMA0GCSqGSIb3DQEBCwUAA4IBAQCQQiJafbDXvE99jRB61vHVKYvyznpVAbKh
+OJB5dXmfGfMmWMDN3Ci6w3+eLLHmz4Fg2s2vXzR0zKb5G1r+1Pj3a54shryrkAGV
++pFc2pneNJdYS6OpQZiv4i/ibPlXX4sYQwrxymkwdiAYekXQO5GxhKvZtRC+T4Sn
+lEx8XODGioHIk0858/zACT1uhwYLuK3LS27DlLXKOEhJ/SBudmUrpq1Xjx6nM6A7
+T/4lxsWeqb5RTmcMIoFs+bwMMuwASP67itzRz2GAimbgxzW//gp9ZViO94Lwz5uS
+4/d1LsX8pWdp2PR5H0JHpI+vHmEazXGzNmpFJIPOY/3uQuicv+lB
 -----END CERTIFICATE REQUEST-----

integration/fixtures/https/clientca/client2.key

@@ -1,27 +1,27 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIEpQIBAAKCAQEA9LaFxeiG1qpBTUIEl2vxvojOSWR1xkayaGtGsXBuqucfwifu
-lsVC7dw+t7lW42pWutIuR98iflAZ9+tFX7TsEITNIyV64ePn9TF935LW2DFmAFkq
-YdZcTJ4qOkdsbbiHznlaIDPbMhIZFd9L8NEhrDTHuTtCav3g5B5V4okJfeNhiSpK
-m3WLHP6lFwG1RISLhHTCeIMFxer49iHiQ+A33TV2l0bQGcv4e1+OoRsXGKGs3oY6
-RJZ0GqzjeYqoybsLGBvZPPd2e8nH3RZac66XHMexsHHTV7L2tpWZm+JunMRghMXO
-Nc0b3V9mbUdrjHY/aGDPADEevZA4LLztGUc3VQIDAQABAoIBAQDRxjVetjoAgup/
-w/wToeEVqEjN+WRMmAYQJQXwzaTQtFgxI/IPJQJ+zLKm5CZrxJichdhOnCUBisD4
-GaLarElAz9baLiLsyWXqdoakxUePBKmf2s/OFugAdgVU+C0m0Wz5vmVX/ZwFjCYc
-7dI3mc73xDcBvp7tAL1sT+Tn0PlmA3xURssiqC0J+4EtYzfHl1MvcQuU8JsVQjO3
-GvGWMr9EBO3oPa6yx3oWD4dn7xHLcCkuSJ6arIvASEaTyPg0Iu7roPrC7AXA+oGq
-+fbzJMqYZW6pMb8HZmxMt7X/srEq1kiyMYFy5fr+aun/vQ6596xjfFroEENJQY96
-+jir0biBAoGBAPutA9/2yo/fchRWLgpsWZ1SLXRWewFYqxlA7DluYXvqciYCXuKe
-S/+gLqHklHsc8YUwbEgW2oI9GPJ3iQps6XVNBaF9GvGjSrA+R6Ha3IT9ZUgvN4/d
-WOYiNRw5+eZ5PfxTufNK6EwXNwKR/siGEnWJ8AH0oNibTVzJHvMYSP2ZAoGBAPjq
-4a9MV6X7eShKHJtkqp33WWQWa3bidlmthhxjhPFlVnjJDj70oKGT5b/YcEFGBxPN
-JvTFJplQe0kLaeC49fPaEefARJe+HuCfUc1C73/q2o0pzvWf6Ut+W8ZZLKSC7aHH
-ZFAiZeMzzbCiqAbAAQFIgDp6m2U9mRYPTxKskoUdAoGBAMPEJzl1XMdhBfnvt0yA
-T4ziOV0/T9sSP7UbHSTnSYj8KuKKAYjBnVgwH1Xq2dyR/QSfT/sbW8jnAZrJhJ3J
-bifCS9j72ZOQcy54o3uxJMuF19y4bb3IbbhFb46PQmYWdTLrZb9ryxo1DKNBMTCF
-qaIoM7sxsFQNKbY884ggodYxAoGBAIbKopXL0HbIe65um5kmZSIPjK+fWGhTb+VW
-CxaaaaZSywWzUmyTCd0VesdtjDQ8mJ6HbH4FuMYzB9/hN1+CqWV4hFOsETjeslfO
-znxJr+nkIp9osXLfOnUwIsCBD6SyZb5CfDbMucHUDqGFI1osZR7txMpmFHo5ZgnF
-Fnu1Sc6dAoGAbgA9Cf6y8JGwr4/zGPDtaemBTLYMD8m/emdqGPgR7yVWXP/jTMqi
-o1EEWtpehALZMVZOsmSg7C/1J+nlHbuxPKsjjYK+V7aGsqXGx95lPyemd2cGcJN4
-fgoCyCahp2BnVCp7Gm3B/AzeZlH7n23qvbkJOsKGuocDycR9TIud+fk=
+MIIEpQIBAAKCAQEAtWkvtUsFBD7REZmm8pUK0ZqOdIIpA5PJgqrrLQ6AOSJ9Z7RQ
+q7BJv8f520FjswIQH4o9PdGYjm9JLSfiRto6hmwB/51BT9Km+WkdT+UNBGu6uK7d
+TbN3BUpei+dbzGxdmBagufQrlK9fkjIF80ZZXmE0c5weLUrhW+E0CPiFeJeHoyJf
+9QcLu2GVmS0Yf3izsBhb0c6JxVG9ZDYiM+EspJZOf5ziSB5D4eEBwvYOzU7lSwJB
+dfSYd91oLy2BSvgCgaSRJroANhD+PwBN8Jop7KIQ/bFgg7J/JFfZEWnh3GICOZsF
+Ubfy+bk66HReoWdr7+0FsWUL7z7YFRuykJFPtQIDAQABAoIBABSnw1zbC9kt5dQh
+MJcSTUcMWAgAAfd8TkdoepqIuiTHPoweRckmq18Av/ws99Mb+wX8UXjGcp5VIXnY
+vrTeiCdiCOA34YXbMFPZmhLMu6yzL3Fzx5LfSj/59cXsM9GUzRtSCD7kBEpLpZAZ
+zf+jFO3gF37KWc1CZ2J0w935ngja1ti7sxewh04e9e8kIcyZVYUPBLEJSBSGkg/M
+boEYXpHkpF2kHvGIZ5Uj/di4B5LpE6kEneWDG2aih0FrnW9t7FWaRXpovSUJ9PR8
+XfmjhvVlBcivNkc/75TlpIUcOrIYaf+PuxqCVOxr/UXOfYVRXa+QZNzXlb5KhMWA
+jbb5R8ECgYEA5E7zsC1jVwT2gTmGbgPaow24Ul5i625H8twipYO6X38Lo/ZHyOEE
+sSHc/RJG+ioJCHeONlHCqC76+mMBWC05zqpAv2eFpoz7RrzV+koIWOX9B0+7qRrD
+9Wtqme6rJrsQ98AC9WvICrH6RAi4vc8eh5N0MgxUE5ScmlK2Qa+CUlkCgYEAy2oN
+NXYjgBAoHDEyZqq3cr1A5QPJK44LavBr66dWxjUk5vnX26lnV/aUJKPbdsro3uGU
+DhZega/yE6PdtIEv5477JTonZb6F+FVzum9IlaSYcOKwqEyEozfjzD/hY0rtaOOc
+xg+a+3dmzjFSzwFkcMhmSUajPFrmM5qN80M2JL0CgYEAofHa63IWkAhGLn22fF0h
+fh1iTJMFCcjNIljB/rPExK5ifGhanQP4BwllLuIDFLoydB4R8zflotTIVElcD8bs
+xUqA6QQuimhgaNnT0lknOJ/S7pfBHn+M1o3eLNhd8PgqXgKGVr2gRO3f/thM6t56
+4mJWvpV+IfF9b/4Rp+AtyekCgYEApLKGZV31GnB6eXEf9N6O0BkJ3SO2k0xcVEa7
+qr7/1FYdPeLW8qTz5tXgVtZREJrz99o/bTSRaoHSCDLqhIcBCYTMNfUjBw8/G7Xc
+kPwfkgIF54i0LmBeGGVdTPf//swg84cvXXIvMyIXHCX1fWQMNgEcSIIoEusqbmfa
+PTeTNCUCgYEAtV5mnYQZJ354B1BpeexmlPk392V13nvhY2V/cU+82Ze0YTYBFU2+
+gXFKL8LmZvnheAET9TKFXCXZueF+0fcEcn8fJ52DXJf72Mlt6aDfdAT+zqxjBLRR
+G3wSPVd5NRDt8njlL3yXa3Cy3JWGzzJi2S5LpCTSMSaLICoc97klw5I=
 -----END RSA PRIVATE KEY-----

integration/fixtures/https/clientca/client3.crt

@@ -1,17 +1,17 @@
 -----BEGIN CERTIFICATE-----
-MIICtDCCAZwCCQCBMhhWPi2g3jANBgkqhkiG9w0BAQUFADAaMRgwFgYDVQQDEw9j
-YTMuZXhhbXBsZS5jb20wHhcNMTYwNjE4MTgxNTAwWhcNMjYwNjE2MTgxNTAwWjAe
-MRwwGgYDVQQDExNjbGllbnQzLmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEAyW1BnimfqeE2TFVCVaFSOnKucZMezOUs5CiNAECbgBPU
-ehAYNZCpKlD0ejZjc8/x2m0fnfHnmRdmCDprpI1gZV/dUMQCgmsq83pccnk3qFyn
-tdDTo0vxTKZhusihipKmVEpvtQP0hMH2De7QjwOpjxnIZwFH8anLr8EyUFNyF8fK
-k5emkMh8Xe5ppOTof36v9N/WPBW2/gxM9aj0l47CUSXjAUD8Fy8DeRtq/COywlnG
-DK25tnrQcX4RBwU9s8pHrXVrvmgLUEc3pWuxrwGJzQ/iY8l1mDDmhqjmcg1uGYOe
-hs/Olnx7pttUbd36mNXSSkjPeTabgpZDFtljMcTJwwIDAQABMA0GCSqGSIb3DQEB
-BQUAA4IBAQBUSxHFcGKaTBBj9peCgzr+buhPQ7F72uNe0uYZhcCn91KXECiFM+rh
-W13qcfsHDM/PPWN+TXHKzTxCHYv3fGkcAR/bUD206dXbO/T1Oc8UTciJFWXCxMK9
-zKlZgn48TcAIEhJodVcqWXr8hZ5Grxw4wB2DnTUTr5FuFS/f4gtlflPJzirxZGe8
-LPZb7QZ+LHxGK39QVY/g9LJxlWzbCytPBR0enb8ijjVj2+Sc+NntvQHqXedNFIql
-ns6X98nQtwFn9/MgLGbqOYNN36b15HddyDRgfZ6zMO3Aeve7GM5GqnpqhyprN91t
-gVaVUIxZCUNmcmtWu+a1QtK/MgLIpX4I
+MIICtDCCAZwCCQCBMhhWPi2g3zANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDDA9j
+YTMuZXhhbXBsZS5jb20wHhcNMjIwODA4MTMzODI0WhcNMzIwODA1MTMzODI0WjAe
+MRwwGgYDVQQDDBNjbGllbnQzLmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAu95ub4QVJeMim1kmwWf6dECWckHG+DYnShnUO7N/p5OX
+4efN62hocvbdYHtyFjkNdS4oWRdW8SsL1CjsuuudBfNhkxP27GbVxXlvuXKKsvhs
+WG/ADt4/C276mgTub6kJRI2CLSqjUUGX7aVbDrSMlBj/HGBvBu1NIdQEEeXf6VHK
+imC7h4k7BQ0QDGyoSv+FZOQrsYFS90fjU+S59sZA6JSA79WvXAYUB2JZhP5FDX3e
+rIXun3Zk37WsD2MQBxEwKrHRZl6FXDyuNbHN+nlup9PV9+LOe5v4qRKZg9yQHBrV
+vB+tstE2bbgyfWpUaRuvJ7Raii/xckSi9FBrK+aj3QIDAQABMA0GCSqGSIb3DQEB
+CwUAA4IBAQA8ZLQtKWIMCLHOGQw+CajTm6ZkuzYpsRhvOB7ikLy2lmfXO3et7cBt
+1gukIk4AmfBskyxvD5v9pbxjxP6mYGYHG8Unitlxv+k0+QPw73loZbCeWIVTAR2k
+6/8TPGPE0nztLzyew5Z/swu2SSXNcqrsSde/h1jh+rVx06C4xZnENzX/wtz/h3dp
+XB9Wqb5oTSkZB/5GGMmZTFYwZwLwr92LArC9fvdzeF9OsG5Eo3s4xuRuA/gGc+ea
+FKMikJmQOHBEbNo795NX8AL3jWCW+tgePwtYB9xr7UGqjT3HfT1eHdETM56mByOK
+w+RDYChOK2wlf4iA4cFYFCm7M30hcVuw
 -----END CERTIFICATE-----

integration/fixtures/https/clientca/client3.csr

@@ -1,15 +1,15 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIICYzCCAUsCAQAwHjEcMBoGA1UEAxMTY2xpZW50My5leGFtcGxlLmNvbTCCASIw
-DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMltQZ4pn6nhNkxVQlWhUjpyrnGT
-HszlLOQojQBAm4AT1HoQGDWQqSpQ9Ho2Y3PP8dptH53x55kXZgg6a6SNYGVf3VDE
-AoJrKvN6XHJ5N6hcp7XQ06NL8UymYbrIoYqSplRKb7UD9ITB9g3u0I8DqY8ZyGcB
-R/Gpy6/BMlBTchfHypOXppDIfF3uaaTk6H9+r/Tf1jwVtv4MTPWo9JeOwlEl4wFA
-/BcvA3kbavwjssJZxgytubZ60HF+EQcFPbPKR611a75oC1BHN6Vrsa8Bic0P4mPJ
-dZgw5oao5nINbhmDnobPzpZ8e6bbVG3d+pjV0kpIz3k2m4KWQxbZYzHEycMCAwEA
-AaAAMA0GCSqGSIb3DQEBBQUAA4IBAQB3ApcHgGHXXYqkNHDp3xaXBrsYNnGSoqQq
-PoFqNh2SVVh9D25hcfTrCXbv8Ng+rTEZqb4BMrSPxl5vNRQL78M70NMNE1bXcdW3
-XWSh7vLxCAmHx7DKNxQI/96o5lG6FFkmZNYZ4CllqXaW0hV3CTuy4ixGwz4JJ6vI
-caS4OEMB/r+kEm0jReGjalS/KWk61+bZnHWKAkvpPxIFKp8YMi84I+GlE1YfbXiC
-kYtwCFmEd5T6Ztz/f/DtCF0JuH+S/2+R+7APD1RbaU8lCMDA292zlVP2mro2WRnZ
-GAbynaqxaPQIn+2LBD5ytRx9aHALj58vq/PVpUUKb20RwIf74+t1
+MIICYzCCAUsCAQAwHjEcMBoGA1UEAwwTY2xpZW50My5leGFtcGxlLmNvbTCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALvebm+EFSXjIptZJsFn+nRAlnJB
+xvg2J0oZ1Duzf6eTl+HnzetoaHL23WB7chY5DXUuKFkXVvErC9Qo7LrrnQXzYZMT
+9uxm1cV5b7lyirL4bFhvwA7ePwtu+poE7m+pCUSNgi0qo1FBl+2lWw60jJQY/xxg
+bwbtTSHUBBHl3+lRyopgu4eJOwUNEAxsqEr/hWTkK7GBUvdH41PkufbGQOiUgO/V
+r1wGFAdiWYT+RQ193qyF7p92ZN+1rA9jEAcRMCqx0WZehVw8rjWxzfp5bqfT1ffi
+znub+KkSmYPckBwa1bwfrbLRNm24Mn1qVGkbrye0Woov8XJEovRQayvmo90CAwEA
+AaAAMA0GCSqGSIb3DQEBCwUAA4IBAQA3hpWyHbGn+3r2hdD82pi8sJmZWrvk2a2k
+1ZriGvHJiZG0lDZfBM/jTNKbIZFyypx4AaMTUJLOmC/Q+pr+WGAmisBt1Fz3v2gw
+pR+Hxt2//lST8wou751m/DS4dbTYIFokCrcQCQ9uaOQ5uYKUOD2A25wRbhl7Hz8T
+zE18VWHcXSOb02nNRwhsCSLygYoBr5UNGRl7nNWOVIJVFdO125HbCiTDGaTiA9Ng
+BsbwfvehkiqceeT67QNvnWOiGMCbNjidx/0716YXb6FV1KKGtw96zhy99QTvQn1Q
+NQ913ch0EJ5JIuCifIquNkRBLlBayrZxN7IU+TKMwlt5uFn5PG0r
 -----END CERTIFICATE REQUEST-----

integration/fixtures/https/clientca/client3.key

@@ -1,27 +1,27 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEAyW1BnimfqeE2TFVCVaFSOnKucZMezOUs5CiNAECbgBPUehAY
-NZCpKlD0ejZjc8/x2m0fnfHnmRdmCDprpI1gZV/dUMQCgmsq83pccnk3qFyntdDT
-o0vxTKZhusihipKmVEpvtQP0hMH2De7QjwOpjxnIZwFH8anLr8EyUFNyF8fKk5em
-kMh8Xe5ppOTof36v9N/WPBW2/gxM9aj0l47CUSXjAUD8Fy8DeRtq/COywlnGDK25
-tnrQcX4RBwU9s8pHrXVrvmgLUEc3pWuxrwGJzQ/iY8l1mDDmhqjmcg1uGYOehs/O
-lnx7pttUbd36mNXSSkjPeTabgpZDFtljMcTJwwIDAQABAoIBAFYbTqG+SXLlw8B9
-8g2JGQ3DWK9UpSYSEk62xxAEjnUCBSLpHnBHlwlv8hMMjRdFHa6yV4G9l7PqPMPn
-tXxys3KiuIl+QVRfW80Z0ctd5l0ivs8Kpm54WH7b4YtnmScT6ea+q2JGfpECGZ17
-Kcz5U9LIwtLFyWuVmm1XuZp9EZj4HI7XgaktPom2f97k7oyQgKvgHVMUU+KYjS0X
-KTTf+PkSR/laV9TXNTRlFOwblh8tjrb/CohR/REQ5yTM04oRHhD+TkIV2qIUuM5Z
-P2hmIrMGhoJt01eJlZz73vXBBFAd/rzEIuKBroEG+culxje56qBbMKvfhmVJNuMz
-6AvkPYECgYEA+yXVRcU7Zqz7rqq7Mw3s3yC6LzE5SNO1hRl9J2N4ldHf4bUeHEuh
-ztW8Q7XiiftLcCGJPc3QxWRWwC8omhwefJzEmmVgpDeTMVjI/nNpgdgKSQfM77LX
-jZtH8q5JH4cMvJbFMV3JN24LSTrctryt+p/Jps3x0FzbgNGEDik7/y0CgYEAzVGB
-UESd09YvBjjW+1CJXHwgTh9Qc4L4VhAt7+O83SxGJEeVMYeTi/YHM2X5ytFBq/1w
-M+j9CWpNi7XoHOCVWZfQjOvsrX5R0s7iBrL9ikkmaEy95VEgywsXTaoJE37/l5GR
-j9s8P6o3KeCyce++2Qi+dHvAUEspLS1nW8KvAq8CgYAKwrw4mRLKe27tNPOAZIBZ
-rxVLIFjL/gYxBb6PCXwJL0zgZto7bCIqso22ePyT3OiGjWlL9J2VV48//MVIlRvZ
-Sv5Bf0Z8wsTTwHIcNOW4YoFOT79AJfGGZ7jVdRI8/5RUIEGis9oDPfvNz2/VhJAP
-xPjm5LwPqWreQhveX3XqoQKBgQC86JANVYTNotTTabrLspcf5AkpOACit09ciDhr
-7uMXsKO8v6wSzUZBUZXggaQqKwy8fUweRvGCFy/QKwesgiqIK3m0H2I9YutQBg/K
-0CcddB6Feo6CDnoYt1SynY8KRCBQyZvfe3zcqvVkb5xf3pF/SV9K943DktQJACyI
-LgEuewKBgF48AjNyi7zMgH0h5rsVimtjS7p8PhwZXyN70B/poykR3sxhCnChuNmt
-47MNOQrNgXCQivrZk1uh4v/itoVCDX/GYz+bqHh8MihALuSX3eRnVPk8oDjoM1lN
-Hks5wU7RK8gy14DPtTxfr0ca65v7kzu3nY1UwdFuTjcDwIv8EdGj
+MIIEpAIBAAKCAQEAu95ub4QVJeMim1kmwWf6dECWckHG+DYnShnUO7N/p5OX4efN
+62hocvbdYHtyFjkNdS4oWRdW8SsL1CjsuuudBfNhkxP27GbVxXlvuXKKsvhsWG/A
+Dt4/C276mgTub6kJRI2CLSqjUUGX7aVbDrSMlBj/HGBvBu1NIdQEEeXf6VHKimC7
+h4k7BQ0QDGyoSv+FZOQrsYFS90fjU+S59sZA6JSA79WvXAYUB2JZhP5FDX3erIXu
+n3Zk37WsD2MQBxEwKrHRZl6FXDyuNbHN+nlup9PV9+LOe5v4qRKZg9yQHBrVvB+t
+stE2bbgyfWpUaRuvJ7Raii/xckSi9FBrK+aj3QIDAQABAoIBAHjyqoaAslzB7fW1
+X44EMunE6xaD4mTJ+GFsX4ZP+U8ZZh657Ygwn43kAIGs97X25QMbxD4XGJIK9IKS
+FlYAegbquVbG86EeU2He3F63rzOpW5dT2oG38z6ZJB0kL50TZjQMJlKNsLcPU5Bb
+dFPzSM3Pie3q54++FnpA1J3xMEY0l4a1JtDL7biZvXk5S/2VeBYVKq62561gNwXv
+I1Hv5yhnqOucBQHlWS1zff9vALOhIFKrUJpcA46Cjtm/vTzmCytwi5JCZ0PLtMi9
+WBdOt/wH5v9AhHzid+zT+TWPUcrokft9SVEX0j4cHHUufxD7Nw8Q//RvLCwb4ypQ
+Ot9rhgECgYEA4TrRDoamVwEcOYfXbLJC6XEzhrjpF3+YHZp8d4177J5Vz94QRxLJ
+wlxcBFikuM1dN8kV8cGUzUMRvSZbm2LEuOQW3XsDHeFuaNCwBjx3BLCxHdi1OuHb
+JmlkJlIMo2u+IrMCD994pCEGAWUmFHMbiMHwU/ezzdj3ffVEBjo5NoUCgYEA1Yj0
+p28OMoaQsR/F1pd3Qnib9jQYVtFwD6ly4c9mItNtFn+J5MFbm9H5WgJt7w/eIMxD
+BRWHUgnqVQ+UFQnTESN9AnbfkcTcGfkKgyzuOb+bRjQaCnE6h8rrSFMPFDxJ4nus
+ruvme3MmVRqHsdbGiGLN7wu+PzK8ZxH1WtmQE3kCgYEAw4GCptFK4oscLPQ1kyzJ
+2EljKLap3rPrHwdSs5Qk1ig65M0l5AvzBruVRFCN67yYBiyO1+PpfqORalc5fZAm
+ozeagXaeJfnhFSrRIRirV27oz7ek2Q/kY1toi7r9LX4A9a3dRFn/JrljtSJQA8BH
+TlbKfpitgymq67NS8PTpZOECgYBwAU6TJKWFyx/KSKg1T2226Bymn9zEbUcib/da
+irdAPTZTPsLNwr6SlSj+FZgkdWZGPd5JpGk+lwTbaTh7cJPNwZeo20GZ7HCnDwJ8
+m+y5Tc/cmyetoobZA482eJrIOndm3QhPGF3lExlgOnJCzi2FDI6IfNhlve8lAT55
+UPVJwQKBgQCvs9KQxBJBm/+LssLesrCBXJ9ww/Af2BxB1tHD8qUOBB0x/H1KpGex
+2/pJaUPnHec+Ig5k7jMDyR+AOy68ycUPCRldjQ8Ym1ErB9frOSufm7XFSca335Wa
+R1hYHsh22gwoUdqAZVgWzo1Y9hq38l3r6sRZFr+2v5QRVE+DE+vSzg==
 -----END RSA PRIVATE KEY-----

integration/fixtures/k8s/01-traefik-crd.yml

@@ -1783,9 +1783,10 @@ spec:
                   VersionTLS13. Default: VersionTLS10.'
                 type: string
               preferServerCipherSuites:
-                description: PreferServerCipherSuites defines whether the server chooses
-                  a cipher suite among his own instead of among the client's. It is
-                  enabled automatically when minVersion or maxVersion are set.
+                description: 'PreferServerCipherSuites defines whether the server
+                  chooses a cipher suite among his own instead of among the client''s.
+                  It is enabled automatically when minVersion or maxVersion is set.
+                  Deprecated: https://github.com/golang/go/issues/45430'
                 type: boolean
               sniStrict:
                 description: SniStrict defines whether Traefik allows connections
@@ -1904,8 +1905,8 @@ spec:
     schema:
       openAPIV3Schema:
         description: 'TraefikService is the CRD implementation of a Traefik Service.
-          TraefikService object allows to:  - Apply weight to Services on load-balancing  -
-          Mirror traffic on services More info: https://doc.traefik.io/traefik/v2.8/routing/providers/kubernetes-crd/#kind-traefikservice'
+          TraefikService object allows to: - Apply weight to Services on load-balancing
+          - Mirror traffic on services More info: https://doc.traefik.io/traefik/v2.8/routing/providers/kubernetes-crd/#kind-traefikservice'
         properties:
           apiVersion:
             description: 'APIVersion defines the versioned schema of this representation

integration/fixtures/tcp/catch-all-no-tls-with-https.toml

@@ -27,7 +27,7 @@
   [tcp.services]
     [tcp.services.whoami-no-tls.loadBalancer]
       [[tcp.services.whoami-no-tls.loadBalancer.servers]]
-        address = "whoami-no-tls:8080"
+        address = "{{ .WhoamiNoTLSAddress }}"
 
 [http]
   [http.routers]
@@ -40,4 +40,4 @@
   [http.services]
     [http.services.whoami.loadBalancer]
       [[http.services.whoami.loadBalancer.servers]]
-        url = "http://whoami:80"
+        url = "{{ .WhoamiURL }}"

integration/fixtures/tcp/catch-all-no-tls.toml

@@ -27,4 +27,4 @@
   [tcp.services]
     [tcp.services.whoami-no-tls.loadBalancer]
       [[tcp.services.whoami-no-tls.loadBalancer.servers]]
-        address = "whoami-banner:8080"
+        address = "{{ .WhoamiBannerAddress }}"

integration/fixtures/tcp/ip-whitelist.toml

@@ -38,11 +38,11 @@
   [tcp.services]
     [tcp.services.whoami-a.loadBalancer]
       [[tcp.services.whoami-a.loadBalancer.servers]]
-        address = "whoami-a:8080"
+        address = "{{ .WhoamiA }}"
 
     [tcp.services.whoami-b.loadBalancer]
       [[tcp.services.whoami-b.loadBalancer.servers]]
-        address = "whoami-b:8080"
+        address = "{{ .WhoamiB }}"
 
   [tcp.middlewares]
     [tcp.middlewares.allowing-ipwhitelist.ipWhiteList]

integration/fixtures/tcp/mixed.toml

@@ -37,7 +37,7 @@
   [http.services]
     [http.services.whoami.loadBalancer]
       [[http.services.whoami.loadBalancer.servers]]
-        url = "http://whoami:80"
+        url = "{{ .Whoami }}"
 [tcp]
   [tcp.routers]
     [tcp.routers.to-whoami-a]
@@ -62,15 +62,15 @@
 
     [tcp.services.whoami-a.loadBalancer]
       [[tcp.services.whoami-a.loadBalancer.servers]]
-        address = "whoami-a:8080"
+        address = "{{ .WhoamiA }}"
 
     [tcp.services.whoami-b.loadBalancer]
       [[tcp.services.whoami-b.loadBalancer.servers]]
-        address = "whoami-b:8080"
+        address = "{{ .WhoamiB }}"
 
     [tcp.services.whoami-no-cert.loadBalancer]
       [[tcp.services.whoami-no-cert.loadBalancer.servers]]
-        address = "whoami-no-cert:8080"
+        address = "{{ .WhoamiNoCert }}"
 
 [[tls.certificates]]
   certFile = "fixtures/tcp/whoami-c.crt"

integration/fixtures/tcp/multi-tls-options.toml

@@ -36,12 +36,12 @@
     [tcp.services.whoami-no-cert]
       [tcp.services.whoami-no-cert.loadBalancer]
         [[tcp.services.whoami-no-cert.loadBalancer.servers]]
-        address = "whoami-no-cert:8080"
+        address = "{{ .WhoamiNoCert }}"
 
 [tls.options]
 
   [tls.options.foo]
-    minVersion = "VersionTLS11"
+    minVersion = "VersionTLS12"
 
   [tls.options.bar]
-    minVersion = "VersionTLS12"
+    minVersion = "VersionTLS13"

integration/fixtures/tcp/non-tls-fallback.toml

@@ -47,17 +47,17 @@
   [tcp.services]
     [tcp.services.whoami-no-tls.loadBalancer]
       [[tcp.services.whoami-no-tls.loadBalancer.servers]]
-        address = "whoami-no-tls:8080"
+        address = "{{ .WhoamiNoTLS }}"
 
     [tcp.services.whoami-a.loadBalancer]
       [[tcp.services.whoami-a.loadBalancer.servers]]
-        address = "whoami-a:8080"
+        address = "{{ .WhoamiA }}"
 
     [tcp.services.whoami-b.loadBalancer]
       [[tcp.services.whoami-b.loadBalancer.servers]]
-        address = "whoami-b:8080"
+        address = "{{ .WhoamiB }}"
 
     [tcp.services.whoami-no-cert.loadBalancer]
       [[tcp.services.whoami-no-cert.loadBalancer.servers]]
-        address = "whoami-no-cert:8080"
+        address = "{{ .WhoamiNoCert }}"
 

integration/fixtures/tcp/non-tls.toml

@@ -27,4 +27,4 @@
   [tcp.services]
     [tcp.services.whoami-no-tls.loadBalancer]
       [[tcp.services.whoami-no-tls.loadBalancer.servers]]
-        address = "whoami-no-tls:8080"
+        address = "{{ .WhoamiNoTLS }}"

integration/fixtures/tcp/wrr.toml

@@ -34,8 +34,8 @@
 
     [tcp.services.whoami-b.loadBalancer]
       [[tcp.services.whoami-b.loadBalancer.servers]]
-        address = "whoami-b:8080"
+        address = "{{ .WhoamiB }}"
 
     [tcp.services.whoami-ab.loadBalancer]
       [[tcp.services.whoami-ab.loadBalancer.servers]]
-        address = "whoami-ab:8080"
+        address = "{{ .WhoamiAB }}"

integration/https_test.go

@@ -142,7 +142,7 @@ func (s *HTTPSSuite) TestWithTLSOptions(c *check.C) {
 	tr1 := &http.Transport{
 		TLSClientConfig: &tls.Config{
 			InsecureSkipVerify: true,
-			MaxVersion:         tls.VersionTLS11,
+			MaxVersion:         tls.VersionTLS12,
 			ServerName:         "snitest.com",
 		},
 	}
@@ -194,7 +194,7 @@ func (s *HTTPSSuite) TestWithTLSOptions(c *check.C) {
 	}
 	_, err = client.Do(req)
 	c.Assert(err, checker.NotNil)
-	c.Assert(err.Error(), checker.Contains, "protocol version not supported")
+	c.Assert(err.Error(), checker.Contains, "tls: no supported versions satisfy MinVersion and MaxVersion")
 
 	//	with unknown tls option
 	err = try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("unknown TLS options: unknown@file"))
@@ -262,7 +262,7 @@ func (s *HTTPSSuite) TestWithConflictingTLSOptions(c *check.C) {
 	}
 	_, err = client.Do(req)
 	c.Assert(err, checker.NotNil)
-	c.Assert(err.Error(), checker.Contains, "protocol version not supported")
+	c.Assert(err.Error(), checker.Contains, "tls: no supported versions satisfy MinVersion and MaxVersion")
 
 	// with unknown tls option
 	err = try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains(fmt.Sprintf("found different TLS options for routers on the same host %v, so using the default TLS options instead", tr4.TLSClientConfig.ServerName)))

integration/integration_test.go

@@ -4,8 +4,10 @@ package integration
 import (
 	"bytes"
 	"context"
+	"errors"
 	"flag"
 	"fmt"
+	"io/fs"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -40,8 +42,23 @@ func Test(t *testing.T) {
 		return
 	}
 
+	// TODO(mpl): very niche optimization: do not start tailscale if none of the
+	// wanted tests actually need it (e.g. KeepAliveSuite does not).
+	var (
+		vpn    *tailscaleNotSuite
+		useVPN bool
+	)
+	if os.Getenv("IN_DOCKER") != "true" {
+		if vpn = setupVPN(nil, "tailscale.secret"); vpn != nil {
+			defer vpn.TearDownSuite(nil)
+			useVPN = true
+		}
+	}
+
 	check.Suite(&AccessLogSuite{})
-	check.Suite(&AcmeSuite{})
+	if !useVPN {
+		check.Suite(&AcmeSuite{})
+	}
 	check.Suite(&ConsulCatalogSuite{})
 	check.Suite(&ConsulSuite{})
 	check.Suite(&DockerComposeSuite{})
@@ -55,12 +72,16 @@ func Test(t *testing.T) {
 	check.Suite(&HostResolverSuite{})
 	check.Suite(&HTTPSSuite{})
 	check.Suite(&HTTPSuite{})
-	check.Suite(&K8sSuite{})
+	if !useVPN {
+		check.Suite(&K8sSuite{})
+	}
 	check.Suite(&KeepAliveSuite{})
 	check.Suite(&LogRotationSuite{})
-	check.Suite(&MarathonSuite15{})
 	check.Suite(&MarathonSuite{})
-	check.Suite(&ProxyProtocolSuite{})
+	check.Suite(&MarathonSuite15{})
+	if !useVPN {
+		check.Suite(&ProxyProtocolSuite{})
+	}
 	check.Suite(&RateLimitSuite{})
 	check.Suite(&RedisSuite{})
 	check.Suite(&RestSuite{})
@@ -125,6 +146,24 @@ func (s *BaseSuite) composeUp(c *check.C, services ...string) {
 	c.Assert(err, checker.IsNil)
 }
 
+// composeExec runs the command in the given args in the given compose service container.
+// Already running services are not affected (i.e. not stopped).
+func (s *BaseSuite) composeExec(c *check.C, service string, args ...string) {
+	c.Assert(s.composeProject, check.NotNil)
+	c.Assert(s.dockerComposeService, check.NotNil)
+
+	_, err := s.dockerComposeService.Exec(context.Background(), s.composeProject.Name, composeapi.RunOptions{
+		Service: service,
+		Stdin:   os.Stdin,
+		Stdout:  os.Stdout,
+		Stderr:  os.Stderr,
+		Command: args,
+		Tty:     false,
+		Index:   1,
+	})
+	c.Assert(err, checker.IsNil)
+}
+
 // composeStop stops the given services of the current docker compose project and removes the corresponding containers.
 func (s *BaseSuite) composeStop(c *check.C, services ...string) {
 	c.Assert(s.dockerComposeService, check.NotNil)
@@ -285,3 +324,45 @@ func (s *BaseSuite) getContainerIP(c *check.C, name string) string {
 func withConfigFile(file string) string {
 	return "--configFile=" + file
 }
+
+// tailscaleNotSuite includes a BaseSuite out of convenience, so we can benefit
+// from composeUp et co., but it is not meant to function as a TestSuite per se.
+type tailscaleNotSuite struct{ BaseSuite }
+
+// setupVPN starts Tailscale on the corresponding container, and makes it a subnet
+// router, for all the other containers (whoamis, etc) subsequently started for the
+// integration tests.
+// It only does so if the file provided as argument exists, and contains a
+// Tailscale auth key (an ephemeral, but reusable, one is recommended).
+//
+// Add this section to your tailscale ACLs to auto-approve the routes for the
+// containers in the docker subnet:
+//
+//	"autoApprovers": {
+//	  // Allow myself to automatically advertize routes for docker networks
+//	  "routes": {
+//	    "172.0.0.0/8": ["your_tailscale_identity"],
+//	  },
+//	},
+//
+// TODO(mpl): we could maybe even move this setup to the Makefile, to start it
+// and let it run (forever, or until voluntarily stopped).
+func setupVPN(c *check.C, keyFile string) *tailscaleNotSuite {
+	data, err := os.ReadFile(keyFile)
+	if err != nil {
+		if !errors.Is(err, fs.ErrNotExist) {
+			log.Fatal(err)
+		}
+		return nil
+	}
+	authKey := strings.TrimSpace(string(data))
+	// TODO: copy and create versions that don't need a check.C?
+	vpn := &tailscaleNotSuite{}
+	vpn.createComposeProject(c, "tailscale")
+	vpn.composeUp(c)
+	time.Sleep(5 * time.Second)
+	// If we ever change the docker subnet in the Makefile,
+	// we need to change this one below correspondingly.
+	vpn.composeExec(c, "tailscaled", "tailscale", "up", "--authkey="+authKey, "--advertise-routes=172.31.42.0/24")
+	return vpn
+}

integration/keepalive_test.go

@@ -77,7 +77,7 @@ func (s *KeepAliveSuite) TestShouldRespectConfiguredBackendHttpKeepAliveTime(c *
 	}()
 
 	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(200)
+		w.WriteHeader(http.StatusOK)
 	}))
 
 	server.Config.ConnState = func(conn net.Conn, state http.ConnState) {

integration/marathon15_test.go

@@ -21,7 +21,7 @@ func (s *MarathonSuite15) SetUpSuite(c *check.C) {
 	s.createComposeProject(c, "marathon15")
 	s.composeUp(c)
 
-	s.marathonURL = "http://" + containerNameMarathon + ":8080"
+	s.marathonURL = "http://" + s.getComposeServiceIP(c, containerNameMarathon) + ":8080"
 
 	// Wait for Marathon readiness prior to creating the client so that we
 	// don't run into the "all cluster members down" state right from the

integration/marathon_test.go

@@ -23,7 +23,7 @@ func (s *MarathonSuite) SetUpSuite(c *check.C) {
 	s.createComposeProject(c, "marathon")
 	s.composeUp(c)
 
-	s.marathonURL = "http://" + containerNameMarathon + ":8080"
+	s.marathonURL = "http://" + s.getComposeServiceIP(c, containerNameMarathon) + ":8080"
 
 	// Wait for Marathon readiness prior to creating the client so that we
 	// don't run into the "all cluster members down" state right from the
@@ -45,6 +45,7 @@ func (s *MarathonSuite) TestConfigurationUpdate(c *check.C) {
 		MarathonURL string
 	}{s.marathonURL})
 	defer os.Remove(file)
+
 	cmd, display := s.traefikCmd(withConfigFile(file))
 	defer display(c)
 	err := cmd.Start()

integration/redis_test.go

@@ -2,6 +2,7 @@ package integration
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"net"
 	"net/http"
@@ -33,6 +34,7 @@ func (s *RedisSuite) setupStore(c *check.C) {
 	s.redisAddr = net.JoinHostPort(s.getComposeServiceIP(c, "redis"), "6379")
 	redis.Register()
 	kv, err := valkeyrie.NewStore(
+		context.Background(),
 		store.REDIS,
 		[]string{s.redisAddr},
 		&store.Config{
@@ -102,7 +104,7 @@ func (s *RedisSuite) TestSimpleConfiguration(c *check.C) {
 	}
 
 	for k, v := range data {
-		err := s.kvClient.Put(k, []byte(v), nil)
+		err := s.kvClient.Put(context.Background(), k, []byte(v), nil)
 		c.Assert(err, checker.IsNil)
 	}
 

integration/resources/compose/marathon.yml

@@ -32,7 +32,7 @@ services:
     -v /var/run/docker.sock:/var/run/docker.sock \
     -v /cgroup:/cgroup -v /sys:/sys \
     -v /usr/local/bin/docker:/usr/local/bin/docker \
-    -e MESOS_HOSTNAME=mesos-slave \
+    -e MESOS_HOSTNAME=$$(hostname -i) \
     -e MESOS_CONTAINERIZERS=docker,mesos \
     -e MESOS_ISOLATOR=cgroups/cpu,cgroups/mem \
     -e MESOS_LOG_DIR=/var/log \

integration/resources/compose/marathon15.yml

@@ -17,24 +17,32 @@ services:
       MESOS_ZK: zk://zookeeper:2181/mesos
 
   mesos-slave:
-    image: mesosphere/mesos-slave-dind:0.4.0_mesos-1.4.1_docker-17.05.0_ubuntu-16.04.3
+    image: docker:dind
     privileged: true
     # Uncomment published ports for interactive debugging.
     # ports:
     #   - "5051:5051"
-    environment:
-      MESOS_HOSTNAME: mesos-slave
-      MESOS_CONTAINERIZERS: docker,mesos
-      MESOS_ISOLATOR: cgroups/cpu,cgroups/mem
-      MESOS_LOG_DIR: /var/log
-      MESOS_MASTER: zk://zookeeper:2181/mesos
-      MESOS_PORT: 5051
-      MESOS_WORK_DIR: /var/lib/mesos
-      MESOS_EXECUTOR_REGISTRATION_TIMEOUT: 5mins
-      MESOS_EXECUTOR_SHUTDOWN_GRACE_PERIOD: 90secs
-      MESOS_DOCKER_STOP_TIMEOUT: 60secs
-      MESOS_RESOURCES: cpus:2;mem:2048;disk:20480;ports(*):[12000-12999]
-      MESOS_SYSTEMD_ENABLE_SUPPORT: false
+    command:
+    - "/bin/sh"
+    - "-c"
+    - "(/usr/local/bin/dockerd-entrypoint.sh &); sleep 10; set -x; \
+    docker -H unix:///var/run/docker.sock run -d --net=host --privileged \
+    -v /var/run/docker.sock:/var/run/docker.sock \
+    -v /cgroup:/cgroup -v /sys:/sys \
+    -v /usr/local/bin/docker:/usr/local/bin/docker \
+    -e MESOS_HOSTNAME=$$(hostname -i) \
+    -e MESOS_CONTAINERIZERS=docker,mesos \
+    -e MESOS_ISOLATOR=cgroups/cpu,cgroups/mem \
+    -e MESOS_LOG_DIR=/var/log \
+    -e MESOS_MASTER=zk://zookeeper:2181/mesos \
+    -e MESOS_PORT=5051 \
+    -e MESOS_WORK_DIR=/var/lib/mesos \
+    -e MESOS_EXECUTOR_REGISTRATION_TIMEOUT=5mins \
+    -e MESOS_EXECUTOR_SHUTDOWN_GRACE_PERIOD=90secs \
+    -e MESOS_DOCKER_STOP_TIMEOUT=60secs \
+    -e MESOS_RESOURCES='cpus:2;mem:2048;disk:20480;ports(*):[12000-12999]' \
+    -e MESOS_SYSTEMD_ENABLE_SUPPORT=false \
+    mesosphere/mesos-slave:1.4.1; sleep 600"
 
   marathon:
     image: mesosphere/marathon:v1.5.9

integration/resources/compose/tailscale.yml

@@ -0,0 +1,17 @@
+version: "3.8"
+services:
+  tailscaled:
+    hostname: traefik-tests-gw             # This will become the tailscale device name
+    image: tailscale/tailscale:v1.24.0
+    volumes:
+      # TODO: maybe mount the container's /var/lib to keep some state for tailscale?
+      - "/dev/net/tun:/dev/net/tun"       # Required for tailscale to work
+    cap_add:                  # Required for tailscale to work
+      - net_admin
+      - sys_module
+    command: tailscaled
+
+networks:
+  default:
+    name: traefik-test-network
+    external: true

integration/resources/tls/README.md

@@ -3,6 +3,7 @@
 ## local.crt / local.key
 
 Generate with
+
 ```bash
 go run $GOROOT/src/crypto/tls/generate_cert.go  --rsa-bits 1024 --host 127.0.0.1,::1,localhost --ca --start-date "Jan 1 00:00:00 1970" --duration=1000000h
 mv cert.pem local.cert

integration/tcp_test.go

@@ -25,7 +25,17 @@ func (s *TCPSuite) SetUpSuite(c *check.C) {
 }
 
 func (s *TCPSuite) TestMixed(c *check.C) {
-	file := s.adaptFile(c, "fixtures/tcp/mixed.toml", struct{}{})
+	file := s.adaptFile(c, "fixtures/tcp/mixed.toml", struct {
+		Whoami       string
+		WhoamiA      string
+		WhoamiB      string
+		WhoamiNoCert string
+	}{
+		Whoami:       "http://" + s.getComposeServiceIP(c, "whoami") + ":80",
+		WhoamiA:      s.getComposeServiceIP(c, "whoami-a") + ":8080",
+		WhoamiB:      s.getComposeServiceIP(c, "whoami-b") + ":8080",
+		WhoamiNoCert: s.getComposeServiceIP(c, "whoami-no-cert") + ":8080",
+	})
 	defer os.Remove(file)
 
 	cmd, display := s.traefikCmd(withConfigFile(file))
@@ -75,7 +85,11 @@ func (s *TCPSuite) TestMixed(c *check.C) {
 }
 
 func (s *TCPSuite) TestTLSOptions(c *check.C) {
-	file := s.adaptFile(c, "fixtures/tcp/multi-tls-options.toml", struct{}{})
+	file := s.adaptFile(c, "fixtures/tcp/multi-tls-options.toml", struct {
+		WhoamiNoCert string
+	}{
+		WhoamiNoCert: s.getComposeServiceIP(c, "whoami-no-cert") + ":8080",
+	})
 	defer os.Remove(file)
 
 	cmd, display := s.traefikCmd(withConfigFile(file))
@@ -88,24 +102,34 @@ func (s *TCPSuite) TestTLSOptions(c *check.C) {
 	err = try.GetRequest("http://127.0.0.1:8080/api/rawdata", 5*time.Second, try.StatusCodeIs(http.StatusOK), try.BodyContains("HostSNI(`whoami-c.test`)"))
 	c.Assert(err, checker.IsNil)
 
-	// Check that we can use a client tls version <= 1.1 with hostSNI 'whoami-c.test'
-	out, err := guessWhoTLSMaxVersion("127.0.0.1:8093", "whoami-c.test", true, tls.VersionTLS11)
+	// Check that we can use a client tls version <= 1.2 with hostSNI 'whoami-c.test'
+	out, err := guessWhoTLSMaxVersion("127.0.0.1:8093", "whoami-c.test", true, tls.VersionTLS12)
 	c.Assert(err, checker.IsNil)
 	c.Assert(out, checker.Contains, "whoami-no-cert")
 
-	// Check that we can use a client tls version <= 1.2 with hostSNI 'whoami-d.test'
-	out, err = guessWhoTLSMaxVersion("127.0.0.1:8093", "whoami-d.test", true, tls.VersionTLS12)
+	// Check that we can use a client tls version <= 1.3 with hostSNI 'whoami-d.test'
+	out, err = guessWhoTLSMaxVersion("127.0.0.1:8093", "whoami-d.test", true, tls.VersionTLS13)
 	c.Assert(err, checker.IsNil)
 	c.Assert(out, checker.Contains, "whoami-no-cert")
 
-	// Check that we cannot use a client tls version <= 1.1 with hostSNI 'whoami-d.test'
-	_, err = guessWhoTLSMaxVersion("127.0.0.1:8093", "whoami-d.test", true, tls.VersionTLS11)
+	// Check that we cannot use a client tls version <= 1.2 with hostSNI 'whoami-d.test'
+	_, err = guessWhoTLSMaxVersion("127.0.0.1:8093", "whoami-d.test", true, tls.VersionTLS12)
 	c.Assert(err, checker.NotNil)
 	c.Assert(err.Error(), checker.Contains, "protocol version not supported")
 }
 
 func (s *TCPSuite) TestNonTLSFallback(c *check.C) {
-	file := s.adaptFile(c, "fixtures/tcp/non-tls-fallback.toml", struct{}{})
+	file := s.adaptFile(c, "fixtures/tcp/non-tls-fallback.toml", struct {
+		WhoamiA      string
+		WhoamiB      string
+		WhoamiNoCert string
+		WhoamiNoTLS  string
+	}{
+		WhoamiA:      s.getComposeServiceIP(c, "whoami-a") + ":8080",
+		WhoamiB:      s.getComposeServiceIP(c, "whoami-b") + ":8080",
+		WhoamiNoCert: s.getComposeServiceIP(c, "whoami-no-cert") + ":8080",
+		WhoamiNoTLS:  s.getComposeServiceIP(c, "whoami-no-tls") + ":8080",
+	})
 	defer os.Remove(file)
 
 	cmd, display := s.traefikCmd(withConfigFile(file))
@@ -139,7 +163,11 @@ func (s *TCPSuite) TestNonTLSFallback(c *check.C) {
 }
 
 func (s *TCPSuite) TestNonTlsTcp(c *check.C) {
-	file := s.adaptFile(c, "fixtures/tcp/non-tls.toml", struct{}{})
+	file := s.adaptFile(c, "fixtures/tcp/non-tls.toml", struct {
+		WhoamiNoTLS string
+	}{
+		WhoamiNoTLS: s.getComposeServiceIP(c, "whoami-no-tls") + ":8080",
+	})
 	defer os.Remove(file)
 
 	cmd, display := s.traefikCmd(withConfigFile(file))
@@ -159,7 +187,11 @@ func (s *TCPSuite) TestNonTlsTcp(c *check.C) {
 }
 
 func (s *TCPSuite) TestCatchAllNoTLS(c *check.C) {
-	file := s.adaptFile(c, "fixtures/tcp/catch-all-no-tls.toml", struct{}{})
+	file := s.adaptFile(c, "fixtures/tcp/catch-all-no-tls.toml", struct {
+		WhoamiBannerAddress string
+	}{
+		WhoamiBannerAddress: s.getComposeServiceIP(c, "whoami-banner") + ":8080",
+	})
 	defer os.Remove(file)
 
 	cmd, display := s.traefikCmd(withConfigFile(file))
@@ -179,7 +211,13 @@ func (s *TCPSuite) TestCatchAllNoTLS(c *check.C) {
 }
 
 func (s *TCPSuite) TestCatchAllNoTLSWithHTTPS(c *check.C) {
-	file := s.adaptFile(c, "fixtures/tcp/catch-all-no-tls-with-https.toml", struct{}{})
+	file := s.adaptFile(c, "fixtures/tcp/catch-all-no-tls-with-https.toml", struct {
+		WhoamiNoTLSAddress string
+		WhoamiURL          string
+	}{
+		WhoamiNoTLSAddress: s.getComposeServiceIP(c, "whoami-no-tls") + ":8080",
+		WhoamiURL:          "http://" + s.getComposeServiceIP(c, "whoami") + ":80",
+	})
 	defer os.Remove(file)
 
 	cmd, display := s.traefikCmd(withConfigFile(file))
@@ -204,7 +242,13 @@ func (s *TCPSuite) TestCatchAllNoTLSWithHTTPS(c *check.C) {
 }
 
 func (s *TCPSuite) TestMiddlewareWhiteList(c *check.C) {
-	file := s.adaptFile(c, "fixtures/tcp/ip-whitelist.toml", struct{}{})
+	file := s.adaptFile(c, "fixtures/tcp/ip-whitelist.toml", struct {
+		WhoamiA string
+		WhoamiB string
+	}{
+		WhoamiA: s.getComposeServiceIP(c, "whoami-a") + ":8080",
+		WhoamiB: s.getComposeServiceIP(c, "whoami-b") + ":8080",
+	})
 	defer os.Remove(file)
 
 	cmd, display := s.traefikCmd(withConfigFile(file))
@@ -228,7 +272,13 @@ func (s *TCPSuite) TestMiddlewareWhiteList(c *check.C) {
 }
 
 func (s *TCPSuite) TestWRR(c *check.C) {
-	file := s.adaptFile(c, "fixtures/tcp/wrr.toml", struct{}{})
+	file := s.adaptFile(c, "fixtures/tcp/wrr.toml", struct {
+		WhoamiB  string
+		WhoamiAB string
+	}{
+		WhoamiB:  s.getComposeServiceIP(c, "whoami-b") + ":8080",
+		WhoamiAB: s.getComposeServiceIP(c, "whoami-ab") + ":8080",
+	})
 	defer os.Remove(file)
 
 	cmd, display := s.traefikCmd(withConfigFile(file))

integration/testdata/rawdata-ingress-label-selector.json

@@ -28,7 +28,7 @@
 				"traefik"
 			]
 		},
-		"test-ingress-default-whoami-test-whoami@kubernetes": {
+		"default-test-ingress-whoami-test-whoami@kubernetes": {
 			"entryPoints": [
 				"web"
 			],
@@ -92,7 +92,7 @@
 			},
 			"status": "enabled",
 			"usedBy": [
-				"test-ingress-default-whoami-test-whoami@kubernetes"
+				"default-test-ingress-whoami-test-whoami@kubernetes"
 			],
 			"serverStatus": {
 				"http://10.42.0.2:80": "UP",

integration/testdata/rawdata-ingress.json

@@ -28,18 +28,7 @@
 				"traefik"
 			]
 		},
-		"test-ingress-default-whoami-test-whoami@kubernetes": {
-			"entryPoints": [
-				"web"
-			],
-			"service": "default-whoami-http",
-			"rule": "Host(`whoami.test`) \u0026\u0026 PathPrefix(`/whoami`)",
-			"status": "enabled",
-			"using": [
-				"web"
-			]
-		},
-		"test-ingress-https-default-whoami-test-https-whoami@kubernetes": {
+		"default-test-ingress-https-whoami-test-https-whoami@kubernetes": {
 			"entryPoints": [
 				"web"
 			],
@@ -50,7 +39,18 @@
 				"web"
 			]
 		},
-		"whoami-drop-route-default-whoami-test-drop-drop@kubernetes": {
+		"default-test-ingress-whoami-test-whoami@kubernetes": {
+			"entryPoints": [
+				"web"
+			],
+			"service": "default-whoami-http",
+			"rule": "Host(`whoami.test`) \u0026\u0026 PathPrefix(`/whoami`)",
+			"status": "enabled",
+			"using": [
+				"web"
+			]
+		},
+		"default-whoami-drop-route-whoami-test-drop-drop@kubernetes": {
 			"entryPoints": [
 				"web"
 			],
@@ -61,7 +61,7 @@
 				"web"
 			]
 		},
-		"whoami-keep-route-default-whoami-test-keep-keep@kubernetes": {
+		"default-whoami-keep-route-whoami-test-keep-keep@kubernetes": {
 			"entryPoints": [
 				"web"
 			],
@@ -125,8 +125,8 @@
 			},
 			"status": "enabled",
 			"usedBy": [
-				"whoami-drop-route-default-whoami-test-drop-drop@kubernetes",
-				"whoami-keep-route-default-whoami-test-keep-keep@kubernetes"
+				"default-whoami-drop-route-whoami-test-drop-drop@kubernetes",
+				"default-whoami-keep-route-whoami-test-keep-keep@kubernetes"
 			],
 			"serverStatus": {
 				"http://XXXX": "UP",
@@ -147,8 +147,8 @@
 			},
 			"status": "enabled",
 			"usedBy": [
-				"test-ingress-default-whoami-test-whoami@kubernetes",
-				"test-ingress-https-default-whoami-test-https-whoami@kubernetes"
+				"default-test-ingress-https-whoami-test-https-whoami@kubernetes",
+				"default-test-ingress-whoami-test-whoami@kubernetes"
 			],
 			"serverStatus": {
 				"http://10.42.0.10:80": "UP",

integration/testdata/rawdata-ingressclass.json

@@ -28,7 +28,7 @@
 				"traefik"
 			]
 		},
-		"whoami-keep-route-default-whoami-test-keep-keep@kubernetes": {
+		"default-whoami-keep-route-whoami-test-keep-keep@kubernetes": {
 			"entryPoints": [
 				"web"
 			],
@@ -92,7 +92,7 @@
 			},
 			"status": "enabled",
 			"usedBy": [
-				"whoami-keep-route-default-whoami-test-keep-keep@kubernetes"
+				"default-whoami-keep-route-whoami-test-keep-keep@kubernetes"
 			],
 			"serverStatus": {
 				"http://10.42.0.4:80": "UP",

integration/try/condition.go

@@ -1,6 +1,7 @@
 package try
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"io"
@@ -185,7 +186,7 @@ type DoCondition func() error
 // Verify if a Key exists in the store.
 func KVExists(kv store.Store, key string) DoCondition {
 	return func() error {
-		_, err := kv.Exists(key, nil)
+		_, err := kv.Exists(context.Background(), key, nil)
 		return err
 	}
 }

integration/zk_test.go

@@ -2,6 +2,7 @@ package integration
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"net"
 	"net/http"
@@ -36,6 +37,7 @@ func (s *ZookeeperSuite) setupStore(c *check.C) {
 
 	var err error
 	s.kvClient, err = valkeyrie.NewStore(
+		context.Background(),
 		store.ZK,
 		[]string{s.zookeeperAddr},
 		&store.Config{
@@ -104,7 +106,7 @@ func (s *ZookeeperSuite) TestSimpleConfiguration(c *check.C) {
 	}
 
 	for k, v := range data {
-		err := s.kvClient.Put(k, []byte(v), nil)
+		err := s.kvClient.Put(context.Background(), k, []byte(v), nil)
 		c.Assert(err, checker.IsNil)
 	}
 

netlify.toml

@@ -1,7 +0,0 @@
-[build]
-# Path relative to the root of the repository
-publish = "site"
-base = "docs"
-
-# Path relative to the "base" directory
-command = "sh -x scripts/netlify-run.sh"

pkg/metrics/datadog.go

@@ -53,7 +53,7 @@ func RegisterDatadog(ctx context.Context, config *types.Datadog) Registry {
 	}
 
 	datadogClient = dogstatsd.New(config.Prefix+".", kitlog.LoggerFunc(func(keyvals ...interface{}) error {
-		log.WithoutContext().WithField(log.MetricsProviderName, "datadog").Info(keyvals)
+		log.WithoutContext().WithField(log.MetricsProviderName, "datadog").Info(keyvals...)
 		return nil
 	}))
 

pkg/metrics/influxdb.go

@@ -136,7 +136,7 @@ func initInfluxDBClient(ctx context.Context, config *types.InfluxDB) *influx.Inf
 			RetentionPolicy: config.RetentionPolicy,
 		},
 		kitlog.LoggerFunc(func(keyvals ...interface{}) error {
-			log.WithoutContext().WithField(log.MetricsProviderName, "influxdb").Info(keyvals)
+			log.WithoutContext().WithField(log.MetricsProviderName, "influxdb").Info(keyvals...)
 			return nil
 		}))
 }

pkg/metrics/influxdb2.go

@@ -38,7 +38,7 @@ func RegisterInfluxDB2(ctx context.Context, config *types.InfluxDB2) Registry {
 			config.AdditionalLabels,
 			influxdb.BatchPointsConfig{},
 			kitlog.LoggerFunc(func(kv ...interface{}) error {
-				log.FromContext(ctx).Error(kv)
+				log.FromContext(ctx).Error(kv...)
 				return nil
 			}),
 		)

pkg/metrics/prometheus.go

@@ -4,8 +4,6 @@ import (
 	"context"
 	"errors"
 	"net/http"
-	"sort"
-	"strings"
 	"sync"
 	"time"
 
@@ -15,7 +13,6 @@ import (
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/traefik/traefik/v2/pkg/config/dynamic"
 	"github.com/traefik/traefik/v2/pkg/log"
-	"github.com/traefik/traefik/v2/pkg/safe"
 	"github.com/traefik/traefik/v2/pkg/types"
 )
 
@@ -111,37 +108,33 @@ func initStandardRegistry(config *types.Prometheus) Registry {
 		buckets = config.Buckets
 	}
 
-	safe.Go(func() {
-		promState.ListenValueUpdates()
-	})
-
-	configReloads := newCounterFrom(promState.collectors, stdprometheus.CounterOpts{
+	configReloads := newCounterFrom(stdprometheus.CounterOpts{
 		Name: configReloadsTotalName,
 		Help: "Config reloads",
 	}, []string{})
-	configReloadsFailures := newCounterFrom(promState.collectors, stdprometheus.CounterOpts{
+	configReloadsFailures := newCounterFrom(stdprometheus.CounterOpts{
 		Name: configReloadsFailuresTotalName,
 		Help: "Config failure reloads",
 	}, []string{})
-	lastConfigReloadSuccess := newGaugeFrom(promState.collectors, stdprometheus.GaugeOpts{
+	lastConfigReloadSuccess := newGaugeFrom(stdprometheus.GaugeOpts{
 		Name: configLastReloadSuccessName,
 		Help: "Last config reload success",
 	}, []string{})
-	lastConfigReloadFailure := newGaugeFrom(promState.collectors, stdprometheus.GaugeOpts{
+	lastConfigReloadFailure := newGaugeFrom(stdprometheus.GaugeOpts{
 		Name: configLastReloadFailureName,
 		Help: "Last config reload failure",
 	}, []string{})
-	tlsCertsNotAfterTimestamp := newGaugeFrom(promState.collectors, stdprometheus.GaugeOpts{
+	tlsCertsNotAfterTimestamp := newGaugeFrom(stdprometheus.GaugeOpts{
 		Name: tlsCertsNotAfterTimestamp,
 		Help: "Certificate expiration timestamp",
 	}, []string{"cn", "serial", "sans"})
 
-	promState.describers = []func(chan<- *stdprometheus.Desc){
-		configReloads.cv.Describe,
-		configReloadsFailures.cv.Describe,
-		lastConfigReloadSuccess.gv.Describe,
-		lastConfigReloadFailure.gv.Describe,
-		tlsCertsNotAfterTimestamp.gv.Describe,
+	promState.vectors = []vector{
+		configReloads.cv,
+		configReloadsFailures.cv,
+		lastConfigReloadSuccess.gv,
+		lastConfigReloadFailure.gv,
+		tlsCertsNotAfterTimestamp.gv,
 	}
 
 	reg := &standardRegistry{
@@ -156,30 +149,30 @@ func initStandardRegistry(config *types.Prometheus) Registry {
 	}
 
 	if config.AddEntryPointsLabels {
-		entryPointReqs := newCounterFrom(promState.collectors, stdprometheus.CounterOpts{
+		entryPointReqs := newCounterFrom(stdprometheus.CounterOpts{
 			Name: entryPointReqsTotalName,
 			Help: "How many HTTP requests processed on an entrypoint, partitioned by status code, protocol, and method.",
 		}, []string{"code", "method", "protocol", "entrypoint"})
-		entryPointReqsTLS := newCounterFrom(promState.collectors, stdprometheus.CounterOpts{
+		entryPointReqsTLS := newCounterFrom(stdprometheus.CounterOpts{
 			Name: entryPointReqsTLSTotalName,
 			Help: "How many HTTP requests with TLS processed on an entrypoint, partitioned by TLS Version and TLS cipher Used.",
 		}, []string{"tls_version", "tls_cipher", "entrypoint"})
-		entryPointReqDurations := newHistogramFrom(promState.collectors, stdprometheus.HistogramOpts{
+		entryPointReqDurations := newHistogramFrom(stdprometheus.HistogramOpts{
 			Name:    entryPointReqDurationName,
 			Help:    "How long it took to process the request on an entrypoint, partitioned by status code, protocol, and method.",
 			Buckets: buckets,
 		}, []string{"code", "method", "protocol", "entrypoint"})
-		entryPointOpenConns := newGaugeFrom(promState.collectors, stdprometheus.GaugeOpts{
+		entryPointOpenConns := newGaugeFrom(stdprometheus.GaugeOpts{
 			Name: entryPointOpenConnsName,
 			Help: "How many open connections exist on an entrypoint, partitioned by method and protocol.",
 		}, []string{"method", "protocol", "entrypoint"})
 
-		promState.describers = append(promState.describers, []func(chan<- *stdprometheus.Desc){
-			entryPointReqs.cv.Describe,
-			entryPointReqsTLS.cv.Describe,
-			entryPointReqDurations.hv.Describe,
-			entryPointOpenConns.gv.Describe,
-		}...)
+		promState.vectors = append(promState.vectors,
+			entryPointReqs.cv,
+			entryPointReqsTLS.cv,
+			entryPointReqDurations.hv,
+			entryPointOpenConns.gv,
+		)
 
 		reg.entryPointReqsCounter = entryPointReqs
 		reg.entryPointReqsTLSCounter = entryPointReqsTLS
@@ -188,30 +181,30 @@ func initStandardRegistry(config *types.Prometheus) Registry {
 	}
 
 	if config.AddRoutersLabels {
-		routerReqs := newCounterFrom(promState.collectors, stdprometheus.CounterOpts{
+		routerReqs := newCounterFrom(stdprometheus.CounterOpts{
 			Name: routerReqsTotalName,
 			Help: "How many HTTP requests are processed on a router, partitioned by service, status code, protocol, and method.",
 		}, []string{"code", "method", "protocol", "router", "service"})
-		routerReqsTLS := newCounterFrom(promState.collectors, stdprometheus.CounterOpts{
+		routerReqsTLS := newCounterFrom(stdprometheus.CounterOpts{
 			Name: routerReqsTLSTotalName,
 			Help: "How many HTTP requests with TLS are processed on a router, partitioned by service, TLS Version, and TLS cipher Used.",
 		}, []string{"tls_version", "tls_cipher", "router", "service"})
-		routerReqDurations := newHistogramFrom(promState.collectors, stdprometheus.HistogramOpts{
+		routerReqDurations := newHistogramFrom(stdprometheus.HistogramOpts{
 			Name:    routerReqDurationName,
 			Help:    "How long it took to process the request on a router, partitioned by service, status code, protocol, and method.",
 			Buckets: buckets,
 		}, []string{"code", "method", "protocol", "router", "service"})
-		routerOpenConns := newGaugeFrom(promState.collectors, stdprometheus.GaugeOpts{
+		routerOpenConns := newGaugeFrom(stdprometheus.GaugeOpts{
 			Name: routerOpenConnsName,
 			Help: "How many open connections exist on a router, partitioned by service, method, and protocol.",
 		}, []string{"method", "protocol", "router", "service"})
 
-		promState.describers = append(promState.describers, []func(chan<- *stdprometheus.Desc){
-			routerReqs.cv.Describe,
-			routerReqsTLS.cv.Describe,
-			routerReqDurations.hv.Describe,
-			routerOpenConns.gv.Describe,
-		}...)
+		promState.vectors = append(promState.vectors,
+			routerReqs.cv,
+			routerReqsTLS.cv,
+			routerReqDurations.hv,
+			routerOpenConns.gv,
+		)
 		reg.routerReqsCounter = routerReqs
 		reg.routerReqsTLSCounter = routerReqsTLS
 		reg.routerReqDurationHistogram, _ = NewHistogramWithScale(routerReqDurations, time.Second)
@@ -219,40 +212,40 @@ func initStandardRegistry(config *types.Prometheus) Registry {
 	}
 
 	if config.AddServicesLabels {
-		serviceReqs := newCounterFrom(promState.collectors, stdprometheus.CounterOpts{
+		serviceReqs := newCounterFrom(stdprometheus.CounterOpts{
 			Name: serviceReqsTotalName,
 			Help: "How many HTTP requests processed on a service, partitioned by status code, protocol, and method.",
 		}, []string{"code", "method", "protocol", "service"})
-		serviceReqsTLS := newCounterFrom(promState.collectors, stdprometheus.CounterOpts{
+		serviceReqsTLS := newCounterFrom(stdprometheus.CounterOpts{
 			Name: serviceReqsTLSTotalName,
 			Help: "How many HTTP requests with TLS processed on a service, partitioned by TLS version and TLS cipher.",
 		}, []string{"tls_version", "tls_cipher", "service"})
-		serviceReqDurations := newHistogramFrom(promState.collectors, stdprometheus.HistogramOpts{
+		serviceReqDurations := newHistogramFrom(stdprometheus.HistogramOpts{
 			Name:    serviceReqDurationName,
 			Help:    "How long it took to process the request on a service, partitioned by status code, protocol, and method.",
 			Buckets: buckets,
 		}, []string{"code", "method", "protocol", "service"})
-		serviceOpenConns := newGaugeFrom(promState.collectors, stdprometheus.GaugeOpts{
+		serviceOpenConns := newGaugeFrom(stdprometheus.GaugeOpts{
 			Name: serviceOpenConnsName,
 			Help: "How many open connections exist on a service, partitioned by method and protocol.",
 		}, []string{"method", "protocol", "service"})
-		serviceRetries := newCounterFrom(promState.collectors, stdprometheus.CounterOpts{
+		serviceRetries := newCounterFrom(stdprometheus.CounterOpts{
 			Name: serviceRetriesTotalName,
 			Help: "How many request retries happened on a service.",
 		}, []string{"service"})
-		serviceServerUp := newGaugeFrom(promState.collectors, stdprometheus.GaugeOpts{
+		serviceServerUp := newGaugeFrom(stdprometheus.GaugeOpts{
 			Name: serviceServerUpName,
 			Help: "service server is up, described by gauge value of 0 or 1.",
 		}, []string{"service", "url"})
 
-		promState.describers = append(promState.describers, []func(chan<- *stdprometheus.Desc){
-			serviceReqs.cv.Describe,
-			serviceReqsTLS.cv.Describe,
-			serviceReqDurations.hv.Describe,
-			serviceOpenConns.gv.Describe,
-			serviceRetries.cv.Describe,
-			serviceServerUp.gv.Describe,
-		}...)
+		promState.vectors = append(promState.vectors,
+			serviceReqs.cv,
+			serviceReqsTLS.cv,
+			serviceReqDurations.hv,
+			serviceOpenConns.gv,
+			serviceRetries.cv,
+			serviceServerUp.gv,
+		)
 
 		reg.serviceReqsCounter = serviceReqs
 		reg.serviceReqsTLSCounter = serviceReqsTLS
@@ -287,64 +280,92 @@ func registerPromState(ctx context.Context) bool {
 // It then converts the configuration to the optimized package internal format
 // and sets it to the promState.
 func OnConfigurationUpdate(conf dynamic.Configuration, entryPoints []string) {
-	dynamicConfig := newDynamicConfig()
+	dynCfg := newDynamicConfig()
 
 	for _, value := range entryPoints {
-		dynamicConfig.entryPoints[value] = true
+		dynCfg.entryPoints[value] = true
+	}
+
+	if conf.HTTP == nil {
+		promState.SetDynamicConfig(dynCfg)
+		return
 	}
 
 	for name := range conf.HTTP.Routers {
-		dynamicConfig.routers[name] = true
+		dynCfg.routers[name] = true
 	}
 
 	for serviceName, service := range conf.HTTP.Services {
-		dynamicConfig.services[serviceName] = make(map[string]bool)
+		dynCfg.services[serviceName] = make(map[string]bool)
 		if service.LoadBalancer != nil {
 			for _, server := range service.LoadBalancer.Servers {
-				dynamicConfig.services[serviceName][server.URL] = true
+				dynCfg.services[serviceName][server.URL] = true
 			}
 		}
 	}
 
-	promState.SetDynamicConfig(dynamicConfig)
+	promState.SetDynamicConfig(dynCfg)
 }
 
 func newPrometheusState() *prometheusState {
 	return &prometheusState{
-		collectors:    make(chan *collector),
 		dynamicConfig: newDynamicConfig(),
-		state:         make(map[string]*collector),
+		deletedURLs:   make(map[string][]string),
 	}
 }
 
-type prometheusState struct {
-	collectors chan *collector
-	describers []func(ch chan<- *stdprometheus.Desc)
+type vector interface {
+	stdprometheus.Collector
+	DeletePartialMatch(labels stdprometheus.Labels) int
+}
 
-	mtx           sync.Mutex
-	dynamicConfig *dynamicConfig
-	state         map[string]*collector
+type prometheusState struct {
+	vectors []vector
+
+	mtx             sync.Mutex
+	dynamicConfig   *dynamicConfig
+	deletedEP       []string
+	deletedRouters  []string
+	deletedServices []string
+	deletedURLs     map[string][]string
 }
 
 func (ps *prometheusState) SetDynamicConfig(dynamicConfig *dynamicConfig) {
 	ps.mtx.Lock()
 	defer ps.mtx.Unlock()
-	ps.dynamicConfig = dynamicConfig
-}
 
-func (ps *prometheusState) ListenValueUpdates() {
-	for collector := range ps.collectors {
-		ps.mtx.Lock()
-		ps.state[collector.id] = collector
-		ps.mtx.Unlock()
+	for ep := range ps.dynamicConfig.entryPoints {
+		if _, ok := dynamicConfig.entryPoints[ep]; !ok {
+			ps.deletedEP = append(ps.deletedEP, ep)
+		}
 	}
+
+	for router := range ps.dynamicConfig.routers {
+		if _, ok := dynamicConfig.routers[router]; !ok {
+			ps.deletedRouters = append(ps.deletedRouters, router)
+		}
+	}
+
+	for service, serV := range ps.dynamicConfig.services {
+		actualService, ok := dynamicConfig.services[service]
+		if !ok {
+			ps.deletedServices = append(ps.deletedServices, service)
+		}
+		for url := range serV {
+			if _, ok := actualService[url]; !ok {
+				ps.deletedURLs[service] = append(ps.deletedURLs[service], url)
+			}
+		}
+	}
+
+	ps.dynamicConfig = dynamicConfig
 }
 
 // Describe implements prometheus.Collector and simply calls
 // the registered describer functions.
 func (ps *prometheusState) Describe(ch chan<- *stdprometheus.Desc) {
-	for _, desc := range ps.describers {
-		desc(ch)
+	for _, v := range ps.vectors {
+		v.Describe(ch)
 	}
 }
 
@@ -354,49 +375,54 @@ func (ps *prometheusState) Describe(ch chan<- *stdprometheus.Desc) {
 // The removal happens only after their Collect method was called to ensure that
 // also those metrics will be exported on the current scrape.
 func (ps *prometheusState) Collect(ch chan<- stdprometheus.Metric) {
+	for _, v := range ps.vectors {
+		v.Collect(ch)
+	}
+
 	ps.mtx.Lock()
 	defer ps.mtx.Unlock()
 
-	var outdatedKeys []string
-	for key, cs := range ps.state {
-		cs.collector.Collect(ch)
-
-		if ps.isOutdated(cs) {
-			outdatedKeys = append(outdatedKeys, key)
+	for _, ep := range ps.deletedEP {
+		if !ps.dynamicConfig.hasEntryPoint(ep) {
+			ps.DeletePartialMatch(map[string]string{"entrypoint": ep})
 		}
 	}
 
-	for _, key := range outdatedKeys {
-		ps.state[key].delete()
-		delete(ps.state, key)
+	for _, router := range ps.deletedRouters {
+		if !ps.dynamicConfig.hasRouter(router) {
+			ps.DeletePartialMatch(map[string]string{"router": router})
+		}
 	}
+
+	for _, service := range ps.deletedServices {
+		if !ps.dynamicConfig.hasService(service) {
+			ps.DeletePartialMatch(map[string]string{"service": service})
+		}
+	}
+
+	for service, urls := range ps.deletedURLs {
+		for _, url := range urls {
+			if !ps.dynamicConfig.hasServerURL(service, url) {
+				ps.DeletePartialMatch(map[string]string{"service": service, "url": url})
+			}
+		}
+	}
+
+	ps.deletedEP = nil
+	ps.deletedRouters = nil
+	ps.deletedServices = nil
+	ps.deletedURLs = make(map[string][]string)
 }
 
-// isOutdated checks whether the passed collector has labels that mark
-// it as belonging to an outdated configuration of Traefik.
-func (ps *prometheusState) isOutdated(collector *collector) bool {
-	labels := collector.labels
-
-	if entrypointName, ok := labels["entrypoint"]; ok && !ps.dynamicConfig.hasEntryPoint(entrypointName) {
-		return true
+// DeletePartialMatch deletes all metrics where the variable labels contain all of those passed in as labels.
+// The order of the labels does not matter.
+// It returns the number of metrics deleted.
+func (ps *prometheusState) DeletePartialMatch(labels stdprometheus.Labels) int {
+	var count int
+	for _, elem := range ps.vectors {
+		count += elem.DeletePartialMatch(labels)
 	}
-
-	if routerName, ok := labels["router"]; ok {
-		if !ps.dynamicConfig.hasRouter(routerName) {
-			return true
-		}
-	}
-
-	if serviceName, ok := labels["service"]; ok {
-		if !ps.dynamicConfig.hasService(serviceName) {
-			return true
-		}
-		if url, ok := labels["url"]; ok && !ps.dynamicConfig.hasServerURL(serviceName, url) {
-			return true
-		}
-	}
-
-	return false
+	return count
 }
 
 func newDynamicConfig() *dynamicConfig {
@@ -440,42 +466,14 @@ func (d *dynamicConfig) hasServerURL(serviceName, serverURL string) bool {
 	return false
 }
 
-func newCollector(metricName string, labels stdprometheus.Labels, c stdprometheus.Collector, deleteFn func()) *collector {
-	return &collector{
-		id:        buildMetricID(metricName, labels),
-		labels:    labels,
-		collector: c,
-		delete:    deleteFn,
-	}
-}
-
-// collector wraps a Collector object from the Prometheus client library.
-// It adds information on how many generations this metric should be present
-// in the /metrics output, relative to the time it was last tracked.
-type collector struct {
-	id        string
-	labels    stdprometheus.Labels
-	collector stdprometheus.Collector
-	delete    func()
-}
-
-func buildMetricID(metricName string, labels stdprometheus.Labels) string {
-	var labelNamesValues []string
-	for name, value := range labels {
-		labelNamesValues = append(labelNamesValues, name, value)
-	}
-	sort.Strings(labelNamesValues)
-	return metricName + ":" + strings.Join(labelNamesValues, "|")
-}
-
-func newCounterFrom(collectors chan<- *collector, opts stdprometheus.CounterOpts, labelNames []string) *counter {
+func newCounterFrom(opts stdprometheus.CounterOpts, labelNames []string) *counter {
 	cv := stdprometheus.NewCounterVec(opts, labelNames)
 	c := &counter{
-		name:       opts.Name,
-		cv:         cv,
-		collectors: collectors,
+		name: opts.Name,
+		cv:   cv,
 	}
 	if len(labelNames) == 0 {
+		c.collector = cv.WithLabelValues()
 		c.Add(0)
 	}
 	return c
@@ -485,39 +483,36 @@ type counter struct {
 	name             string
 	cv               *stdprometheus.CounterVec
 	labelNamesValues labelNamesValues
-	collectors       chan<- *collector
+	collector        stdprometheus.Counter
 }
 
 func (c *counter) With(labelValues ...string) metrics.Counter {
+	lnv := c.labelNamesValues.With(labelValues...)
 	return &counter{
 		name:             c.name,
 		cv:               c.cv,
-		labelNamesValues: c.labelNamesValues.With(labelValues...),
-		collectors:       c.collectors,
+		labelNamesValues: lnv,
+		collector:        c.cv.With(lnv.ToLabels()),
 	}
 }
 
 func (c *counter) Add(delta float64) {
-	labels := c.labelNamesValues.ToLabels()
-	collector := c.cv.With(labels)
-	collector.Add(delta)
-	c.collectors <- newCollector(c.name, labels, collector, func() {
-		c.cv.Delete(labels)
-	})
+	c.collector.Add(delta)
 }
 
 func (c *counter) Describe(ch chan<- *stdprometheus.Desc) {
 	c.cv.Describe(ch)
 }
 
-func newGaugeFrom(collectors chan<- *collector, opts stdprometheus.GaugeOpts, labelNames []string) *gauge {
+func newGaugeFrom(opts stdprometheus.GaugeOpts, labelNames []string) *gauge {
 	gv := stdprometheus.NewGaugeVec(opts, labelNames)
 	g := &gauge{
-		name:       opts.Name,
-		gv:         gv,
-		collectors: collectors,
+		name: opts.Name,
+		gv:   gv,
 	}
+
 	if len(labelNames) == 0 {
+		g.collector = gv.WithLabelValues()
 		g.Set(0)
 	}
 	return g
@@ -527,46 +522,36 @@ type gauge struct {
 	name             string
 	gv               *stdprometheus.GaugeVec
 	labelNamesValues labelNamesValues
-	collectors       chan<- *collector
+	collector        stdprometheus.Gauge
 }
 
 func (g *gauge) With(labelValues ...string) metrics.Gauge {
+	lnv := g.labelNamesValues.With(labelValues...)
 	return &gauge{
 		name:             g.name,
 		gv:               g.gv,
-		labelNamesValues: g.labelNamesValues.With(labelValues...),
-		collectors:       g.collectors,
+		labelNamesValues: lnv,
+		collector:        g.gv.With(lnv.ToLabels()),
 	}
 }
 
 func (g *gauge) Add(delta float64) {
-	labels := g.labelNamesValues.ToLabels()
-	collector := g.gv.With(labels)
-	collector.Add(delta)
-	g.collectors <- newCollector(g.name, labels, collector, func() {
-		g.gv.Delete(labels)
-	})
+	g.collector.Add(delta)
 }
 
 func (g *gauge) Set(value float64) {
-	labels := g.labelNamesValues.ToLabels()
-	collector := g.gv.With(labels)
-	collector.Set(value)
-	g.collectors <- newCollector(g.name, labels, collector, func() {
-		g.gv.Delete(labels)
-	})
+	g.collector.Set(value)
 }
 
 func (g *gauge) Describe(ch chan<- *stdprometheus.Desc) {
 	g.gv.Describe(ch)
 }
 
-func newHistogramFrom(collectors chan<- *collector, opts stdprometheus.HistogramOpts, labelNames []string) *histogram {
+func newHistogramFrom(opts stdprometheus.HistogramOpts, labelNames []string) *histogram {
 	hv := stdprometheus.NewHistogramVec(opts, labelNames)
 	return &histogram{
-		name:       opts.Name,
-		hv:         hv,
-		collectors: collectors,
+		name: opts.Name,
+		hv:   hv,
 	}
 }
 
@@ -574,28 +559,21 @@ type histogram struct {
 	name             string
 	hv               *stdprometheus.HistogramVec
 	labelNamesValues labelNamesValues
-	collectors       chan<- *collector
+	collector        stdprometheus.Observer
 }
 
 func (h *histogram) With(labelValues ...string) metrics.Histogram {
+	lnv := h.labelNamesValues.With(labelValues...)
 	return &histogram{
 		name:             h.name,
 		hv:               h.hv,
-		labelNamesValues: h.labelNamesValues.With(labelValues...),
-		collectors:       h.collectors,
+		labelNamesValues: lnv,
+		collector:        h.hv.With(lnv.ToLabels()),
 	}
 }
 
 func (h *histogram) Observe(value float64) {
-	labels := h.labelNamesValues.ToLabels()
-	observer := h.hv.With(labels)
-	observer.Observe(value)
-	// Do a type assertion to be sure that prometheus will be able to call the Collect method.
-	if collector, ok := observer.(stdprometheus.Histogram); ok {
-		h.collectors <- newCollector(h.name, labels, collector, func() {
-			h.hv.Delete(labels)
-		})
-	}
+	h.collector.Observe(value)
 }
 
 func (h *histogram) Describe(ch chan<- *stdprometheus.Desc) {
@@ -612,13 +590,18 @@ func (lvs labelNamesValues) With(labelValues ...string) labelNamesValues {
 	if len(labelValues)%2 != 0 {
 		labelValues = append(labelValues, "unknown")
 	}
-	return append(lvs, labelValues...)
+
+	labels := make([]string, len(lvs)+len(labelValues))
+	n := copy(labels, lvs)
+	copy(labels[n:], labelValues)
+
+	return labels
 }
 
 // ToLabels is a convenience method to convert a labelNamesValues
 // to the native prometheus.Labels.
 func (lvs labelNamesValues) ToLabels() stdprometheus.Labels {
-	labels := stdprometheus.Labels{}
+	labels := make(map[string]string, len(lvs)/2)
 	for i := 0; i < len(lvs); i += 2 {
 		labels[lvs[i]] = lvs[i+1]
 	}

pkg/metrics/prometheus_test.go

@@ -17,8 +17,7 @@ import (
 )
 
 func TestRegisterPromState(t *testing.T) {
-	// Reset state of global promState.
-	defer promState.reset()
+	t.Cleanup(promState.reset)
 
 	testCases := []struct {
 		desc                 string
@@ -88,21 +87,10 @@ func TestRegisterPromState(t *testing.T) {
 	}
 }
 
-// reset is a utility method for unit testing. It should be called after each
-// test run that changes promState internally in order to avoid dependencies
-// between unit tests.
-func (ps *prometheusState) reset() {
-	ps.collectors = make(chan *collector)
-	ps.describers = []func(ch chan<- *prometheus.Desc){}
-	ps.dynamicConfig = newDynamicConfig()
-	ps.state = make(map[string]*collector)
-}
-
 func TestPrometheus(t *testing.T) {
 	promState = newPrometheusState()
 	promRegistry = prometheus.NewRegistry()
-	// Reset state of global promState.
-	defer promState.reset()
+	t.Cleanup(promState.reset)
 
 	prometheusRegistry := RegisterPrometheus(context.Background(), &types.Prometheus{AddEntryPointsLabels: true, AddRoutersLabels: true, AddServicesLabels: true})
 	defer promRegistry.Unregister(promState)
@@ -361,30 +349,41 @@ func TestPrometheus(t *testing.T) {
 func TestPrometheusMetricRemoval(t *testing.T) {
 	promState = newPrometheusState()
 	promRegistry = prometheus.NewRegistry()
-	// Reset state of global promState.
-	defer promState.reset()
+	t.Cleanup(promState.reset)
 
 	prometheusRegistry := RegisterPrometheus(context.Background(), &types.Prometheus{AddEntryPointsLabels: true, AddServicesLabels: true, AddRoutersLabels: true})
 	defer promRegistry.Unregister(promState)
 
-	conf := dynamic.Configuration{
+	conf1 := dynamic.Configuration{
 		HTTP: th.BuildConfiguration(
 			th.WithRouters(
-				th.WithRouter("foo@providerName",
-					th.WithServiceName("bar")),
+				th.WithRouter("foo@providerName", th.WithServiceName("bar")),
+				th.WithRouter("router2", th.WithServiceName("bar@providerName")),
 			),
-			th.WithLoadBalancerServices(th.WithService("bar@providerName",
-				th.WithServers(th.WithServer("http://localhost:9000"))),
+			th.WithLoadBalancerServices(
+				th.WithService("bar@providerName", th.WithServers(
+					th.WithServer("http://localhost:9000"),
+					th.WithServer("http://localhost:9999"),
+					th.WithServer("http://localhost:9998"),
+				)),
+				th.WithService("service1", th.WithServers(th.WithServer("http://localhost:9000"))),
 			),
-			func(cfg *dynamic.HTTPConfiguration) {
-				cfg.Services["fii"] = &dynamic.Service{
-					Weighted: &dynamic.WeightedRoundRobin{},
-				}
-			},
 		),
 	}
 
-	OnConfigurationUpdate(conf, []string{"entrypoint1"})
+	conf2 := dynamic.Configuration{
+		HTTP: th.BuildConfiguration(
+			th.WithRouters(
+				th.WithRouter("foo@providerName", th.WithServiceName("bar")),
+			),
+			th.WithLoadBalancerServices(
+				th.WithService("bar@providerName", th.WithServers(th.WithServer("http://localhost:9000"))),
+			),
+		),
+	}
+
+	OnConfigurationUpdate(conf1, []string{"entrypoint1", "entrypoint2"})
+	OnConfigurationUpdate(conf2, []string{"entrypoint1"})
 
 	// Register some metrics manually that are not part of the active configuration.
 	// Those metrics should be part of the /metrics output on the first scrape but
@@ -393,22 +392,25 @@ func TestPrometheusMetricRemoval(t *testing.T) {
 		EntryPointReqsCounter().
 		With("entrypoint", "entrypoint2", "code", strconv.Itoa(http.StatusOK), "method", http.MethodGet, "protocol", "http").
 		Add(1)
+	prometheusRegistry.
+		RouterReqsCounter().
+		With("router", "router2", "service", "bar@providerName", "code", strconv.Itoa(http.StatusOK), "method", http.MethodGet, "protocol", "http").
+		Add(1)
 	prometheusRegistry.
 		ServiceReqsCounter().
-		With("service", "service2", "code", strconv.Itoa(http.StatusOK), "method", http.MethodGet, "protocol", "http").
+		With("service", "service1", "code", strconv.Itoa(http.StatusOK), "method", http.MethodGet, "protocol", "http").
 		Add(1)
 	prometheusRegistry.
 		ServiceServerUpGauge().
-		With("service", "service1", "url", "http://localhost:9999").
+		With("service", "bar@providerName", "url", "http://localhost:9999").
 		Set(1)
 	prometheusRegistry.
-		RouterReqsCounter().
-		With("router", "router2", "service", "service2", "code", strconv.Itoa(http.StatusOK), "method", http.MethodGet, "protocol", "http").
-		Add(1)
+		ServiceServerUpGauge().
+		With("service", "bar@providerName", "url", "http://localhost:9998").
+		Set(1)
 
-	assertMetricsExist(t, mustScrape(), entryPointReqsTotalName, serviceReqsTotalName, serviceServerUpName)
-	assertMetricsAbsent(t, mustScrape(), entryPointReqsTotalName, serviceReqsTotalName, serviceServerUpName)
-	assertMetricsAbsent(t, mustScrape(), routerReqsTotalName, routerReqDurationName, routerOpenConnsName)
+	assertMetricsExist(t, mustScrape(), entryPointReqsTotalName, routerReqsTotalName, serviceReqsTotalName, serviceServerUpName)
+	assertMetricsAbsent(t, mustScrape(), entryPointReqsTotalName, routerReqsTotalName, serviceReqsTotalName, serviceServerUpName)
 
 	// To verify that metrics belonging to active configurations are not removed
 	// here the counter examples.
@@ -418,24 +420,80 @@ func TestPrometheusMetricRemoval(t *testing.T) {
 		Add(1)
 	prometheusRegistry.
 		RouterReqsCounter().
-		With("router", "foo@providerName", "service", "bar@providerName", "code", strconv.Itoa(http.StatusOK), "method", http.MethodGet, "protocol", "http").
+		With("router", "foo@providerName", "service", "bar", "code", strconv.Itoa(http.StatusOK), "method", http.MethodGet, "protocol", "http").
 		Add(1)
+	prometheusRegistry.
+		ServiceReqsCounter().
+		With("service", "bar@providerName", "code", strconv.Itoa(http.StatusOK), "method", http.MethodGet, "protocol", "http").
+		Add(1)
+	prometheusRegistry.
+		ServiceServerUpGauge().
+		With("service", "bar@providerName", "url", "http://localhost:9000").
+		Set(1)
 
 	delayForTrackingCompletion()
 
-	assertMetricsExist(t, mustScrape(), entryPointReqsTotalName)
-	assertMetricsExist(t, mustScrape(), entryPointReqsTotalName)
-	assertMetricsExist(t, mustScrape(), routerReqsTotalName)
-	assertMetricsExist(t, mustScrape(), routerReqsTotalName)
+	assertMetricsExist(t, mustScrape(), entryPointReqsTotalName, serviceReqsTotalName, serviceServerUpName, routerReqsTotalName)
+	assertMetricsExist(t, mustScrape(), entryPointReqsTotalName, serviceReqsTotalName, serviceServerUpName, routerReqsTotalName)
+}
+
+func TestPrometheusMetricRemoveEndpointForRecoveredService(t *testing.T) {
+	promState = newPrometheusState()
+	promRegistry = prometheus.NewRegistry()
+	t.Cleanup(promState.reset)
+
+	prometheusRegistry := RegisterPrometheus(context.Background(), &types.Prometheus{AddServicesLabels: true})
+	defer promRegistry.Unregister(promState)
+
+	conf1 := dynamic.Configuration{
+		HTTP: th.BuildConfiguration(
+			th.WithLoadBalancerServices(
+				th.WithService("service1", th.WithServers(th.WithServer("http://localhost:9000"))),
+			),
+		),
+	}
+
+	conf2 := dynamic.Configuration{
+		HTTP: th.BuildConfiguration(),
+	}
+
+	conf3 := dynamic.Configuration{
+		HTTP: th.BuildConfiguration(
+			th.WithLoadBalancerServices(
+				th.WithService("service1", th.WithServers(th.WithServer("http://localhost:9001"))),
+			),
+		),
+	}
+
+	OnConfigurationUpdate(conf1, []string{})
+	OnConfigurationUpdate(conf2, []string{})
+	OnConfigurationUpdate(conf3, []string{})
+
+	prometheusRegistry.
+		ServiceServerUpGauge().
+		With("service", "service1", "url", "http://localhost:9000").
+		Add(1)
+
+	assertMetricsExist(t, mustScrape(), serviceServerUpName)
+	assertMetricsAbsent(t, mustScrape(), serviceServerUpName)
 }
 
 func TestPrometheusRemovedMetricsReset(t *testing.T) {
-	// Reset state of global promState.
-	defer promState.reset()
+	t.Cleanup(promState.reset)
 
 	prometheusRegistry := RegisterPrometheus(context.Background(), &types.Prometheus{AddEntryPointsLabels: true, AddServicesLabels: true})
 	defer promRegistry.Unregister(promState)
 
+	conf1 := dynamic.Configuration{
+		HTTP: th.BuildConfiguration(
+			th.WithLoadBalancerServices(th.WithService("service",
+				th.WithServers(th.WithServer("http://localhost:9000"))),
+			),
+		),
+	}
+	OnConfigurationUpdate(conf1, []string{"entrypoint1", "entrypoint2"})
+	OnConfigurationUpdate(dynamic.Configuration{}, nil)
+
 	labelNamesValues := []string{
 		"service", "service",
 		"code", strconv.Itoa(http.StatusOK),
@@ -467,12 +525,24 @@ func TestPrometheusRemovedMetricsReset(t *testing.T) {
 	assertCounterValue(t, 1, findMetricFamily(serviceReqsTotalName, metricsFamilies), labelNamesValues...)
 }
 
+// reset is a utility method for unit testing.
+// It should be called after each test run that changes promState internally
+// in order to avoid dependencies between unit tests.
+func (ps *prometheusState) reset() {
+	ps.dynamicConfig = newDynamicConfig()
+	ps.vectors = nil
+	ps.deletedEP = nil
+	ps.deletedRouters = nil
+	ps.deletedServices = nil
+	ps.deletedURLs = make(map[string][]string)
+}
+
 // Tracking and gathering the metrics happens concurrently.
-// In practice this is no problem, because in case a tracked metric would miss
-// the current scrape, it would just be there in the next one.
-// That we can test reliably the tracking of all metrics here, we sleep
-// for a short amount of time, to make sure the metric will be present
-// in the next scrape.
+// In practice this is no problem, because in case a tracked metric would miss the current scrape,
+// it would just be there in the next one.
+// That we can test reliably the tracking of all metrics here,
+// we sleep for a short amount of time,
+// to make sure the metric will be present in the next scrape.
 func delayForTrackingCompletion() {
 	time.Sleep(250 * time.Millisecond)
 }

pkg/metrics/statsd.go

@@ -50,7 +50,7 @@ func RegisterStatsd(ctx context.Context, config *types.Statsd) Registry {
 	}
 
 	statsdClient = statsd.New(config.Prefix+".", kitlog.LoggerFunc(func(keyvals ...interface{}) error {
-		log.WithoutContext().WithField(log.MetricsProviderName, "statsd").Info(keyvals)
+		log.WithoutContext().WithField(log.MetricsProviderName, "statsd").Info(keyvals...)
 		return nil
 	}))
 

pkg/middlewares/compress/compress_test.go

@@ -401,7 +401,7 @@ func BenchmarkCompress(b *testing.B) {
 			})
 			handler, _ := New(context.Background(), next, dynamic.Compress{}, "testing")
 
-			req, _ := http.NewRequest("GET", "/whatever", nil)
+			req, _ := http.NewRequest(http.MethodGet, "/whatever", nil)
 			req.Header.Set("Accept-Encoding", "gzip")
 
 			b.ReportAllocs()

pkg/middlewares/forwardedheaders/forwarded_header.go

@@ -142,6 +142,9 @@ func (x *XForwarded) rewrite(outreq *http.Request) {
 
 	xfProto := unsafeHeader(outreq.Header).Get(xForwardedProto)
 	if xfProto == "" {
+		// TODO: is this expected to set the X-Forwarded-Proto header value to
+		// ws(s) as the underlying request used to upgrade the connection is
+		// made over HTTP(S)?
 		if isWebsocketRequest(outreq) {
 			if outreq.TLS != nil {
 				unsafeHeader(outreq.Header).Set(xForwardedProto, "wss")

pkg/middlewares/ipwhitelist/ip_whitelist.go

@@ -63,15 +63,16 @@ func (wl *ipWhiteLister) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	ctx := middlewares.GetLoggerCtx(req.Context(), wl.name, typeName)
 	logger := log.FromContext(ctx)
 
-	err := wl.whiteLister.IsAuthorized(wl.strategy.GetIP(req))
+	clientIP := wl.strategy.GetIP(req)
+	err := wl.whiteLister.IsAuthorized(clientIP)
 	if err != nil {
-		logMessage := fmt.Sprintf("rejecting request %+v: %v", req, err)
-		logger.Debug(logMessage)
-		tracing.SetErrorWithEvent(req, logMessage)
+		msg := fmt.Sprintf("Rejecting IP %s: %v", clientIP, err)
+		logger.Debug(msg)
+		tracing.SetErrorWithEvent(req, msg)
 		reject(ctx, rw)
 		return
 	}
-	logger.Debugf("Accept %s: %+v", wl.strategy.GetIP(req), req)
+	logger.Debugf("Accepting IP %s", clientIP)
 
 	wl.next.ServeHTTP(rw, req)
 }

pkg/middlewares/metrics/metrics.go

@@ -103,8 +103,9 @@ func (m *metricsMiddleware) ServeHTTP(rw http.ResponseWriter, req *http.Request)
 	labels = append(labels, m.baseLabels...)
 	labels = append(labels, "method", getMethod(req), "protocol", getRequestProtocol(req))
 
-	m.openConnsGauge.With(labels...).Add(1)
-	defer m.openConnsGauge.With(labels...).Add(-1)
+	openConnsGauge := m.openConnsGauge.With(labels...)
+	openConnsGauge.Add(1)
+	defer openConnsGauge.Add(-1)
 
 	// TLS metrics
 	if req.TLS != nil {
@@ -122,8 +123,7 @@ func (m *metricsMiddleware) ServeHTTP(rw http.ResponseWriter, req *http.Request)
 
 	labels = append(labels, "code", strconv.Itoa(recorder.getCode()))
 
-	histograms := m.reqDurationHistogram.With(labels...)
-	histograms.ObserveFromStart(start)
+	m.reqDurationHistogram.With(labels...).ObserveFromStart(start)
 
 	m.reqsCounter.With(labels...).Add(1)
 }