Prepare release v2.5.0-rc5

Co-authored-by: Tom Moulard <tom.moulard@traefik.io>

.gitignore

@@ -17,4 +17,5 @@
 cover.out
 vendor/
 plugins-storage/
+plugins-local/
 traefik_changelog.md

.golangci.toml

@@ -109,6 +109,11 @@
     "Error return value of .((os\\.)?std(out|err)\\..*|.*Close|.*Flush|os\\.Remove(All)?|.*printf?|os\\.(Un)?Setenv). is not checked",
     "should have a package comment, unless it's in another file for this package",
     "SA1019: http.CloseNotifier has been deprecated",  # FIXME must be fixed
+    "SA1019: cfg.SSLRedirect is deprecated",
+    "SA1019: cfg.SSLTemporaryRedirect is deprecated",
+    "SA1019: cfg.SSLHost is deprecated",
+    "SA1019: cfg.SSLForceHost is deprecated",
+    "SA1019: cfg.FeaturePolicy is deprecated",
   ]
  [[issues.exclude-rules]]
     path = "(.+)_test.go"

.semaphore/semaphore.yml

@@ -2,7 +2,7 @@ version: v1.0
 name: Traefik
 agent:
   machine:
-    type: e1-standard-4
+    type: e1-standard-8
     os_image: ubuntu1804
 
 fail_fast:

CHANGELOG.md

@@ -1,8 +1,23 @@
+## [v2.5.0-rc5](https://github.com/traefik/traefik/tree/v2.5.0-rc5) (2021-08-03)
+[All Commits](https://github.com/traefik/traefik/compare/v2.5.0-rc3...v2.5.0-rc5)
+
+**Bug fixes:**
+- **[k8s]** Kubernetes: detect changes for resources other than endpoints ([#8313](https://github.com/traefik/traefik/pull/8313) by [rtribotte](https://github.com/rtribotte))
+
+**Misc:**
+- Merge current v2.4 into v2.5 ([#8325](https://github.com/traefik/traefik/pull/8325) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- Merge current v2.4 into v2.5 ([#8314](https://github.com/traefik/traefik/pull/8314) by [rtribotte](https://github.com/rtribotte))
+- Merge current v2.4 into v2.5 ([#8296](https://github.com/traefik/traefik/pull/8296) by [tomMoulard](https://github.com/tomMoulard))
+
+## [v2.5.0-rc4](https://github.com/traefik/traefik/tree/v2.5.0-rc4) (2021-08-03)
+
+Release canceled.
+
 ## [v2.4.13](https://github.com/traefik/traefik/tree/v2.4.13) (2021-07-30)
 [All Commits](https://github.com/traefik/traefik/compare/v2.4.12...v2.4.13)
 
 **Bug fixes:**
-- **[authentication,middleware]** Remove hop-by-hop headers define in connection header beore some middleware ([#8319](https://github.com/traefik/traefik/pull/8319) by [ldez](https://github.com/ldez))
+- **[authentication,middleware]** Remove hop-by-hop headers defined in connection header before some middleware ([#8319](https://github.com/traefik/traefik/pull/8319) by [ldez](https://github.com/ldez))
 
 ## [v2.4.12](https://github.com/traefik/traefik/tree/v2.4.12) (2021-07-26)
 [All Commits](https://github.com/traefik/traefik/compare/v2.4.11...v2.4.12)
@@ -13,6 +28,27 @@
 - **[middleware]** Ratelimiter: use correct ttlSeconds value, and always call Set ([#8254](https://github.com/traefik/traefik/pull/8254) by [mpl](https://github.com/mpl))
 - **[tls]** Check if defaultcertificate is defined in store ([#8274](https://github.com/traefik/traefik/pull/8274) by [dtomcej](https://github.com/dtomcej))
 
+## [v2.5.0-rc3](https://github.com/traefik/traefik/tree/v2.5.0-rc3) (2021-07-20)
+[All Commits](https://github.com/traefik/traefik/compare/v2.5.0-rc2...v2.5.0-rc3)
+
+**Enhancements:**
+- **[consulcatalog]** Add Support for Consul Connect ([#7407](https://github.com/traefik/traefik/pull/7407) by [Gufran](https://github.com/Gufran))
+
+**Bug fixes:**
+- **[k8s,k8s/gatewayapi]** Update Gateway API version to v0.3.0 ([#8253](https://github.com/traefik/traefik/pull/8253) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[middleware]** Library change for compress middleware to increase performance ([#8245](https://github.com/traefik/traefik/pull/8245) by [tomMoulard](https://github.com/tomMoulard))
+- **[plugins]** Update yaegi to v0.9.21 ([#8285](https://github.com/traefik/traefik/pull/8285) by [ldez](https://github.com/ldez))
+- **[plugins]** Downgrade yaegi to v0.9.19 ([#8282](https://github.com/traefik/traefik/pull/8282) by [ldez](https://github.com/ldez))
+- **[webui]** Fix dashboard to display middleware details ([#8284](https://github.com/traefik/traefik/pull/8284) by [tomMoulard](https://github.com/tomMoulard))
+
+**Documentation:**
+- Fix KV reference documentation ([#8280](https://github.com/traefik/traefik/pull/8280) by [rtribotte](https://github.com/rtribotte))
+- Fix migration guide ([#8269](https://github.com/traefik/traefik/pull/8269) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- Update generated and reference doc for plugins ([#8236](https://github.com/traefik/traefik/pull/8236) by [tomMoulard](https://github.com/tomMoulard))
+
+**Misc:**
+- Merge current v2.4 into v2.5 ([#8263](https://github.com/traefik/traefik/pull/8263) by [rtribotte](https://github.com/rtribotte))
+
 ## [v2.4.11](https://github.com/traefik/traefik/tree/v2.4.11) (2021-07-15)
 [All Commits](https://github.com/traefik/traefik/compare/v2.4.9...v2.4.11)
 
@@ -36,6 +72,80 @@
 
 Release canceled.
 
+## [v2.5.0-rc2](https://github.com/traefik/traefik/tree/v2.5.0-rc2) (2021-06-28)
+[All Commits](https://github.com/traefik/traefik/compare/v2.4.0-rc1...v2.5.0-rc2)
+
+**Enhancements:**
+- **[file]** Update sprig to v3.2.0 ([#7746](https://github.com/traefik/traefik/pull/7746) by [sirlatrom](https://github.com/sirlatrom))
+- **[healthcheck]** Healthcheck: add support at the load-balancers of services level ([#8057](https://github.com/traefik/traefik/pull/8057) by [mpl](https://github.com/mpl))
+- **[http3]** Upgrade github.com/lucas-clemente/quic-go ([#8076](https://github.com/traefik/traefik/pull/8076) by [sylr](https://github.com/sylr))
+- **[http3]** Add HTTP3 support (experimental) ([#7724](https://github.com/traefik/traefik/pull/7724) by [juliens](https://github.com/juliens))
+- **[k8s,k8s/crd,k8s/ingress]** Ignore empty endpoint changes ([#7646](https://github.com/traefik/traefik/pull/7646) by [hensur](https://github.com/hensur))
+- **[k8s,k8s/crd]** Improve kubernetes external name service support for UDP ([#7773](https://github.com/traefik/traefik/pull/7773) by [kevinpollet](https://github.com/kevinpollet))
+- **[k8s,k8s/crd]** Upgrade the CRD version from apiextensions.k8s.io/v1beta1 to apiextensions.k8s.io/v1 ([#7815](https://github.com/traefik/traefik/pull/7815) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[k8s,k8s/crd]** Add named port support to Kubernetes IngressRoute CRDs ([#7668](https://github.com/traefik/traefik/pull/7668) by [Cirrith](https://github.com/Cirrith))
+- **[k8s,k8s/gatewayapi]** Add wildcard hostname rule to kubernetes gateway ([#7963](https://github.com/traefik/traefik/pull/7963) by [jberger](https://github.com/jberger))
+- **[k8s,k8s/gatewayapi]** Allow crossprovider service reference ([#7774](https://github.com/traefik/traefik/pull/7774) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[k8s,k8s/gatewayapi]** Add support for TCPRoute and TLSRoute ([#8054](https://github.com/traefik/traefik/pull/8054) by [tomMoulard](https://github.com/tomMoulard))
+- **[k8s,k8s/ingress]** Filter ingress class resources by name ([#7915](https://github.com/traefik/traefik/pull/7915) by [tomMoulard](https://github.com/tomMoulard))
+- **[k8s,k8s/ingress]** Upgrade Ingress Handling to work with networkingv1/Ingress ([#7549](https://github.com/traefik/traefik/pull/7549) by [SantoDE](https://github.com/SantoDE))
+- **[k8s,k8s/ingress]** Upgrade IngressClass to use v1 over v1Beta on Kube 1.19+ ([#8089](https://github.com/traefik/traefik/pull/8089) by [SantoDE](https://github.com/SantoDE))
+- **[k8s,k8s/ingress]** Add k8s provider option to create services without endpoints ([#7593](https://github.com/traefik/traefik/pull/7593) by [Lucaber](https://github.com/Lucaber))
+- **[k8s,k8s/ingress]** Add ServersTransport annotation to k8s ingress provider ([#8084](https://github.com/traefik/traefik/pull/8084) by [wdullaer](https://github.com/wdullaer))
+- **[logs,middleware]** Add TLS version and cipher to the accessLog ([#7478](https://github.com/traefik/traefik/pull/7478) by [na4ma4](https://github.com/na4ma4))
+- **[metrics]** Allow to define datadogs metrics endpoint with env vars ([#7968](https://github.com/traefik/traefik/pull/7968) by [sylr](https://github.com/sylr))
+- **[metrics]** Add TLS certs expiration metric ([#6924](https://github.com/traefik/traefik/pull/6924) by [sylr](https://github.com/sylr))
+- **[middleware,metrics]** Add router metrics ([#7510](https://github.com/traefik/traefik/pull/7510) by [jorge07](https://github.com/jorge07))
+- **[middleware,tcp]** Add TCP Middlewares support ([#7813](https://github.com/traefik/traefik/pull/7813) by [rtribotte](https://github.com/rtribotte))
+- **[middleware]** Deprecates ssl redirect headers middleware options ([#8160](https://github.com/traefik/traefik/pull/8160) by [tomMoulard](https://github.com/tomMoulard))
+- **[middleware]** Headers: add `permissionsPolicy` and deprecate `featurePolicy` ([#8200](https://github.com/traefik/traefik/pull/8200) by [WLun001](https://github.com/WLun001))
+- **[middleware]** Removes  headers middleware options  ([#8161](https://github.com/traefik/traefik/pull/8161) by [tomMoulard](https://github.com/tomMoulard))
+- **[plugins,provider]** Add plugin's support for provider ([#7794](https://github.com/traefik/traefik/pull/7794) by [ldez](https://github.com/ldez))
+- **[plugins]** Local private plugins. ([#8224](https://github.com/traefik/traefik/pull/8224) by [ldez](https://github.com/ldez))
+- **[rules]** Add routing IP rule matcher ([#8169](https://github.com/traefik/traefik/pull/8169) by [tomMoulard](https://github.com/tomMoulard))
+- **[rules]** Support not in rules definition ([#8164](https://github.com/traefik/traefik/pull/8164) by [juliens](https://github.com/juliens))
+- **[server]** Improve host name resolution for TCP proxy ([#7971](https://github.com/traefik/traefik/pull/7971) by [H-M-H](https://github.com/H-M-H))
+- **[server]** Add ability to disable HTTP/2 in dynamic config ([#7645](https://github.com/traefik/traefik/pull/7645) by [jcuzzi](https://github.com/jcuzzi))
+- **[sticky-session]** Add a mechanism to format the sticky cookie value ([#8103](https://github.com/traefik/traefik/pull/8103) by [tomMoulard](https://github.com/tomMoulard))
+- **[tls]** Mutualize TLS version and cipher code ([#7779](https://github.com/traefik/traefik/pull/7779) by [rtribotte](https://github.com/rtribotte))
+- **[tls]** Do not build a default certificate for ACME challenges store ([#7833](https://github.com/traefik/traefik/pull/7833) by [rkojedzinszky](https://github.com/rkojedzinszky))
+- **[tracing]** Use Datadog tracer environment variables to setup default config ([#7721](https://github.com/traefik/traefik/pull/7721) by [GianOrtiz](https://github.com/GianOrtiz))
+- **[tracing]** Update Elastic APM from 1.7.0 to 1.11.0 ([#8187](https://github.com/traefik/traefik/pull/8187) by [afitzek](https://github.com/afitzek))
+- **[tracing]** Override jaeger configuration with env variables ([#8198](https://github.com/traefik/traefik/pull/8198) by [mmatur](https://github.com/mmatur))
+- **[udp]** Add udp timeout configuration ([#6982](https://github.com/traefik/traefik/pull/6982) by [Lindenk](https://github.com/Lindenk))
+
+**Bug fixes:**
+- **[k8s]** Remove logging of changed object with cast ([#8128](https://github.com/traefik/traefik/pull/8128) by [hensur](https://github.com/hensur))
+
+**Documentation:**
+- **[k8s/crd]** Fix: regenerate crd ([#8114](https://github.com/traefik/traefik/pull/8114) by [tomMoulard](https://github.com/tomMoulard))
+- **[k8s]** Clarify doc for ingressclass name in k8s 1.18+ ([#7944](https://github.com/traefik/traefik/pull/7944) by [tomMoulard](https://github.com/tomMoulard))
+- Update documentation references ([#8202](https://github.com/traefik/traefik/pull/8202) by [rtribotte](https://github.com/rtribotte))
+
+**Misc:**
+- **[k8s,k8s/crd,tls]** Improve CA certificate loading from kubernetes secret ([#7789](https://github.com/traefik/traefik/pull/7789) by [rio](https://github.com/rio))
+- Merge current v2.4 into master ([#8221](https://github.com/traefik/traefik/pull/8221) by [rtribotte](https://github.com/rtribotte))
+- Merge current v2.4 into master ([#8105](https://github.com/traefik/traefik/pull/8105) by [tomMoulard](https://github.com/tomMoulard))
+- Merge current v2.4 into master ([#8087](https://github.com/traefik/traefik/pull/8087) by [tomMoulard](https://github.com/tomMoulard))
+- Merge current v2.4 into master ([#8068](https://github.com/traefik/traefik/pull/8068) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- Merge current v2.4 into master ([#8058](https://github.com/traefik/traefik/pull/8058) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- Merge current v2.4 into master ([#8024](https://github.com/traefik/traefik/pull/8024) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- Merge current v2.4 into master ([#7969](https://github.com/traefik/traefik/pull/7969) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- Merge current v2.4 into master ([#7921](https://github.com/traefik/traefik/pull/7921) by [rtribotte](https://github.com/rtribotte))
+- Merge current v2.4 into master ([#7901](https://github.com/traefik/traefik/pull/7901) by [rtribotte](https://github.com/rtribotte))
+- Merge current v2.4 into master ([#7859](https://github.com/traefik/traefik/pull/7859) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- Merge current v2.4 into master ([#7795](https://github.com/traefik/traefik/pull/7795) by [kevinpollet](https://github.com/kevinpollet))
+- Merge current v2.4 into master ([#8210](https://github.com/traefik/traefik/pull/8210) by [rtribotte](https://github.com/rtribotte))
+- Merge current v2.4 into master ([#7781](https://github.com/traefik/traefik/pull/7781) by [kevinpollet](https://github.com/kevinpollet))
+- Merge current v2.4 into master ([#7766](https://github.com/traefik/traefik/pull/7766) by [ldez](https://github.com/ldez))
+- Merge current v2.4 into master ([#7761](https://github.com/traefik/traefik/pull/7761) by [rtribotte](https://github.com/rtribotte))
+- Merge current v2.4 into master ([#7748](https://github.com/traefik/traefik/pull/7748) by [kevinpollet](https://github.com/kevinpollet))
+- Merge current v2.4 into master ([#7728](https://github.com/traefik/traefik/pull/7728) by [mmatur](https://github.com/mmatur))
+
+## [v2.5.0-rc1](https://github.com/traefik/traefik/tree/v2.5.0-rc1) (2021-06-28)
+
+Release canceled.
+
 ## [v2.4.9](https://github.com/traefik/traefik/tree/v2.4.9) (2021-06-21)
 [All Commits](https://github.com/traefik/traefik/compare/v2.4.8...v2.4.9)
 

Makefile

@@ -7,7 +7,7 @@ SHA := $(shell git rev-parse HEAD)
 VERSION_GIT := $(if $(TAG_NAME),$(TAG_NAME),$(SHA))
 VERSION := $(if $(VERSION),$(VERSION),$(VERSION_GIT))
 
-BIND_DIR := "dist"
+BIND_DIR := dist
 
 GIT_BRANCH := $(subst heads/,,$(shell git rev-parse --abbrev-ref HEAD 2>/dev/null))
 TRAEFIK_DEV_IMAGE := traefik-dev$(if $(GIT_BRANCH),:$(subst /,-,$(GIT_BRANCH)))
@@ -144,10 +144,14 @@ docs-pull-images:
 generate-crd:
 	@$(CURDIR)/script/code-gen.sh
 
+## Generate code from dynamic configuration https://github.com/traefik/genconf
+generate-genconf:
+	go run ./cmd/internal/gen/
+
 ## Create packages for the release
 release-packages: generate-webui $(PRE_TARGET)
 	rm -rf dist
-	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK_NOTTY)) goreleaser release --skip-publish --timeout="60m"
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK_NOTTY)) goreleaser release --skip-publish --timeout="90m"
 	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK_NOTTY)) tar cfz dist/traefik-${VERSION}.src.tar.gz \
 		--exclude-vcs \
 		--exclude .idea \

cmd/internal/gen/centrifuge.go

@@ -0,0 +1,347 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"go/format"
+	"go/importer"
+	"go/token"
+	"go/types"
+	"io"
+	"log"
+	"os"
+	"path"
+	"path/filepath"
+	"reflect"
+	"sort"
+	"strings"
+
+	"golang.org/x/tools/imports"
+)
+
+// File a kind of AST element that represents a file.
+type File struct {
+	Package  string
+	Imports  []string
+	Elements []Element
+}
+
+// Element is a simplified version of a symbol.
+type Element struct {
+	Name  string
+	Value string
+}
+
+// Centrifuge a centrifuge.
+// Generate Go Structures from Go structures.
+type Centrifuge struct {
+	IncludedImports []string
+	ExcludedTypes   []string
+	ExcludedFiles   []string
+
+	TypeCleaner    func(types.Type, string) string
+	PackageCleaner func(string) string
+
+	rootPkg string
+	fileSet *token.FileSet
+	pkg     *types.Package
+}
+
+// NewCentrifuge creates a new Centrifuge.
+func NewCentrifuge(rootPkg string) (*Centrifuge, error) {
+	fileSet := token.NewFileSet()
+
+	pkg, err := importer.ForCompiler(fileSet, "source", nil).Import(rootPkg)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Centrifuge{
+		fileSet: fileSet,
+		pkg:     pkg,
+		rootPkg: rootPkg,
+
+		TypeCleaner: func(typ types.Type, _ string) string {
+			return typ.String()
+		},
+		PackageCleaner: func(s string) string {
+			return s
+		},
+	}, nil
+}
+
+// Run runs the code extraction and the code generation.
+func (c Centrifuge) Run(dest string, pkgName string) error {
+	files, err := c.run(c.pkg.Scope(), c.rootPkg, pkgName)
+	if err != nil {
+		return err
+	}
+
+	err = fileWriter{baseDir: dest}.Write(files)
+	if err != nil {
+		return err
+	}
+
+	for _, p := range c.pkg.Imports() {
+		if contains(c.IncludedImports, p.Path()) {
+			fls, err := c.run(p.Scope(), p.Path(), p.Name())
+			if err != nil {
+				return err
+			}
+
+			err = fileWriter{baseDir: filepath.Join(dest, p.Name())}.Write(fls)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return err
+}
+
+func (c Centrifuge) run(sc *types.Scope, rootPkg string, pkgName string) (map[string]*File, error) {
+	files := map[string]*File{}
+
+	for _, name := range sc.Names() {
+		if contains(c.ExcludedTypes, name) {
+			continue
+		}
+
+		o := sc.Lookup(name)
+		if !o.Exported() {
+			continue
+		}
+
+		filename := filepath.Base(c.fileSet.File(o.Pos()).Name())
+		if contains(c.ExcludedFiles, path.Join(rootPkg, filename)) {
+			continue
+		}
+
+		fl, ok := files[filename]
+		if !ok {
+			files[filename] = &File{Package: pkgName}
+			fl = files[filename]
+		}
+
+		elt := Element{
+			Name: name,
+		}
+
+		switch ob := o.(type) {
+		case *types.TypeName:
+
+			switch obj := ob.Type().(*types.Named).Underlying().(type) {
+			case *types.Struct:
+				elt.Value = c.writeStruct(name, obj, rootPkg, fl)
+
+			case *types.Map:
+				elt.Value = fmt.Sprintf("type %s map[%s]%s\n", name, obj.Key().String(), c.TypeCleaner(obj.Elem(), rootPkg))
+
+			case *types.Slice:
+				elt.Value = fmt.Sprintf("type %s []%v\n", name, c.TypeCleaner(obj.Elem(), rootPkg))
+
+			case *types.Basic:
+				elt.Value = fmt.Sprintf("type %s %v\n", name, obj.Name())
+
+			default:
+				log.Printf("OTHER TYPE::: %s %T\n", name, o.Type().(*types.Named).Underlying())
+				continue
+			}
+
+		default:
+			log.Printf("OTHER::: %s %T\n", name, o)
+			continue
+		}
+
+		if len(elt.Value) > 0 {
+			fl.Elements = append(fl.Elements, elt)
+		}
+	}
+
+	return files, nil
+}
+
+func (c Centrifuge) writeStruct(name string, obj *types.Struct, rootPkg string, elt *File) string {
+	b := strings.Builder{}
+	b.WriteString(fmt.Sprintf("type %s struct {\n", name))
+
+	for i := 0; i < obj.NumFields(); i++ {
+		field := obj.Field(i)
+
+		if !field.Exported() {
+			continue
+		}
+
+		fPkg := c.PackageCleaner(extractPackage(field.Type()))
+		if fPkg != "" && fPkg != rootPkg {
+			elt.Imports = append(elt.Imports, fPkg)
+		}
+
+		fType := c.TypeCleaner(field.Type(), rootPkg)
+
+		if field.Embedded() {
+			b.WriteString(fmt.Sprintf("\t%s\n", fType))
+			continue
+		}
+
+		values, ok := lookupTagValue(obj.Tag(i), "json")
+		if len(values) > 0 && values[0] == "-" {
+			continue
+		}
+
+		b.WriteString(fmt.Sprintf("\t%s %s", field.Name(), fType))
+
+		if ok {
+			b.WriteString(fmt.Sprintf(" `json:\"%s\"`", strings.Join(values, ",")))
+		}
+
+		b.WriteString("\n")
+	}
+
+	b.WriteString("}\n")
+
+	return b.String()
+}
+
+func lookupTagValue(raw, key string) ([]string, bool) {
+	value, ok := reflect.StructTag(raw).Lookup(key)
+	if !ok {
+		return nil, ok
+	}
+
+	values := strings.Split(value, ",")
+
+	if len(values) < 1 {
+		return nil, true
+	}
+
+	return values, true
+}
+
+func extractPackage(t types.Type) string {
+	switch tu := t.(type) {
+	case *types.Named:
+		return tu.Obj().Pkg().Path()
+
+	case *types.Slice:
+		if v, ok := tu.Elem().(*types.Named); ok {
+			return v.Obj().Pkg().Path()
+		}
+		return ""
+
+	case *types.Map:
+		if v, ok := tu.Elem().(*types.Named); ok {
+			return v.Obj().Pkg().Path()
+		}
+		return ""
+
+	case *types.Pointer:
+		return extractPackage(tu.Elem())
+
+	default:
+		return ""
+	}
+}
+
+func contains(values []string, value string) bool {
+	for _, val := range values {
+		if val == value {
+			return true
+		}
+	}
+
+	return false
+}
+
+type fileWriter struct {
+	baseDir string
+}
+
+func (f fileWriter) Write(files map[string]*File) error {
+	err := os.MkdirAll(f.baseDir, 0755)
+	if err != nil {
+		return err
+	}
+
+	for name, file := range files {
+		err = f.writeFile(name, file)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (f fileWriter) writeFile(name string, desc *File) error {
+	if len(desc.Elements) == 0 {
+		return nil
+	}
+
+	filename := filepath.Join(f.baseDir, name)
+
+	file, err := os.Create(filename)
+	if err != nil {
+		return fmt.Errorf("failed to create file: %w", err)
+	}
+
+	defer func() { _ = file.Close() }()
+
+	b := bytes.NewBufferString("package ")
+	b.WriteString(desc.Package)
+	b.WriteString("\n")
+	b.WriteString("// Code generated by centrifuge. DO NOT EDIT.\n")
+
+	b.WriteString("\n")
+	f.writeImports(b, desc.Imports)
+	b.WriteString("\n")
+
+	for _, elt := range desc.Elements {
+		b.WriteString(elt.Value)
+		b.WriteString("\n")
+	}
+
+	// gofmt
+	source, err := format.Source(b.Bytes())
+	if err != nil {
+		log.Println(b.String())
+		return fmt.Errorf("failed to format sources: %w", err)
+	}
+
+	// goimports
+	process, err := imports.Process(filename, source, nil)
+	if err != nil {
+		log.Println(string(source))
+		return fmt.Errorf("failed to format imports: %w", err)
+	}
+
+	_, err = file.Write(process)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (f fileWriter) writeImports(b io.StringWriter, imports []string) {
+	if len(imports) == 0 {
+		return
+	}
+
+	uniq := map[string]struct{}{}
+
+	sort.Strings(imports)
+
+	_, _ = b.WriteString("import (\n")
+	for _, s := range imports {
+		if _, exist := uniq[s]; exist {
+			continue
+		}
+
+		uniq[s] = struct{}{}
+
+		_, _ = b.WriteString(fmt.Sprintf(`	"%s"`+"\n", s))
+	}
+
+	_, _ = b.WriteString(")\n")
+}

cmd/internal/gen/main.go

@@ -0,0 +1,124 @@
+package main
+
+import (
+	"fmt"
+	"go/build"
+	"go/types"
+	"io/ioutil"
+	"log"
+	"path"
+	"path/filepath"
+	"strings"
+)
+
+const rootPkg = "github.com/traefik/traefik/v2/pkg/config/dynamic"
+
+const (
+	destModuleName = "github.com/traefik/genconf"
+	destPkg        = "dynamic"
+)
+
+const marsh = `package %s
+
+import "encoding/json"
+
+type JSONPayload struct {
+	*Configuration
+}
+
+func (c JSONPayload) MarshalJSON() ([]byte, error) {
+	if c.Configuration == nil {
+		return nil, nil
+	}
+
+	return json.Marshal(c.Configuration)
+}
+`
+
+// main generate Go Structures from Go structures.
+// Allows to create an external module (destModuleName) used by the plugin's providers
+// that contains Go structs of the dynamic configuration and nothing else.
+// These Go structs do not have any non-exported fields and do not rely on any external dependencies.
+func main() {
+	dest := filepath.Join(path.Join(build.Default.GOPATH, "src"), destModuleName, destPkg)
+
+	log.Println("Output:", dest)
+
+	err := run(dest)
+	if err != nil {
+		log.Fatal(err)
+	}
+}
+
+func run(dest string) error {
+	centrifuge, err := NewCentrifuge(rootPkg)
+	if err != nil {
+		return err
+	}
+
+	centrifuge.IncludedImports = []string{
+		"github.com/traefik/traefik/v2/pkg/tls",
+		"github.com/traefik/traefik/v2/pkg/types",
+	}
+
+	centrifuge.ExcludedTypes = []string{
+		// tls
+		"CertificateStore", "Manager",
+		// dynamic
+		"Message", "Configurations",
+		// types
+		"HTTPCodeRanges", "HostResolverConfig",
+	}
+
+	centrifuge.ExcludedFiles = []string{
+		"github.com/traefik/traefik/v2/pkg/types/logs.go",
+		"github.com/traefik/traefik/v2/pkg/types/metrics.go",
+	}
+
+	centrifuge.TypeCleaner = cleanType
+	centrifuge.PackageCleaner = cleanPackage
+
+	err = centrifuge.Run(dest, destPkg)
+	if err != nil {
+		return err
+	}
+
+	return ioutil.WriteFile(filepath.Join(dest, "marshaler.go"), []byte(fmt.Sprintf(marsh, destPkg)), 0666)
+}
+
+func cleanType(typ types.Type, base string) string {
+	if typ.String() == "github.com/traefik/traefik/v2/pkg/tls.FileOrContent" {
+		return "string"
+	}
+
+	if typ.String() == "[]github.com/traefik/traefik/v2/pkg/tls.FileOrContent" {
+		return "[]string"
+	}
+
+	if typ.String() == "github.com/traefik/paerser/types.Duration" {
+		return "string"
+	}
+
+	if strings.Contains(typ.String(), base) {
+		return strings.ReplaceAll(typ.String(), base+".", "")
+	}
+
+	if strings.Contains(typ.String(), "github.com/traefik/traefik/v2/pkg/") {
+		return strings.ReplaceAll(typ.String(), "github.com/traefik/traefik/v2/pkg/", "")
+	}
+
+	return typ.String()
+}
+
+func cleanPackage(src string) string {
+	switch src {
+	case "github.com/traefik/paerser/types":
+		return ""
+	case "github.com/traefik/traefik/v2/pkg/tls":
+		return path.Join(destModuleName, destPkg, "tls")
+	case "github.com/traefik/traefik/v2/pkg/types":
+		return path.Join(destModuleName, destPkg, "types")
+	default:
+		return src
+	}
+}

cmd/traefik/plugins.go

@@ -1,6 +1,8 @@
 package main
 
 import (
+	"fmt"
+
 	"github.com/traefik/traefik/v2/pkg/config/static"
 	"github.com/traefik/traefik/v2/pkg/plugins"
 )
@@ -8,35 +10,69 @@ import (
 const outputDir = "./plugins-storage/"
 
 func createPluginBuilder(staticConfiguration *static.Configuration) (*plugins.Builder, error) {
-	client, plgs, devPlugin, err := initPlugins(staticConfiguration)
+	client, plgs, localPlgs, err := initPlugins(staticConfiguration)
 	if err != nil {
 		return nil, err
 	}
 
-	return plugins.NewBuilder(client, plgs, devPlugin)
+	return plugins.NewBuilder(client, plgs, localPlgs)
 }
 
-func initPlugins(staticCfg *static.Configuration) (*plugins.Client, map[string]plugins.Descriptor, *plugins.DevPlugin, error) {
-	if !isPilotEnabled(staticCfg) || !hasPlugins(staticCfg) {
-		return nil, map[string]plugins.Descriptor{}, nil, nil
-	}
-
-	opts := plugins.ClientOptions{
-		Output: outputDir,
-		Token:  staticCfg.Pilot.Token,
-	}
-
-	client, err := plugins.NewClient(opts)
+func initPlugins(staticCfg *static.Configuration) (*plugins.Client, map[string]plugins.Descriptor, map[string]plugins.LocalDescriptor, error) {
+	err := checkUniquePluginNames(staticCfg.Experimental)
 	if err != nil {
 		return nil, nil, nil, err
 	}
 
-	err = plugins.Setup(client, staticCfg.Experimental.Plugins, staticCfg.Experimental.DevPlugin)
-	if err != nil {
-		return nil, nil, nil, err
+	var client *plugins.Client
+	plgs := map[string]plugins.Descriptor{}
+
+	if isPilotEnabled(staticCfg) && hasPlugins(staticCfg) {
+		opts := plugins.ClientOptions{
+			Output: outputDir,
+			Token:  staticCfg.Pilot.Token,
+		}
+
+		var err error
+		client, err = plugins.NewClient(opts)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+
+		err = plugins.SetupRemotePlugins(client, staticCfg.Experimental.Plugins)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+
+		plgs = staticCfg.Experimental.Plugins
 	}
 
-	return client, staticCfg.Experimental.Plugins, staticCfg.Experimental.DevPlugin, nil
+	localPlgs := map[string]plugins.LocalDescriptor{}
+
+	if hasLocalPlugins(staticCfg) {
+		err := plugins.SetupLocalPlugins(staticCfg.Experimental.LocalPlugins)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+
+		localPlgs = staticCfg.Experimental.LocalPlugins
+	}
+
+	return client, plgs, localPlgs, nil
+}
+
+func checkUniquePluginNames(e *static.Experimental) error {
+	if e == nil {
+		return nil
+	}
+
+	for s := range e.LocalPlugins {
+		if _, ok := e.Plugins[s]; ok {
+			return fmt.Errorf("the plugin's name %q must be unique", s)
+		}
+	}
+
+	return nil
 }
 
 func isPilotEnabled(staticCfg *static.Configuration) bool {
@@ -44,6 +80,9 @@ func isPilotEnabled(staticCfg *static.Configuration) bool {
 }
 
 func hasPlugins(staticCfg *static.Configuration) bool {
-	return staticCfg.Experimental != nil &&
-		(len(staticCfg.Experimental.Plugins) > 0 || staticCfg.Experimental.DevPlugin != nil)
+	return staticCfg.Experimental != nil && len(staticCfg.Experimental.Plugins) > 0
+}
+
+func hasLocalPlugins(staticCfg *static.Configuration) bool {
+	return staticCfg.Experimental != nil && len(staticCfg.Experimental.LocalPlugins) > 0
 }

cmd/traefik/traefik.go

@@ -2,7 +2,9 @@ package main
 
 import (
 	"context"
+	"crypto/x509"
 	"encoding/json"
+	"fmt"
 	stdlog "log"
 	"net/http"
 	"os"
@@ -16,6 +18,7 @@ import (
 	"github.com/coreos/go-systemd/daemon"
 	assetfs "github.com/elazarl/go-bindata-assetfs"
 	"github.com/go-acme/lego/v4/challenge"
+	gokitmetrics "github.com/go-kit/kit/metrics"
 	"github.com/sirupsen/logrus"
 	"github.com/traefik/paerser/cli"
 	"github.com/traefik/traefik/v2/autogen/genstatic"
@@ -123,12 +126,6 @@ func runCmd(staticConfiguration *static.Configuration) error {
 
 	ctx, _ := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 
-	if staticConfiguration.Experimental != nil && staticConfiguration.Experimental.DevPlugin != nil {
-		var cancel context.CancelFunc
-		ctx, cancel = context.WithTimeout(ctx, 30*time.Minute)
-		defer cancel()
-	}
-
 	if staticConfiguration.Ping != nil {
 		staticConfiguration.Ping.WithContext(ctx)
 	}
@@ -235,6 +232,20 @@ func setupServer(staticConfiguration *static.Configuration) (*server.Server, err
 		return nil, err
 	}
 
+	// Providers plugins
+
+	for name, conf := range staticConfiguration.Providers.Plugin {
+		p, err := pluginBuilder.BuildProvider(name, conf)
+		if err != nil {
+			return nil, fmt.Errorf("plugin: failed to build provider: %w", err)
+		}
+
+		err = providerAggregator.AddProvider(p)
+		if err != nil {
+			return nil, fmt.Errorf("plugin: failed to add provider: %w", err)
+		}
+	}
+
 	// Metrics
 
 	metricRegistries := registerMetricClients(staticConfiguration.Metrics)
@@ -253,7 +264,7 @@ func setupServer(staticConfiguration *static.Configuration) (*server.Server, err
 
 	accessLog := setupAccessLog(staticConfiguration.AccessLog)
 	chainBuilder := middleware.NewChainBuilder(*staticConfiguration, metricsRegistry, accessLog)
-	routerFactory := server.NewRouterFactory(*staticConfiguration, managerFactory, tlsManager, chainBuilder, pluginBuilder)
+	routerFactory := server.NewRouterFactory(*staticConfiguration, managerFactory, tlsManager, chainBuilder, pluginBuilder, metricsRegistry)
 
 	// Watcher
 
@@ -269,6 +280,11 @@ func setupServer(staticConfiguration *static.Configuration) (*server.Server, err
 	watcher.AddListener(func(conf dynamic.Configuration) {
 		ctx := context.Background()
 		tlsManager.UpdateConfigs(ctx, conf.TLS.Stores, conf.TLS.Options, conf.TLS.Certificates)
+
+		gauge := metricsRegistry.TLSCertsNotAfterTimestampGauge()
+		for _, certificate := range tlsManager.GetCertificates() {
+			appendCertMetric(gauge, certificate)
+		}
 	})
 
 	// Metrics
@@ -443,6 +459,20 @@ func registerMetricClients(metricsConfig *types.Metrics) []metrics.Registry {
 	return registries
 }
 
+func appendCertMetric(gauge gokitmetrics.Gauge, certificate *x509.Certificate) {
+	sort.Strings(certificate.DNSNames)
+
+	labels := []string{
+		"cn", certificate.Subject.CommonName,
+		"serial", certificate.SerialNumber.String(),
+		"sans", strings.Join(certificate.DNSNames, ","),
+	}
+
+	notAfter := float64(certificate.NotAfter.Unix())
+
+	gauge.With(labels...).Set(notAfter)
+}
+
 func setupAccessLog(conf *types.AccessLog) *accesslog.Handler {
 	if conf == nil {
 		return nil

cmd/traefik/traefik_test.go

@@ -0,0 +1,116 @@
+package main
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"strings"
+	"testing"
+
+	"github.com/go-kit/kit/metrics"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// FooCert is a PEM-encoded TLS cert.
+// generated from src/crypto/tls:
+// go run generate_cert.go  --rsa-bits 1024 --host foo.org,foo.com  --ca --start-date "Jan 1 00:00:00 1970" --duration=1000000h
+const fooCert = `-----BEGIN CERTIFICATE-----
+MIICHzCCAYigAwIBAgIQXQFLeYRwc5X21t457t2xADANBgkqhkiG9w0BAQsFADAS
+MRAwDgYDVQQKEwdBY21lIENvMCAXDTcwMDEwMTAwMDAwMFoYDzIwODQwMTI5MTYw
+MDAwWjASMRAwDgYDVQQKEwdBY21lIENvMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
+iQKBgQDCjn67GSs/khuGC4GNN+tVo1S+/eSHwr/hWzhfMqO7nYiXkFzmxi+u14CU
+Pda6WOeps7T2/oQEFMxKKg7zYOqkLSbjbE0ZfosopaTvEsZm/AZHAAvoOrAsIJOn
+SEiwy8h0tLA4z1SNR6rmIVQWyqBZEPAhBTQM1z7tFp48FakCFwIDAQABo3QwcjAO
+BgNVHQ8BAf8EBAMCAqQwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUw
+AwEB/zAdBgNVHQ4EFgQUDHG3ASzeUezElup9zbPpBn/vjogwGwYDVR0RBBQwEoIH
+Zm9vLm9yZ4IHZm9vLmNvbTANBgkqhkiG9w0BAQsFAAOBgQBT+VLMbB9u27tBX8Aw
+ZrGY3rbNdBGhXVTksrjiF+6ZtDpD3iI56GH9zLxnqvXkgn3u0+Ard5TqF/xmdwVw
+NY0V/aWYfcL2G2auBCQrPvM03ozRnVUwVfP23eUzX2ORNHCYhd2ObQx4krrhs7cJ
+SWxtKwFlstoXY3K2g9oRD9UxdQ==
+-----END CERTIFICATE-----`
+
+// BarCert is a PEM-encoded TLS cert.
+// generated from src/crypto/tls:
+// go run generate_cert.go  --rsa-bits 1024 --host bar.org,bar.com  --ca --start-date "Jan 1 00:00:00 1970" --duration=10000h
+const barCert = `-----BEGIN CERTIFICATE-----
+MIICHTCCAYagAwIBAgIQcuIcNEXzBHPoxna5S6wG4jANBgkqhkiG9w0BAQsFADAS
+MRAwDgYDVQQKEwdBY21lIENvMB4XDTcwMDEwMTAwMDAwMFoXDTcxMDIyMTE2MDAw
+MFowEjEQMA4GA1UEChMHQWNtZSBDbzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
+gYEAqtcrP+KA7D6NjyztGNIPMup9KiBMJ8QL+preog/YHR7SQLO3kGFhpS3WKMab
+SzMypC3ZX1PZjBP5ZzwaV3PFbuwlCkPlyxR2lOWmullgI7mjY0TBeYLDIclIzGRp
+mpSDDSpkW1ay2iJDSpXjlhmwZr84hrCU7BRTQJo91fdsRTsCAwEAAaN0MHIwDgYD
+VR0PAQH/BAQDAgKkMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMB
+Af8wHQYDVR0OBBYEFK8jnzFQvBAgWtfzOyXY4VSkwrTXMBsGA1UdEQQUMBKCB2Jh
+ci5vcmeCB2Jhci5jb20wDQYJKoZIhvcNAQELBQADgYEAJz0ifAExisC/ZSRhWuHz
+7qs1i6Nd4+YgEVR8dR71MChP+AMxucY1/ajVjb9xlLys3GPE90TWSdVppabEVjZY
+Oq11nPKc50ItTt8dMku6t0JHBmzoGdkN0V4zJCBqdQJxhop8JpYJ0S9CW0eT93h3
+ipYQSsmIINGtMXJ8VkP/MlM=
+-----END CERTIFICATE-----`
+
+type gaugeMock struct {
+	metrics map[string]float64
+	labels  string
+}
+
+func (g gaugeMock) With(labelValues ...string) metrics.Gauge {
+	g.labels = strings.Join(labelValues, ",")
+	return g
+}
+
+func (g gaugeMock) Set(value float64) {
+	g.metrics[g.labels] = value
+}
+
+func (g gaugeMock) Add(delta float64) {
+	panic("implement me")
+}
+
+func TestAppendCertMetric(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		certs    []string
+		expected map[string]float64
+	}{
+		{
+			desc:     "No certs",
+			certs:    []string{},
+			expected: map[string]float64{},
+		},
+		{
+			desc:  "One cert",
+			certs: []string{fooCert},
+			expected: map[string]float64{
+				"cn,,serial,123624926713171615935660664614975025408,sans,foo.com,foo.org": 3.6e+09,
+			},
+		},
+		{
+			desc:  "Two certs",
+			certs: []string{fooCert, barCert},
+			expected: map[string]float64{
+				"cn,,serial,123624926713171615935660664614975025408,sans,foo.com,foo.org": 3.6e+09,
+				"cn,,serial,152706022658490889223053211416725817058,sans,bar.com,bar.org": 3.6e+07,
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			gauge := &gaugeMock{
+				metrics: map[string]float64{},
+			}
+
+			for _, cert := range test.certs {
+				block, _ := pem.Decode([]byte(cert))
+				parsedCert, err := x509.ParseCertificate(block.Bytes)
+				require.NoError(t, err)
+
+				appendCertMetric(gauge, parsedCert)
+			}
+
+			assert.Equal(t, test.expected, gauge.metrics)
+		})
+	}
+}

docs/content/getting-started/install-traefik.md

@@ -16,7 +16,7 @@ Choose one of the [official Docker images](https://hub.docker.com/_/traefik) and
 
 ```bash
 docker run -d -p 8080:8080 -p 80:80 \
-    -v $PWD/traefik.yml:/etc/traefik/traefik.yml traefik:v2.4
+    -v $PWD/traefik.yml:/etc/traefik/traefik.yml traefik:v2.5
 ```
 
 For more details, go to the [Docker provider documentation](../providers/docker.md)

docs/content/getting-started/quick-start.md

@@ -15,7 +15,7 @@ version: '3'
 services:
   reverse-proxy:
     # The official v2 Traefik docker image
-    image: traefik:v2.4
+    image: traefik:v2.5
     # Enables the web UI and tells Traefik to listen to docker
     command: --api.insecure=true --providers.docker
     ports:

docs/content/https/tls.md

@@ -447,7 +447,7 @@ metadata:
 
 spec:
   clientAuth:
-    # the CA certificate is extracted from key `tls.ca` of the given secrets.
+    # the CA certificate is extracted from key `tls.ca` or `ca.crt` of the given secrets.
     secretNames:
       - secretCA
     clientAuthType: RequireAndVerifyClientCert

docs/content/middlewares/http/addprefix.md

@@ -3,7 +3,7 @@
 Prefixing the Path
 {: .subtitle }
 
-![AddPrefix](../assets/img/middleware/addprefix.png)
+![AddPrefix](../../assets/img/middleware/addprefix.png)
 
 The AddPrefix middleware updates the path of a request before forwarding it.
 

docs/content/middlewares/http/basicauth.md

@@ -3,7 +3,7 @@
 Adding Basic Authentication
 {: .subtitle }
 
-![BasicAuth](../assets/img/middleware/basicauth.png)
+![BasicAuth](../../assets/img/middleware/basicauth.png)
 
 The BasicAuth middleware restricts access to your services to known users.
 

docs/content/middlewares/http/buffering.md

@@ -3,7 +3,7 @@
 How to Read the Request before Forwarding It
 {: .subtitle }
 
-![Buffering](../assets/img/middleware/buffering.png)
+![Buffering](../../assets/img/middleware/buffering.png)
 
 The Buffering middleware limits the size of requests that can be forwarded to services.
 

docs/content/middlewares/http/chain.md

@@ -3,7 +3,7 @@
 When One Isn't Enough
 {: .subtitle }
 
-![Chain](../assets/img/middleware/chain.png)
+![Chain](../../assets/img/middleware/chain.png)
 
 The Chain middleware enables you to define reusable combinations of other pieces of middleware.
 It makes reusing the same groups easier.

docs/content/middlewares/http/circuitbreaker.md

@@ -3,7 +3,7 @@
 Don't Waste Time Calling Unhealthy Services
 {: .subtitle }
 
-![CircuitBreaker](../assets/img/middleware/circuitbreaker.png)
+![CircuitBreaker](../../assets/img/middleware/circuitbreaker.png)
 
 The circuit breaker protects your system from stacking requests to unhealthy services, resulting in cascading failures.
 

docs/content/middlewares/http/compress.md

@@ -3,7 +3,7 @@
 Compress Responses before Sending them to the Client
 {: .subtitle }
 
-![Compress](../assets/img/middleware/compress.png)
+![Compress](../../assets/img/middleware/compress.png)
 
 The Compress middleware uses gzip compression.
 

docs/content/middlewares/http/digestauth.md

@@ -3,7 +3,7 @@
 Adding Digest Authentication
 {: .subtitle }
 
-![BasicAuth](../assets/img/middleware/digestauth.png)
+![BasicAuth](../../assets/img/middleware/digestauth.png)
 
 The DigestAuth middleware restricts access to your services to known users.
 

docs/content/middlewares/http/errorpages.md

@@ -3,7 +3,7 @@
 It Has Never Been Easier to Say That Something Went Wrong
 {: .subtitle }
 
-![ErrorPages](../assets/img/middleware/errorpages.png)
+![ErrorPages](../../assets/img/middleware/errorpages.png)
 
 The ErrorPage middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.
 

docs/content/middlewares/http/forwardauth.md

@@ -3,7 +3,7 @@
 Using an External Service to Forward Authentication
 {: .subtitle }
 
-![AuthForward](../assets/img/middleware/authforward.png)
+![AuthForward](../../assets/img/middleware/authforward.png)
 
 The ForwardAuth middleware delegates authentication to an external service.
 If the service answers with a 2XX code, access is granted, and the original request is performed.
@@ -373,7 +373,8 @@ metadata:
   namespace: default
 
 data:
-  ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  # Must contain a certificate under either a `tls.ca` or a `ca.crt` key. 
+  tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
 ```
 
 ```yaml tab="Consul Catalog"

docs/content/middlewares/http/headers.md

@@ -3,7 +3,7 @@
 Managing Request/Response headers
 {: .subtitle }
 
-![Headers](../assets/img/middleware/headers.png)
+![Headers](../../assets/img/middleware/headers.png)
 
 The Headers middleware manages the headers of requests and responses.
 
@@ -141,13 +141,13 @@ http:
 
 ### Using Security Headers
 
-Security-related headers (HSTS headers, SSL redirection, Browser XSS filter, etc) can be managed similarly to custom headers as shown above.
+Security-related headers (HSTS headers, Browser XSS filter, etc) can be managed similarly to custom headers as shown above.
 This functionality makes it possible to easily use security features by adding headers.
 
 ```yaml tab="Docker"
 labels:
   - "traefik.http.middlewares.testHeader.headers.framedeny=true"
-  - "traefik.http.middlewares.testHeader.headers.sslredirect=true"
+  - "traefik.http.middlewares.testHeader.headers.browserxssfilter=true"
 ```
 
 ```yaml tab="Kubernetes"
@@ -158,25 +158,25 @@ metadata:
 spec:
   headers:
     frameDeny: true
-    sslRedirect: true
+    browserxssfilter: true
 ```
 
 ```yaml tab="Consul Catalog"
 - "traefik.http.middlewares.testheader.headers.framedeny=true"
-- "traefik.http.middlewares.testheader.headers.sslredirect=true"
+- "traefik.http.middlewares.testheader.headers.browserxssfilter=true"
 ```
 
 ```json tab="Marathon"
 "labels": {
   "traefik.http.middlewares.testheader.headers.framedeny": "true",
-  "traefik.http.middlewares.testheader.headers.sslredirect": "true"
+  "traefik.http.middlewares.testheader.headers.browserxssfilter": "true"
 }
 ```
 
 ```yaml tab="Rancher"
 labels:
   - "traefik.http.middlewares.testheader.headers.framedeny=true"
-  - "traefik.http.middlewares.testheader.headers.sslredirect=true"
+  - "traefik.http.middlewares.testheader.headers.browserxssfilter=true"
 ```
 
 ```yaml tab="File (YAML)"
@@ -185,14 +185,14 @@ http:
     testHeader:
       headers:
         frameDeny: true
-        sslRedirect: true
+        browserxssfilter: true
 ```
 
 ```toml tab="File (TOML)"
 [http.middlewares]
   [http.middlewares.testHeader.headers]
     frameDeny = true
-    sslRedirect = true
+    browserxssfilter = true
 ```
 
 ### CORS Headers
@@ -355,14 +355,26 @@ The `hostsProxyHeaders` option is a set of header keys that may hold a proxied h
 
 ### `sslRedirect`
 
+!!! warning
+
+    Deprecated in favor of [EntryPoint redirection](../../routing/entrypoints.md#redirection) or the [RedirectScheme middleware](./redirectscheme.md).
+
 The `sslRedirect` only allow HTTPS requests when set to `true`.
 
 ### `sslTemporaryRedirect`
 
+!!! warning
+
+    Deprecated in favor of [EntryPoint redirection](../../routing/entrypoints.md#redirection) or the [RedirectScheme middleware](./redirectscheme.md).
+
 Set `sslTemporaryRedirect` to `true` to force an SSL redirection using a 302 (instead of a 301).
 
 ### `sslHost`
 
+!!! warning
+
+    Deprecated in favor of the [RedirectRegex middleware](./redirectregex.md).
+
 The `sslHost` option is the host name that is used to redirect HTTP requests to HTTPS.
 
 ### `sslProxyHeaders`
@@ -372,6 +384,10 @@ It can be useful when using other proxies (example: `"X-Forwarded-Proto": "https
 
 ### `sslForceHost`
 
+!!! warning
+
+    Deprecated in favor of the [RedirectRegex middleware](./redirectregex.md).
+
 Set `sslForceHost` to `true` and set `sslHost` to force requests to use `SSLHost` regardless of whether they already use SSL.
 
 ### `stsSeconds`
@@ -427,8 +443,16 @@ The `referrerPolicy` allows sites to control whether browsers forward the `Refer
 
 ### `featurePolicy`
 
+!!! warning
+
+    Deprecated in favor of `permissionsPolicy`
+
 The `featurePolicy` allows sites to control browser features.
 
+### `permissionsPolicy`
+
+The `permissionsPolicy` allows sites to control browser features.
+
 ### `isDevelopment`
 
 Set `isDevelopment` to `true` when developing to mitigate the unwanted effects of the `AllowedHosts`, SSL, and STS options.

docs/content/middlewares/http/inflightreq.md

@@ -3,7 +3,7 @@
 Limiting the Number of Simultaneous In-Flight Requests
 {: .subtitle }
 
-![InFlightReq](../assets/img/middleware/inflightreq.png)
+![InFlightReq](../../assets/img/middleware/inflightreq.png)
 
 To proactively prevent services from being overwhelmed with high load, the number of allowed simultaneous in-flight requests can be limited.
 

docs/content/middlewares/http/ipwhitelist.md

@@ -3,7 +3,7 @@
 Limiting Clients to Specific IPs
 {: .subtitle }
 
-![IpWhiteList](../assets/img/middleware/ipwhitelist.png)
+![IpWhiteList](../../assets/img/middleware/ipwhitelist.png)
 
 IPWhitelist accepts / refuses requests based on the client IP.
 

docs/content/middlewares/http/overview.md

@@ -0,0 +1,149 @@
+# HTTP Middlewares
+
+Controlling connections
+{: .subtitle }
+
+![Overview](../../assets/img/middleware/overview.png)
+
+## Configuration Example
+
+```yaml tab="Docker"
+# As a Docker Label
+whoami:
+  #  A container that exposes an API to show its IP address
+  image: traefik/whoami
+  labels:
+    # Create a middleware named `foo-add-prefix`
+    - "traefik.http.middlewares.foo-add-prefix.addprefix.prefix=/foo"
+    # Apply the middleware named `foo-add-prefix` to the router named `router1`
+    - "traefik.http.routers.router1.middlewares=foo-add-prefix@docker"
+```
+
+```yaml tab="Kubernetes IngressRoute"
+# As a Kubernetes Traefik IngressRoute
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: middlewares.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: Middleware
+    plural: middlewares
+    singular: middleware
+  scope: Namespaced
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: stripprefix
+spec:
+  stripPrefix:
+    prefixes:
+      - /stripit
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ingressroute
+spec:
+# more fields...
+  routes:
+    # more fields...
+    middlewares:
+      - name: stripprefix
+```
+
+```yaml tab="Consul Catalog"
+# Create a middleware named `foo-add-prefix`
+- "traefik.http.middlewares.foo-add-prefix.addprefix.prefix=/foo"
+# Apply the middleware named `foo-add-prefix` to the router named `router1`
+- "traefik.http.routers.router1.middlewares=foo-add-prefix@consulcatalog"
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.foo-add-prefix.addprefix.prefix": "/foo",
+  "traefik.http.routers.router1.middlewares": "foo-add-prefix@marathon"
+}
+```
+
+```yaml tab="Rancher"
+# As a Rancher Label
+labels:
+  # Create a middleware named `foo-add-prefix`
+  - "traefik.http.middlewares.foo-add-prefix.addprefix.prefix=/foo"
+  # Apply the middleware named `foo-add-prefix` to the router named `router1`
+  - "traefik.http.routers.router1.middlewares=foo-add-prefix@rancher"
+```
+
+```toml tab="File (TOML)"
+# As TOML Configuration File
+[http.routers]
+  [http.routers.router1]
+    service = "myService"
+    middlewares = ["foo-add-prefix"]
+    rule = "Host(`example.com`)"
+
+[http.middlewares]
+  [http.middlewares.foo-add-prefix.addPrefix]
+    prefix = "/foo"
+
+[http.services]
+  [http.services.service1]
+    [http.services.service1.loadBalancer]
+
+      [[http.services.service1.loadBalancer.servers]]
+        url = "http://127.0.0.1:80"
+```
+
+```yaml tab="File (YAML)"
+# As YAML Configuration File
+http:
+  routers:
+    router1:
+      service: myService
+      middlewares:
+        - "foo-add-prefix"
+      rule: "Host(`example.com`)"
+
+  middlewares:
+    foo-add-prefix:
+      addPrefix:
+        prefix: "/foo"
+
+  services:
+    service1:
+      loadBalancer:
+        servers:
+          - url: "http://127.0.0.1:80"
+```
+
+## Available HTTP Middlewares
+
+| Middleware                                | Purpose                                           | Area                        |
+|-------------------------------------------|---------------------------------------------------|-----------------------------|
+| [AddPrefix](addprefix.md)                 | Add a Path Prefix                                 | Path Modifier               |
+| [BasicAuth](basicauth.md)                 | Basic auth mechanism                              | Security, Authentication    |
+| [Buffering](buffering.md)                 | Buffers the request/response                      | Request Lifecycle           |
+| [Chain](chain.md)                         | Combine multiple pieces of middleware             | Middleware tool             |
+| [CircuitBreaker](circuitbreaker.md)       | Stop calling unhealthy services                   | Request Lifecycle           |
+| [Compress](compress.md)                   | Compress the response                             | Content Modifier            |
+| [DigestAuth](digestauth.md)               | Adds Digest Authentication                        | Security, Authentication    |
+| [Errors](errorpages.md)                   | Define custom error pages                         | Request Lifecycle           |
+| [ForwardAuth](forwardauth.md)             | Authentication delegation                         | Security, Authentication    |
+| [Headers](headers.md)                     | Add / Update headers                              | Security                    |
+| [IPWhiteList](ipwhitelist.md)             | Limit the allowed client IPs                      | Security, Request lifecycle |
+| [InFlightReq](inflightreq.md)             | Limit the number of simultaneous connections      | Security, Request lifecycle |
+| [PassTLSClientCert](passtlsclientcert.md) | Adding Client Certificates in a Header            | Security                    |
+| [RateLimit](ratelimit.md)                 | Limit the call frequency                          | Security, Request lifecycle |
+| [RedirectScheme](redirectscheme.md)       | Redirect easily the client elsewhere              | Request lifecycle           |
+| [RedirectRegex](redirectregex.md)         | Redirect the client elsewhere                     | Request lifecycle           |
+| [ReplacePath](replacepath.md)             | Change the path of the request                    | Path Modifier               |
+| [ReplacePathRegex](replacepathregex.md)   | Change the path of the request                    | Path Modifier               |
+| [Retry](retry.md)                         | Automatically retry the request in case of errors | Request lifecycle           |
+| [StripPrefix](stripprefix.md)             | Change the path of the request                    | Path Modifier               |
+| [StripPrefixRegex](stripprefixregex.md)   | Change the path of the request                    | Path Modifier               |

docs/content/middlewares/http/passtlsclientcert.md

@@ -248,7 +248,7 @@ PassTLSClientCert can add two headers to the request:
 !!! info
 
     * The headers are filled with escaped string so it can be safely placed inside a URL query.
-    * These options only work accordingly to the [MutualTLS configuration](../https/tls.md#client-authentication-mtls).
+    * These options only work accordingly to the [MutualTLS configuration](../../https/tls.md#client-authentication-mtls).
     That is to say, only the certificates that match the `clientAuth.clientAuthType` policy are passed.
 
 The following example shows a complete certificate and explains each of the middleware options.

docs/content/middlewares/overview.md

@@ -9,7 +9,7 @@ Attached to the routers, pieces of middleware are a means of tweaking the reques
 
 There are several available middleware in Traefik, some can modify the request, the headers, some are in charge of redirections, some add authentication, and so on.
 
-Pieces of middleware can be combined in chains to fit every scenario.
+Middlewares that use the same protocol can be combined into chains to fit every scenario.
 
 !!! warning "Provider Namespace"
 
@@ -31,20 +31,6 @@ whoami:
 ```
 
 ```yaml tab="Kubernetes IngressRoute"
-# As a Kubernetes Traefik IngressRoute
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: middlewares.traefik.containo.us
-spec:
-  group: traefik.containo.us
-  version: v1alpha1
-  names:
-    kind: Middleware
-    plural: middlewares
-    singular: middleware
-  scope: Namespaced
-
 ---
 apiVersion: traefik.containo.us/v1alpha1
 kind: Middleware
@@ -135,26 +121,6 @@ http:
 
 ## Available Middlewares
 
-| Middleware                                | Purpose                                           | Area                        |
-|-------------------------------------------|---------------------------------------------------|-----------------------------|
-| [AddPrefix](addprefix.md)                 | Add a Path Prefix                                 | Path Modifier               |
-| [BasicAuth](basicauth.md)                 | Basic auth mechanism                              | Security, Authentication    |
-| [Buffering](buffering.md)                 | Buffers the request/response                      | Request Lifecycle           |
-| [Chain](chain.md)                         | Combine multiple pieces of middleware             | Middleware tool             |
-| [CircuitBreaker](circuitbreaker.md)       | Stop calling unhealthy services                   | Request Lifecycle           |
-| [Compress](compress.md)                   | Compress the response                             | Content Modifier            |
-| [DigestAuth](digestauth.md)               | Adds Digest Authentication                        | Security, Authentication    |
-| [Errors](errorpages.md)                   | Define custom error pages                         | Request Lifecycle           |
-| [ForwardAuth](forwardauth.md)             | Authentication delegation                         | Security, Authentication    |
-| [Headers](headers.md)                     | Add / Update headers                              | Security                    |
-| [IPWhiteList](ipwhitelist.md)             | Limit the allowed client IPs                      | Security, Request lifecycle |
-| [InFlightReq](inflightreq.md)             | Limit the number of simultaneous connections      | Security, Request lifecycle |
-| [PassTLSClientCert](passtlsclientcert.md) | Adding Client Certificates in a Header            | Security                    |
-| [RateLimit](ratelimit.md)                 | Limit the call frequency                          | Security, Request lifecycle |
-| [RedirectScheme](redirectscheme.md)       | Redirect easily the client elsewhere              | Request lifecycle           |
-| [RedirectRegex](redirectregex.md)         | Redirect the client elsewhere                     | Request lifecycle           |
-| [ReplacePath](replacepath.md)             | Change the path of the request                    | Path Modifier               |
-| [ReplacePathRegex](replacepathregex.md)   | Change the path of the request                    | Path Modifier               |
-| [Retry](retry.md)                         | Automatically retry the request in case of errors | Request lifecycle           |
-| [StripPrefix](stripprefix.md)             | Change the path of the request                    | Path Modifier               |
-| [StripPrefixRegex](stripprefixregex.md)   | Change the path of the request                    | Path Modifier               |
+A list of HTTP middlewares can be found [here](http/overview.md).
+
+A list of TCP middlewares can be found [here](tcp/overview.md).

docs/content/middlewares/tcp/ipwhitelist.md

@@ -0,0 +1,67 @@
+# IPWhiteList
+
+Limiting Clients to Specific IPs
+{: .subtitle }
+
+IPWhitelist accepts / refuses connections based on the client IP.
+
+## Configuration Examples
+
+```yaml tab="Docker"
+# Accepts connections from defined IP
+labels:
+  - "traefik.tcp.middlewares.test-ipwhitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: MiddlewareTCP
+metadata:
+  name: test-ipwhitelist
+spec:
+  ipWhiteList:
+    sourceRange:
+      - 127.0.0.1/32
+      - 192.168.1.7
+```
+
+```yaml tab="Consul Catalog"
+# Accepts request from defined IP
+- "traefik.tcp.middlewares.test-ipwhitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.tcp.middlewares.test-ipwhitelist.ipwhitelist.sourcerange": "127.0.0.1/32,192.168.1.7"
+}
+```
+
+```yaml tab="Rancher"
+# Accepts request from defined IP
+labels:
+  - "traefik.tcp.middlewares.test-ipwhitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
+```
+
+```toml tab="File (TOML)"
+# Accepts request from defined IP
+[tcp.middlewares]
+  [tcp.middlewares.test-ipwhitelist.ipWhiteList]
+    sourceRange = ["127.0.0.1/32", "192.168.1.7"]
+```
+
+```yaml tab="File (YAML)"
+# Accepts request from defined IP
+http:
+  middlewares:
+    test-ipwhitelist:
+      ipWhiteList:
+        sourceRange:
+          - "127.0.0.1/32"
+          - "192.168.1.7"
+```
+
+## Configuration Options
+
+### `sourceRange`
+
+The `sourceRange` option sets the allowed IPs (or ranges of allowed IPs by using CIDR notation).

docs/content/middlewares/tcp/overview.md

@@ -0,0 +1,134 @@
+# TCP Middlewares
+
+Controlling connections
+{: .subtitle }
+
+![Overview](../../assets/img/middleware/overview.png)
+
+## Configuration Example
+
+```yaml tab="Docker"
+# As a Docker Label
+whoami:
+  #  A container that exposes an API to show its IP address
+  image: traefik/whoami
+  labels:
+    # Create a middleware named `foo-ip-whitelist`
+    - "traefik.tcp.middlewares.foo-ip-whitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
+    # Apply the middleware named `foo-ip-whitelist` to the router named `router1`
+    - "traefik.tcp.routers.router1.middlewares=foo-ip-whitelist@docker"
+```
+
+```yaml tab="Kubernetes IngressRoute"
+# As a Kubernetes Traefik IngressRoute
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: middlewaretcps.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: MiddlewareTCP
+    plural: middlewaretcps
+    singular: middlewaretcp
+  scope: Namespaced
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: foo-ip-whitelist
+spec:
+  ipWhiteList:
+    sourcerange:
+      - 127.0.0.1/32
+      - 192.168.1.7
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ingressroute
+spec:
+# more fields...
+  routes:
+    # more fields...
+    middlewares:
+      - name: foo-ip-whitelist
+```
+
+```yaml tab="Consul Catalog"
+# Create a middleware named `foo-ip-whitelist`
+- "traefik.tcp.middlewares.foo-ip-whitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
+# Apply the middleware named `foo-ip-whitelist` to the router named `router1`
+- "traefik.tcp.routers.router1.middlewares=foo-ip-whitelist@consulcatalog"
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.tcp.middlewares.foo-ip-whitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7",
+  "traefik.tcp.routers.router1.middlewares=foo-ip-whitelist@marathon"
+}
+```
+
+```yaml tab="Rancher"
+# As a Rancher Label
+labels:
+  # Create a middleware named `foo-ip-whitelist`
+  - "traefik.tcp.middlewares.foo-ip-whitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
+  # Apply the middleware named `foo-ip-whitelist` to the router named `router1`
+  - "traefik.tcp.routers.router1.middlewares=foo-ip-whitelist@rancher"
+```
+
+```toml tab="File (TOML)"
+# As TOML Configuration File
+[tcp.routers]
+  [tcp.routers.router1]
+    service = "myService"
+    middlewares = ["foo-ip-whitelist"]
+    rule = "Host(`example.com`)"
+
+[tcp.middlewares]
+  [tcp.middlewares.foo-ip-whitelist.ipWhiteList]
+    sourceRange = ["127.0.0.1/32", "192.168.1.7"]
+
+[tcp.services]
+  [tcp.services.service1]
+    [tcp.services.service1.loadBalancer]
+    [[tcp.services.service1.loadBalancer.servers]]
+      address = "10.0.0.10:4000"
+    [[tcp.services.service1.loadBalancer.servers]]
+      address = "10.0.0.11:4000"
+```
+
+```yaml tab="File (YAML)"
+# As YAML Configuration File
+tcp:
+  routers:
+    router1:
+      service: myService
+      middlewares:
+        - "foo-ip-whitelist"
+      rule: "Host(`example.com`)"
+
+  middlewares:
+    foo-ip-whitelist:
+      ipWhiteList:
+        sourceRange:
+          - "127.0.0.1/32"
+          - "192.168.1.7"
+
+  services:
+    service1:
+      loadBalancer:
+        servers:
+        - address: "10.0.0.10:4000"
+        - address: "10.0.0.11:4000"
+```
+
+## Available TCP Middlewares
+
+| Middleware                                | Purpose                                           | Area                        |
+|-------------------------------------------|---------------------------------------------------|-----------------------------|
+| [IPWhiteList](ipwhitelist.md)             | Limit the allowed client IPs                      | Security, Request lifecycle |

docs/content/migration/v1-to-v2.md

@@ -327,7 +327,7 @@ With Traefik v2 it is applied on an entry point or a [Router](../routing/routers
 To apply a redirection:
 
 - on an entry point, the [HTTP redirection](../routing/entrypoints.md#redirection) has to be configured.
-- on a router, one of the redirect middlewares, [RedirectRegex](../middlewares/redirectregex.md) or [RedirectScheme](../middlewares/redirectscheme.md), has to be configured and added to the router middlewares list.
+- on a router, one of the redirect middlewares, [RedirectRegex](../middlewares/http/redirectregex.md) or [RedirectScheme](../middlewares/http/redirectscheme.md), has to be configured and added to the router middlewares list.
 
 !!! example "Global HTTP to HTTPS redirection"
 
@@ -545,7 +545,7 @@ Use Case: Incoming requests to `http://example.org/admin` are forwarded to the w
 with the path `/admin` stripped, e.g. to `http://<IP>:<port>/`. In this case, you must:
 
 - First, configure a router named `admin` with a rule matching at least the path prefix with the `PathPrefix` keyword,
-- Then, define a middleware of type [`stripprefix`](../middlewares/stripprefix.md), which removes the prefix `/admin`, associated to the router `admin`.
+- Then, define a middleware of type [`stripprefix`](../middlewares/http/stripprefix.md), which removes the prefix `/admin`, associated to the router `admin`.
 
 !!! example "Strip Path Prefix When Forwarding to Backend"
 
@@ -660,12 +660,12 @@ with the path `/admin` stripped, e.g. to `http://<IP>:<port>/`. In this case, yo
 
 ??? question "What About Other Path Transformations?"
 
-    Instead of removing the path prefix with the [`stripprefix` middleware](../../middlewares/stripprefix/), you can also:
+    Instead of removing the path prefix with the [`stripprefix` middleware](../../middlewares/http/stripprefix/), you can also:
 
-    - Add a path prefix with the [`addprefix` middleware](../../middlewares/addprefix/)
-    - Replace the complete path of the request with the [`replacepath` middleware](../../middlewares/replacepath/)
-    - ReplaceRewrite path using Regexp with the [`replacepathregex` middleware](../../middlewares/replacepathregex/)
-    - And a lot more on the [`middlewares` page](../../middlewares/overview/)
+    - Add a path prefix with the [`addprefix` middleware](../../middlewares/http/addprefix/)
+    - Replace the complete path of the request with the [`replacepath` middleware](../../middlewares/http/replacepath/)
+    - ReplaceRewrite path using Regexp with the [`replacepathregex` middleware](../../middlewares/http/replacepathregex/)
+    - And a lot more on the [`HTTP middlewares` page](../../middlewares/http/overview/)
 
 ## ACME (LetsEncrypt)
 

docs/content/migration/v2.md

@@ -375,3 +375,37 @@ In `v2.4.10`, the default value for `allowCrossNamespace` has been changed to `f
 
 In `v2.4.10`, by default, it is no longer authorized to reference Kubernetes ExternalName services.
 To allow it, the `allowExternalNameServices` option should be set to `true`.
+
+## v2.4 to v2.5
+
+### Kubernetes CRD
+
+In `v2.5`, the [Traefik CRDs](../reference/dynamic-configuration/kubernetes-crd.md#definitions) have been updated to support the new API version `apiextensions.k8s.io/v1`. 
+As required by `apiextensions.k8s.io/v1`, we have included the OpenAPI validation schema. 
+
+After deploying the new [Traefik CRDs](../reference/dynamic-configuration/kubernetes-crd.md#definitions), the resources will be validated only on creation or update.
+
+Please note that the unknown fields will not be pruned when migrating from `apiextensions.k8s.io/v1beta1` to `apiextensions.k8s.io/v1` CRDs.
+For more details check out the official [documentation](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#specifying-a-structural-schema).
+
+### Kubernetes Ingress
+
+Traefik v2.5 moves forward for the Ingress provider to support Kubernetes v1.22.
+
+Traefik now supports only v1.14+ Kubernetes clusters, which means the support of `extensions/v1beta1` API Version ingresses has been dropped.
+
+The `extensions/v1beta1` API Version should now be replaced either by `networking.k8s.io/v1beta1` or by `networking.k8s.io/v1` (as of Kubernetes v1.19+).
+
+The support of the `networking.k8s.io/v1beta1` API Version will stop in Kubernetes v1.22.
+
+### Headers middleware: ssl redirect options
+
+`sslRedirect`, `sslTemporaryRedirect`, `sslHost` and `sslForceHost` are deprecated in Traefik v2.5.
+
+For simple HTTP to HTTPS redirection, you may use [EntryPoints redirections](../routing/entrypoints.md#redirection).
+
+For more advanced use cases, you can use either the [RedirectScheme middleware](../middlewares/http/redirectscheme.md) or the [RedirectRegex middleware](../middlewares/http/redirectregex.md).
+
+### Headers middleware: accessControlAllowOrigin
+
+`accessControlAllowOrigin` is no longer supported in Traefik v2.5.

docs/content/observability/access-logs.md

@@ -209,7 +209,7 @@ accessLog:
     | `RequestScheme`         | The HTTP scheme requested `http` or `https`.                                                                                                                        |
     | `RequestLine`           | `RequestMethod` + `RequestPath` + `RequestProtocol`                                                                                                                 |
     | `RequestContentSize`    | The number of bytes in the request entity (a.k.a. body) sent by the client.                                                                                         |
-    | `OriginDuration`        | The time taken (in nanoseconds) by the origin server ('upstream') to return its response.                                                                                            |
+    | `OriginDuration`        | The time taken (in nanoseconds) by the origin server ('upstream') to return its response.                                                                           |
     | `OriginContentSize`     | The content length specified by the origin server, or 0 if unspecified.                                                                                             |
     | `OriginStatus`          | The HTTP status code returned by the origin server. If the request was handled by this Traefik instance (e.g. with a redirect), then this value will be absent.     |
     | `OriginStatusLine`      | `OriginStatus` + Status code explanation                                                                                                                            |
@@ -218,8 +218,10 @@ accessLog:
     | `DownstreamContentSize` | The number of bytes in the response entity returned to the client. This is in addition to the "Content-Length" header, which may be present in the origin response. |
     | `RequestCount`          | The number of requests received since the Traefik instance started.                                                                                                 |
     | `GzipRatio`             | The response body compression ratio achieved.                                                                                                                       |
-    | `Overhead`              | The processing time overhead (in nanoseconds) caused by Traefik.                                                                                                                     |
+    | `Overhead`              | The processing time overhead (in nanoseconds) caused by Traefik.                                                                                                    |
     | `RetryAttempts`         | The amount of attempts the request was retried.                                                                                                                     |
+    | `TLSVersion`            | The TLS version used by the connection (e.g. `1.2`) (if connection is TLS).                                                                                         |
+    | `TLSCipher`             | The TLS cipher used by the connection (e.g. `TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA`) (if connection is TLS)                                                           |
 
 ## Log Rotation
 

docs/content/observability/metrics/datadog.md

@@ -59,6 +59,27 @@ metrics:
 ```bash tab="CLI"
 --metrics.datadog.addEntryPointsLabels=true
 ```
+#### `AddRoutersLabels`
+
+_Optional, Default=false_
+
+Enable metrics on routers.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.datadog]
+    addRoutersLabels = true
+```
+
+```yaml tab="File (YAML)"
+metrics:
+  datadog:
+    addRoutersLabels: true
+```
+
+```bash tab="CLI"
+--metrics.datadog.addrouterslabels=true
+```
 
 #### `addServicesLabels`
 

docs/content/observability/metrics/influxdb.md

@@ -170,6 +170,28 @@ metrics:
 --metrics.influxdb.addEntryPointsLabels=true
 ```
 
+#### `AddRoutersLabels`
+
+_Optional, Default=false_
+
+Enable metrics on routers.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.influxDB]
+    addRoutersLabels = true
+```
+
+```yaml tab="File (YAML)"
+metrics:
+  influxDB:
+    addRoutersLabels: true
+```
+
+```bash tab="CLI"
+--metrics.influxdb.addrouterslabels=true
+```
+
 #### `addServicesLabels`
 
 _Optional, Default=true_

docs/content/observability/metrics/prometheus.md

@@ -64,6 +64,28 @@ metrics:
 --metrics.prometheus.addEntryPointsLabels=true
 ```
 
+#### `AddRoutersLabels`
+
+_Optional, Default=false_
+
+Enable metrics on routers.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.prometheus]
+    addRoutersLabels = true
+```
+
+```yaml tab="File (YAML)"
+metrics:
+  prometheus:
+    addRoutersLabels: true
+```
+
+```bash tab="CLI"
+--metrics.prometheus.addrouterslabels=true
+```
+
 #### `addServicesLabels`
 
 _Optional, Default=true_

docs/content/observability/metrics/statsd.md

@@ -60,6 +60,28 @@ metrics:
 --metrics.statsd.addEntryPointsLabels=true
 ```
 
+#### `AddRoutersLabels`
+
+_Optional, Default=false_
+
+Enable metrics on entry points.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.statsD]
+    addRoutersLabels = true
+```
+
+```yaml tab="File (YAML)"
+metrics:
+  statsD:
+    addRoutersLabels: true
+```
+
+```bash tab="CLI"
+--metrics.statsd.addrouterslabels=true
+```
+
 #### `addServicesLabels`
 
 _Optional, Default=true_

docs/content/observability/tracing/jaeger.md

@@ -20,6 +20,9 @@ tracing:
     Traefik is able to send data over the compact thrift protocol to the [Jaeger agent](https://www.jaegertracing.io/docs/deployment/#agent)
     or a [Jaeger collector](https://www.jaegertracing.io/docs/deployment/#collectors).
 
+!!! info
+    All Jaeger configuration can be overridden by [environment variables](https://github.com/jaegertracing/jaeger-client-go#environment-variables)
+
 #### `samplingServerURL`
 
 _Required, Default="http://localhost:5778/sampling"_

docs/content/operations/dashboard.md

@@ -66,8 +66,8 @@ with a router attached to the service `api@internal` in the
 to allow defining:
 
 - One or more security features through [middlewares](../middlewares/overview.md)
-  like authentication ([basicAuth](../middlewares/basicauth.md) , [digestAuth](../middlewares/digestauth.md),
-  [forwardAuth](../middlewares/forwardauth.md)) or [whitelisting](../middlewares/ipwhitelist.md).
+  like authentication ([basicAuth](../middlewares/http/basicauth.md) , [digestAuth](../middlewares/http/digestauth.md),
+  [forwardAuth](../middlewares/http/forwardauth.md)) or [whitelisting](../middlewares/http/ipwhitelist.md).
 
 - A [router rule](#dashboard-router-rule) for accessing the dashboard,
   through Traefik itself (sometimes referred as "Traefik-ception").

docs/content/providers/consul-catalog.md

@@ -556,6 +556,81 @@ providers:
 # ...
 ```
 
+### `connectAware`
+
+_Optional, Default=false_
+
+Enable Consul Connect support.
+If set to `true`, Traefik will be enabled to communicate with Connect services.
+
+```toml tab="File (TOML)"
+[providers.consulCatalog]
+  connectAware = true
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  consulCatalog:
+    connectAware: true
+    # ...
+```
+
+```bash tab="CLI"
+--providers.consulcatalog.connectAware=true
+# ...
+```
+
+### `connectByDefault`
+
+_Optional, Default=false_
+
+Consider every service as Connect capable by default.
+If set to `true`, Traefik will consider every Consul Catalog service to be Connect capable by default.
+The option can be overridden on an instance basis with the `traefik.consulcatalog.connect` tag.
+
+```toml tab="File (TOML)"
+[providers.consulCatalog]
+  connectByDefault = true
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  consulCatalog:
+    connectByDefault: true
+    # ...
+```
+
+```bash tab="CLI"
+--providers.consulcatalog.connectByDefault=true
+# ...
+```
+
+### `serviceName`
+
+_Optional, Default="traefik"_
+
+Name of the Traefik service in Consul Catalog.
+
+```toml tab="File (TOML)"
+[providers.consulCatalog]
+  serviceName = "test"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  consulCatalog:
+    serviceName: test
+    # ...
+```
+
+```bash tab="CLI"
+--providers.consulcatalog.serviceName=test
+# ...
+```
+
 ### `constraints`
 
 _Optional, Default=""_

docs/content/providers/docker.md

@@ -252,7 +252,7 @@ See the sections [Docker API Access](#docker-api-access) and [Docker Swarm API A
 
     services:
       traefik:
-         image: traefik:v2.4 # The official v2 Traefik docker image
+         image: traefik:v2.5 # The official v2 Traefik docker image
          ports:
            - "80:80"
          volumes:

docs/content/providers/kubernetes-crd.md

@@ -20,11 +20,17 @@ the Traefik engineering team developed a [Custom Resource Definition](https://ku
         * Apply the needed kubernetesCRD provider [configuration](#provider-configuration)
     * Add all necessary Traefik custom [resources](../reference/dynamic-configuration/kubernetes-crd.md#resources)
 
+!!! warning "Deprecated apiextensions.k8s.io/v1beta1 CRD"
+
+    The `apiextensions.k8s.io/v1beta1` CustomResourceDefinition is deprecated in Kubernetes `v1.16+` and will be removed in `v1.22+`.
+    
+    For Kubernetes `v1.16+`, please use the Traefik `apiextensions.k8s.io/v1` CRDs instead.
+
 ??? example "Initializing Resource Definition and RBAC"
 
     ```yaml tab="Traefik Resource Definition"
     # All resources definition must be declared
-    --8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition.yml"
+    --8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml"
     ```
 
     ```yaml tab="RBAC for Traefik CRD"

docs/content/providers/kubernetes-gateway.md

@@ -9,7 +9,7 @@ The Gateway API project is part of Kubernetes, working under SIG-NETWORK.
 The Kubernetes Gateway provider is a Traefik implementation of the [Gateway API](https://gateway-api.sigs.k8s.io/)
 specifications from the Kubernetes Special Interest Groups (SIGs).
 
-This provider is proposed as an experimental feature and partially supports the Gateway API [v0.2.0](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v0.2.0) specification.
+This provider is proposed as an experimental feature and partially supports the Gateway API [v0.3.0](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v0.3.0) specification.
 
 !!! warning "Enabling The Experimental Kubernetes Gateway Provider"
 
@@ -77,13 +77,13 @@ The [getting started guide](https://gateway-api.sigs.k8s.io/guides/getting-start
 
 !!! note ""
 
-    Keep in mind that the Traefik Gateway provider only supports the `v0.1.0`.
+    Keep in mind that the Traefik Gateway provider only supports the `v0.3.0`.
 
 For now, the Traefik Gateway Provider can be used while following the below guides:
 
 * [Simple Gateway](https://gateway-api.sigs.k8s.io/guides/simple-gateway/)
 * [HTTP routing](https://gateway-api.sigs.k8s.io/guides/http-routing/)
-* [TLS](https://gateway-api.sigs.k8s.io/guides/tls/) (Partial support: only on listeners with terminate mode)
+* [TLS](https://gateway-api.sigs.k8s.io/guides/tls/)
 
 ## Resource Configuration
 
@@ -96,7 +96,9 @@ Traefik implements the following resources:
 
 * `GatewayClass` defines a set of Gateways that share a common configuration and behaviour.
 * `Gateway` describes how traffic can be translated to Services within the cluster.
-* `HTTPRoute` define HTTP rules for mapping requests from a Gateway to Kubernetes Services.
+* `HTTPRoute` defines HTTP rules for mapping requests from a Gateway to Kubernetes Services.
+* `TCPRoute` defines TCP rules for mapping requests from a Gateway to Kubernetes Services.
+* `TLSRoute` defines TLS rules for mapping requests from a Gateway to Kubernetes Services.
 
 ## Provider Configuration
 

docs/content/providers/kubernetes-ingress.md

@@ -6,6 +6,10 @@ The Kubernetes Ingress Controller.
 The Traefik Kubernetes Ingress provider is a Kubernetes Ingress controller; that is to say,
 it manages access to cluster services by supporting the [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) specification.
 
+## Requirements
+
+Traefik supports `1.14+` Kubernetes clusters.
+
 ## Routing Configuration
 
 See the dedicated section in [routing](../routing/providers/kubernetes-ingress.md).
@@ -31,9 +35,9 @@ The provider then watches for incoming ingresses events, such as the example bel
 and derives the corresponding dynamic configuration from it,
 which in turn creates the resulting routers, services, handlers, etc.
 
-```yaml tab="File (YAML)"
+```yaml tab="Ingress"
 kind: Ingress
-apiVersion: extensions/v1beta1
+apiVersion: networking.k8s.io/v1beta1
 metadata:
   name: "foo"
   namespace: production
@@ -53,6 +57,32 @@ spec:
               servicePort: 80
 ```
 
+```yaml tab="Ingress Kubernetes v1.19+"
+kind: Ingress
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: "foo"
+  namespace: production
+
+spec:
+  rules:
+    - host: example.net
+      http:
+        paths:
+          - path: /bar
+            backend:
+              service:
+                name:  service1
+                port:
+                  number: 80
+          - path: /foo
+            backend:
+              service:
+                name:  service1
+                port:
+                  number: 80
+```
+
 ## LetsEncrypt Support with the Ingress Provider
 
 By design, Traefik is a stateless application,
@@ -220,11 +250,13 @@ Value of `kubernetes.io/ingress.class` annotation that identifies Ingress object
 If the parameter is set, only Ingresses containing an annotation with the same value are processed.
 Otherwise, Ingresses missing the annotation, having an empty value, or the value `traefik` are processed.
 
-!!! info "Kubernetes 1.18+"
+??? info "Kubernetes 1.18+"
 
     If the Kubernetes cluster version is 1.18+,
     the new `IngressClass` resource can be leveraged to identify Ingress objects that should be processed.
-    In that case, Traefik will look for an `IngressClass` in the cluster with the controller value equal to *traefik.io/ingress-controller*. 
+    In that case, Traefik will look for an `IngressClass` in the cluster with the controller value equal to *traefik.io/ingress-controller*.
+
+    In addition to the controller value matching mechanism, the property `ingressClass` (if set) will be used to select IngressClasses by applying a strict matching on their name.
 
     Please see [this article](https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/) for more information or the example below.
 
@@ -254,6 +286,39 @@ Otherwise, Ingresses missing the annotation, having an empty value, or the value
               servicePort: 80
     ```
 
+??? info "Kubernetes 1.19+"
+
+    If the Kubernetes cluster version is 1.19+,
+    prefer using the `networking.k8s.io/v1` [apiVersion](https://v1-19.docs.kubernetes.io/docs/setup/release/notes/#api-change) of `Ingress` and `IngressClass`.
+
+    ```yaml tab="IngressClass"
+    apiVersion: networking.k8s.io/v1
+    kind: IngressClass
+    metadata:
+      name: traefik-lb
+    spec:
+      controller: traefik.io/ingress-controller
+    ```
+
+    ```yaml tab="Ingress"
+    apiVersion: "networking.k8s.io/v1"
+    kind: "Ingress"
+    metadata:
+      name: "example-ingress"
+    spec:
+      ingressClassName: "traefik-lb"
+      rules:
+      - host: "*.example.com"
+        http:
+          paths:
+          - path: "/example"
+            backend:
+              service:
+                name: "example-service"
+                port:
+                    number: 80
+    ```
+
 ```yaml tab="File (YAML)"
 providers:
   kubernetesIngress:
@@ -375,6 +440,30 @@ providers:
 --providers.kubernetesingress.throttleDuration=10s
 ```
 
+### `allowEmptyServices`
+
+_Optional, Default: false
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesIngress:
+    allowEmptyServices: true
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.kubernetesIngress]
+  allowEmptyServices = true
+  # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetesingress.allowEmptyServices=true
+```
+
+Allow the creation of services if there are no endpoints available.
+This results in `503` http responses instead of `404`.
+
 ### `allowExternalNameServices`
 
 _Optional, Default: false_

docs/content/reference/dynamic-configuration/consul-catalog.yml

@@ -1 +1,2 @@
 - "traefik.enable=true"
+- "traefik.consulcatalog.connect=true"

docs/content/reference/dynamic-configuration/docker-labels.yml

@@ -35,7 +35,6 @@
 - "traefik.http.middlewares.middleware10.headers.accesscontrolallowcredentials=true"
 - "traefik.http.middlewares.middleware10.headers.accesscontrolallowheaders=foobar, foobar"
 - "traefik.http.middlewares.middleware10.headers.accesscontrolallowmethods=foobar, foobar"
-- "traefik.http.middlewares.middleware10.headers.accesscontrolalloworigin=foobar"
 - "traefik.http.middlewares.middleware10.headers.accesscontrolalloworiginlist=foobar, foobar"
 - "traefik.http.middlewares.middleware10.headers.accesscontrolalloworiginlistregex=foobar, foobar"
 - "traefik.http.middlewares.middleware10.headers.accesscontrolexposeheaders=foobar, foobar"
@@ -160,7 +159,9 @@
 - "traefik.http.services.service01.loadbalancer.server.port=foobar"
 - "traefik.http.services.service01.loadbalancer.server.scheme=foobar"
 - "traefik.http.services.service01.loadbalancer.serverstransport=foobar"
+- "traefik.tcp.middlewares.middleware00.ipwhitelist.sourcerange=foobar, foobar"
 - "traefik.tcp.routers.tcprouter0.entrypoints=foobar, foobar"
+- "traefik.tcp.routers.tcprouter0.middlewares=foobar, foobar"
 - "traefik.tcp.routers.tcprouter0.rule=foobar"
 - "traefik.tcp.routers.tcprouter0.service=foobar"
 - "traefik.tcp.routers.tcprouter0.tls=true"
@@ -172,6 +173,7 @@
 - "traefik.tcp.routers.tcprouter0.tls.options=foobar"
 - "traefik.tcp.routers.tcprouter0.tls.passthrough=true"
 - "traefik.tcp.routers.tcprouter1.entrypoints=foobar, foobar"
+- "traefik.tcp.routers.tcprouter1.middlewares=foobar, foobar"
 - "traefik.tcp.routers.tcprouter1.rule=foobar"
 - "traefik.tcp.routers.tcprouter1.service=foobar"
 - "traefik.tcp.routers.tcprouter1.tls=true"

docs/content/reference/dynamic-configuration/file.toml

@@ -69,6 +69,8 @@
         service = "foobar"
         maxBodySize = 42
 
+        [http.services.Service02.mirroring.healthCheck]
+
         [[http.services.Service02.mirroring.mirrors]]
           name = "foobar"
           percent = 42
@@ -78,6 +80,7 @@
           percent = 42
     [http.services.Service03]
       [http.services.Service03.weighted]
+        [http.services.Service03.weighted.healthCheck]
 
         [[http.services.Service03.weighted.services]]
           name = "foobar"
@@ -152,7 +155,6 @@
         accessControlAllowCredentials = true
         accessControlAllowHeaders = ["foobar", "foobar"]
         accessControlAllowMethods = ["foobar", "foobar"]
-        accessControlAllowOrigin = "foobar"
         accessControlAllowOriginList = ["foobar", "foobar"]
         accessControlAllowOriginListRegex = ["foobar", "foobar"]
         accessControlExposeHeaders = ["foobar", "foobar"]
@@ -275,6 +277,8 @@
       insecureSkipVerify = true
       rootCAs = ["foobar", "foobar"]
       maxIdleConnsPerHost = 42
+      disableHTTP2 = true
+      peerCertURI = "foobar"
 
       [[http.serversTransports.ServersTransport0.certificates]]
         certFile = "foobar"
@@ -292,6 +296,8 @@
       insecureSkipVerify = true
       rootCAs = ["foobar", "foobar"]
       maxIdleConnsPerHost = 42
+      disableHTTP2 = true
+      peerCertURI = "foobar"
 
       [[http.serversTransports.ServersTransport1.certificates]]
         certFile = "foobar"
@@ -309,6 +315,7 @@
   [tcp.routers]
     [tcp.routers.TCPRouter0]
       entryPoints = ["foobar", "foobar"]
+      middlewares = ["foobar", "foobar"]
       service = "foobar"
       rule = "foobar"
       [tcp.routers.TCPRouter0.tls]
@@ -325,6 +332,7 @@
           sans = ["foobar", "foobar"]
     [tcp.routers.TCPRouter1]
       entryPoints = ["foobar", "foobar"]
+      middlewares = ["foobar", "foobar"]
       service = "foobar"
       rule = "foobar"
       [tcp.routers.TCPRouter1.tls]
@@ -361,6 +369,10 @@
         [[tcp.services.TCPService02.weighted.services]]
           name = "foobar"
           weight = 42
+  [tcp.middlewares]
+    [tcp.middlewares.Middleware00]
+      [tcp.middlewares.Middleware00.ipWhiteList]
+      sourceRange = ["foobar", "foobar"]
 
 [udp]
   [udp.routers]

docs/content/reference/dynamic-configuration/file.yaml

@@ -75,6 +75,7 @@ http:
       mirroring:
         service: foobar
         maxBodySize: 42
+        healthCheck: {}
         mirrors:
         - name: foobar
           percent: 42
@@ -82,6 +83,7 @@ http:
           percent: 42
     Service03:
       weighted:
+        healthCheck: {}
         services:
         - name: foobar
           weight: 42
@@ -177,7 +179,6 @@ http:
         accessControlAllowMethods:
         - foobar
         - foobar
-        accessControlAllowOrigin: foobar
         accessControlAllowOriginList:
         - foobar
         - foobar
@@ -327,6 +328,8 @@ http:
         dialTimeout: 42s
         responseHeaderTimeout: 42s
         idleConnTimeout: 42s
+      disableHTTP2: true
+      peerCertURI: foobar
     ServersTransport1:
       serverName: foobar
       insecureSkipVerify: true
@@ -343,12 +346,17 @@ http:
         dialTimeout: 42s
         responseHeaderTimeout: 42s
         idleConnTimeout: 42s
+      disableHTTP2: true
+      peerCertURI: foobar
 tcp:
   routers:
     TCPRouter0:
       entryPoints:
       - foobar
       - foobar
+      middlewares:
+      - foobar
+      - foobar
       service: foobar
       rule: foobar
       tls:
@@ -368,6 +376,9 @@ tcp:
       entryPoints:
       - foobar
       - foobar
+      middlewares:
+      - foobar
+      - foobar
       service: foobar
       rule: foobar
       tls:
@@ -383,6 +394,12 @@ tcp:
           sans:
           - foobar
           - foobar
+  middlewares:
+    Middleware00:
+      ipWhiteList:
+        sourceRange:
+        - foobar
+        - foobar
   services:
     TCPService01:
       loadBalancer:

docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml

@@ -0,0 +1,8 @@
+--8<-- "content/reference/dynamic-configuration/traefik.containo.us_ingressroutes.yaml"
+--8<-- "content/reference/dynamic-configuration/traefik.containo.us_ingressroutetcps.yaml"
+--8<-- "content/reference/dynamic-configuration/traefik.containo.us_ingressrouteudps.yaml"
+--8<-- "content/reference/dynamic-configuration/traefik.containo.us_middlewares.yaml"
+--8<-- "content/reference/dynamic-configuration/traefik.containo.us_serverstransports.yaml"
+--8<-- "content/reference/dynamic-configuration/traefik.containo.us_tlsoptions.yaml"
+--8<-- "content/reference/dynamic-configuration/traefik.containo.us_tlsstores.yaml"
+--8<-- "content/reference/dynamic-configuration/traefik.containo.us_traefikservices.yaml"

docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1beta1.yml

@@ -27,6 +27,21 @@ spec:
     singular: middleware
   scope: Namespaced
 
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: middlewaretcps.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: MiddlewareTCP
+    plural: middlewaretcps
+    singular: middlewaretcp
+  scope: Namespaced
+
 ---
 apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
@@ -72,21 +87,6 @@ spec:
     singular: tlsoption
   scope: Namespaced
 
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: serverstransports.traefik.containo.us
-
-spec:
-  group: traefik.containo.us
-  version: v1alpha1
-  names:
-    kind: ServersTransport
-    plural: serverstransports
-    singular: serverstransport
-  scope: Namespaced
-
 ---
 apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
@@ -102,7 +102,6 @@ spec:
     singular: tlsstore
   scope: Namespaced
 
-
 ---
 apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
@@ -117,3 +116,18 @@ spec:
     plural: traefikservices
     singular: traefikservice
   scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serverstransports.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: ServersTransport
+    plural: serverstransports
+    singular: serverstransport
+  scope: Namespaced

docs/content/reference/dynamic-configuration/kubernetes-crd-definition.yml

@@ -1,118 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: ingressroutes.traefik.containo.us
-
-spec:
-  group: traefik.containo.us
-  version: v1alpha1
-  names:
-    kind: IngressRoute
-    plural: ingressroutes
-    singular: ingressroute
-  scope: Namespaced
-
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: middlewares.traefik.containo.us
-
-spec:
-  group: traefik.containo.us
-  version: v1alpha1
-  names:
-    kind: Middleware
-    plural: middlewares
-    singular: middleware
-  scope: Namespaced
-
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: ingressroutetcps.traefik.containo.us
-
-spec:
-  group: traefik.containo.us
-  version: v1alpha1
-  names:
-    kind: IngressRouteTCP
-    plural: ingressroutetcps
-    singular: ingressroutetcp
-  scope: Namespaced
-
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: ingressrouteudps.traefik.containo.us
-
-spec:
-  group: traefik.containo.us
-  version: v1alpha1
-  names:
-    kind: IngressRouteUDP
-    plural: ingressrouteudps
-    singular: ingressrouteudp
-  scope: Namespaced
-
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: tlsoptions.traefik.containo.us
-
-spec:
-  group: traefik.containo.us
-  version: v1alpha1
-  names:
-    kind: TLSOption
-    plural: tlsoptions
-    singular: tlsoption
-  scope: Namespaced
-
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: tlsstores.traefik.containo.us
-
-spec:
-  group: traefik.containo.us
-  version: v1alpha1
-  names:
-    kind: TLSStore
-    plural: tlsstores
-    singular: tlsstore
-  scope: Namespaced
-
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: traefikservices.traefik.containo.us
-
-spec:
-  group: traefik.containo.us
-  version: v1alpha1
-  names:
-    kind: TraefikService
-    plural: traefikservices
-    singular: traefikservice
-  scope: Namespaced
-
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: serverstransports.traefik.containo.us
-
-spec:
-  group: traefik.containo.us
-  version: v1alpha1
-  names:
-    kind: ServersTransport
-    plural: serverstransports
-    singular: serverstransport
-  scope: Namespaced

docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml

@@ -34,6 +34,7 @@ rules:
       - traefik.containo.us
     resources:
       - middlewares
+      - middlewaretcps
       - ingressroutes
       - traefikservices
       - ingressroutetcps

docs/content/reference/dynamic-configuration/kubernetes-crd-resource.yml

@@ -63,10 +63,10 @@ spec:
   mirroring:
     name: wrr2
     kind: TraefikService
+    # Optional
+    maxBodySize: 2000000000
     mirrors:
       - name: s2
-        # Optional
-        maxBodySize: 2000000000
         # Optional, as it is the default value
         kind: Service
         percent: 20
@@ -77,6 +77,7 @@ apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
   name: ingressroute
+
 spec:
   entryPoints:
     - web
@@ -98,6 +99,7 @@ spec:
           port: 433
           serversTransport: mytransport
     - match: PathPrefix(`/misc`)
+      kind: Rule
       services:
         - name: s3
           port: 80
@@ -105,6 +107,7 @@ spec:
         - name: stripprefix
         - name: addprefix
     - match: PathPrefix(`/misc`)
+      kind: Rule
       services:
         - name: s3
           # Optional, as it is the default value
@@ -113,10 +116,12 @@ spec:
           # scheme allow to override the scheme for the service. (ex: https or h2c)
           scheme: https
     - match: PathPrefix(`/lb`)
+      kind: Rule
       services:
         - name: wrr1
           kind: TraefikService
     - match: PathPrefix(`/mirrored`)
+      kind: Rule
       services:
         - name: mirror1
           kind: TraefikService
@@ -142,6 +147,8 @@ spec:
       services:
         - name: whoamitcp
           port: 8080
+      middlewares:
+        - name: ipwhitelist
   tls:
     secretName: foosecret
     passthrough: false
@@ -181,10 +188,10 @@ spec:
     - foobar
     - foobar
   clientAuth:
-    caFiles:
+    secretNames:
       - foobar
       - foobar
-    clientAuthType: foobar
+    clientAuthType: RequireAndVerifyClientCert
   sniStrict: true
   preferServerCipherSuites: true
 
@@ -209,3 +216,4 @@ spec:
     dialTimeout: 42s
     responseHeaderTimeout: 42s
     idleConnTimeout: 42s
+  disableHTTP2: true

docs/content/reference/dynamic-configuration/kubernetes-crd.md

@@ -5,8 +5,12 @@ Dynamic configuration with Kubernetes Custom Resource
 
 ## Definitions
 
-```yaml
---8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition.yml"
+```yaml tab="apiextensions.k8s.io/v1"
+--8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml"
+```
+
+```yaml tab="apiextensions.k8s.io/v1beta1"
+--8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition-v1beta1.yml"
 ```
 
 ## Resources

docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml

@@ -20,6 +20,8 @@ rules:
       - gatewayclasses
       - gateways
       - httproutes
+      - tcproutes
+      - tlsroutes
     verbs:
       - get
       - list
@@ -30,6 +32,8 @@ rules:
       - gatewayclasses/status
       - gateways/status
       - httproutes/status
+      - tcproutes/status
+      - tlsroutes/status
     verbs:
       - update
 

docs/content/reference/dynamic-configuration/kubernetes-gateway-resource.yml

@@ -22,7 +22,44 @@ spec:
         namespaces:
           from: Same
         selector:
-          app: foo
+          matchLabels:
+            app: foo
+     - protocol: HTTPS
+       port: 443
+       tls:
+         certificateRef:
+           group: "core"
+           kind: "Secret"
+           name: "mysecret"
+       routes:
+         kind: HTTPRoute
+         selector:
+           matchLabels:
+             app: foo
+    - protocol: TCP
+      port: 9000
+      routes:
+        kind: TCPRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: footcp
+    - protocol: TLS
+      port: 9443
+      hostname: example.com
+      tls:
+        certificateRef:
+          group: "core"
+          kind: "Secret"
+          name: "mysecret"
+      routes:
+        kind: TLSRoute
+        namespaces:
+          from: Same
+        selector:
+          matchLabels:
+            app: footls
 
 ---
 kind: HTTPRoute
@@ -44,3 +81,44 @@ spec:
         - serviceName: whoami
           port: 80
           weight: 1
+    - matches:
+        - path:
+            type: Prefix
+            value: /foo
+      forwardTo:
+        - backendRef:
+            group: traefik.containo.us
+            kind: TraefikService
+            name: myservice@file
+          weight: 1
+          port: 80
+
+---
+kind: TCPRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tcp-app-1
+  namespace: default
+  labels:
+    app: footcp
+spec:
+  rules:
+     - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1
+
+---
+kind: TLSRoute
+apiVersion: networking.x-k8s.io/v1alpha1
+metadata:
+  name: tls-app-1
+  namespace: default
+  labels:
+    app: footls
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: whoamitcp
+          port: 9000
+          weight: 1

docs/content/reference/dynamic-configuration/kubernetes-gateway.md

@@ -9,6 +9,8 @@ Dynamic configuration with Kubernetes Gateway provider.
 --8<-- "content/reference/dynamic-configuration/networking.x-k8s.io_gatewayclasses.yaml"
 --8<-- "content/reference/dynamic-configuration/networking.x-k8s.io_gateways.yaml"
 --8<-- "content/reference/dynamic-configuration/networking.x-k8s.io_httproutes.yaml"
+--8<-- "content/reference/dynamic-configuration/networking.x-k8s.io_tcproutes.yaml"
+--8<-- "content/reference/dynamic-configuration/networking.x-k8s.io_tlsroutes.yaml"
 ```
 
 ## Resources

docs/content/reference/dynamic-configuration/kv-ref.md

@@ -43,7 +43,6 @@
 | `traefik/http/middlewares/Middleware10/headers/accessControlAllowHeaders/1` | `foobar` |
 | `traefik/http/middlewares/Middleware10/headers/accessControlAllowMethods/0` | `foobar` |
 | `traefik/http/middlewares/Middleware10/headers/accessControlAllowMethods/1` | `foobar` |
-| `traefik/http/middlewares/Middleware10/headers/accessControlAllowOrigin` | `foobar` |
 | `traefik/http/middlewares/Middleware10/headers/accessControlAllowOriginList/0` | `foobar` |
 | `traefik/http/middlewares/Middleware10/headers/accessControlAllowOriginList/1` | `foobar` |
 | `traefik/http/middlewares/Middleware10/headers/accessControlAllowOriginListRegex/0` | `foobar` |
@@ -169,11 +168,13 @@
 | `traefik/http/serversTransports/ServersTransport0/certificates/0/keyFile` | `foobar` |
 | `traefik/http/serversTransports/ServersTransport0/certificates/1/certFile` | `foobar` |
 | `traefik/http/serversTransports/ServersTransport0/certificates/1/keyFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport0/disableHTTP2` | `true` |
 | `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/dialTimeout` | `42s` |
 | `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/idleConnTimeout` | `42s` |
 | `traefik/http/serversTransports/ServersTransport0/forwardingTimeouts/responseHeaderTimeout` | `42s` |
 | `traefik/http/serversTransports/ServersTransport0/insecureSkipVerify` | `true` |
 | `traefik/http/serversTransports/ServersTransport0/maxIdleConnsPerHost` | `42` |
+| `traefik/http/serversTransports/ServersTransport0/peerCertURI` | `foobar` |
 | `traefik/http/serversTransports/ServersTransport0/rootCAs/0` | `foobar` |
 | `traefik/http/serversTransports/ServersTransport0/rootCAs/1` | `foobar` |
 | `traefik/http/serversTransports/ServersTransport0/serverName` | `foobar` |
@@ -181,11 +182,13 @@
 | `traefik/http/serversTransports/ServersTransport1/certificates/0/keyFile` | `foobar` |
 | `traefik/http/serversTransports/ServersTransport1/certificates/1/certFile` | `foobar` |
 | `traefik/http/serversTransports/ServersTransport1/certificates/1/keyFile` | `foobar` |
+| `traefik/http/serversTransports/ServersTransport1/disableHTTP2` | `true` |
 | `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/dialTimeout` | `42s` |
 | `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/idleConnTimeout` | `42s` |
 | `traefik/http/serversTransports/ServersTransport1/forwardingTimeouts/responseHeaderTimeout` | `42s` |
 | `traefik/http/serversTransports/ServersTransport1/insecureSkipVerify` | `true` |
 | `traefik/http/serversTransports/ServersTransport1/maxIdleConnsPerHost` | `42` |
+| `traefik/http/serversTransports/ServersTransport1/peerCertURI` | `foobar` |
 | `traefik/http/serversTransports/ServersTransport1/rootCAs/0` | `foobar` |
 | `traefik/http/serversTransports/ServersTransport1/rootCAs/1` | `foobar` |
 | `traefik/http/serversTransports/ServersTransport1/serverName` | `foobar` |
@@ -207,12 +210,14 @@
 | `traefik/http/services/Service01/loadBalancer/sticky/cookie/name` | `foobar` |
 | `traefik/http/services/Service01/loadBalancer/sticky/cookie/sameSite` | `foobar` |
 | `traefik/http/services/Service01/loadBalancer/sticky/cookie/secure` | `true` |
+| `traefik/http/services/Service02/mirroring/healthCheck` | `` |
 | `traefik/http/services/Service02/mirroring/maxBodySize` | `42` |
 | `traefik/http/services/Service02/mirroring/mirrors/0/name` | `foobar` |
 | `traefik/http/services/Service02/mirroring/mirrors/0/percent` | `42` |
 | `traefik/http/services/Service02/mirroring/mirrors/1/name` | `foobar` |
 | `traefik/http/services/Service02/mirroring/mirrors/1/percent` | `42` |
 | `traefik/http/services/Service02/mirroring/service` | `foobar` |
+| `traefik/http/services/Service03/weighted/healthCheck` | `` |
 | `traefik/http/services/Service03/weighted/services/0/name` | `foobar` |
 | `traefik/http/services/Service03/weighted/services/0/weight` | `42` |
 | `traefik/http/services/Service03/weighted/services/1/name` | `foobar` |
@@ -221,8 +226,12 @@
 | `traefik/http/services/Service03/weighted/sticky/cookie/name` | `foobar` |
 | `traefik/http/services/Service03/weighted/sticky/cookie/sameSite` | `foobar` |
 | `traefik/http/services/Service03/weighted/sticky/cookie/secure` | `true` |
+| `traefik/tcp/middlewares/Middleware00/ipWhiteList/sourceRange/0` | `foobar` |
+| `traefik/tcp/middlewares/Middleware00/ipWhiteList/sourceRange/1` | `foobar` |
 | `traefik/tcp/routers/TCPRouter0/entryPoints/0` | `foobar` |
 | `traefik/tcp/routers/TCPRouter0/entryPoints/1` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/middlewares/0` | `foobar` |
+| `traefik/tcp/routers/TCPRouter0/middlewares/1` | `foobar` |
 | `traefik/tcp/routers/TCPRouter0/rule` | `foobar` |
 | `traefik/tcp/routers/TCPRouter0/service` | `foobar` |
 | `traefik/tcp/routers/TCPRouter0/tls/certResolver` | `foobar` |
@@ -236,6 +245,8 @@
 | `traefik/tcp/routers/TCPRouter0/tls/passthrough` | `true` |
 | `traefik/tcp/routers/TCPRouter1/entryPoints/0` | `foobar` |
 | `traefik/tcp/routers/TCPRouter1/entryPoints/1` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/middlewares/0` | `foobar` |
+| `traefik/tcp/routers/TCPRouter1/middlewares/1` | `foobar` |
 | `traefik/tcp/routers/TCPRouter1/rule` | `foobar` |
 | `traefik/tcp/routers/TCPRouter1/service` | `foobar` |
 | `traefik/tcp/routers/TCPRouter1/tls/certResolver` | `foobar` |

docs/content/reference/dynamic-configuration/marathon-labels.json

@@ -35,7 +35,6 @@
 "traefik.http.middlewares.middleware10.headers.accesscontrolallowcredentials": "true",
 "traefik.http.middlewares.middleware10.headers.accesscontrolallowheaders": "foobar, foobar",
 "traefik.http.middlewares.middleware10.headers.accesscontrolallowmethods": "foobar, foobar",
-"traefik.http.middlewares.middleware10.headers.accesscontrolalloworigin": "foobar",
 "traefik.http.middlewares.middleware10.headers.accesscontrolalloworiginlist": "foobar, foobar",
 "traefik.http.middlewares.middleware10.headers.accesscontrolalloworiginlistregex": "foobar, foobar",
 "traefik.http.middlewares.middleware10.headers.accesscontrolexposeheaders": "foobar, foobar",

docs/content/reference/dynamic-configuration/networking.x-k8s.io_gatewayclasses.yaml

@@ -4,12 +4,14 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.4.1
+    controller-gen.kubebuilder.io/version: v0.5.0
   creationTimestamp: null
   name: gatewayclasses.networking.x-k8s.io
 spec:
   group: networking.x-k8s.io
   names:
+    categories:
+    - gateway-api
     kind: GatewayClass
     listKind: GatewayClassList
     plural: gatewayclasses
@@ -22,16 +24,25 @@ spec:
     - jsonPath: .spec.controller
       name: Controller
       type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
     name: v1alpha1
     schema:
       openAPIV3Schema:
-        description: "GatewayClass describes a class of Gateways available to the user for creating Gateway resources. \n GatewayClass is a Cluster level resource."
+        description: "GatewayClass describes a class of Gateways available to the
+          user for creating Gateway resources. \n GatewayClass is a Cluster level
+          resource."
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
             type: string
           metadata:
             type: object
@@ -39,11 +50,23 @@ spec:
             description: Spec defines the desired state of GatewayClass.
             properties:
               controller:
-                description: "Controller is a domain/path string that indicates the controller that is managing Gateways of this class. \n Example: \"acme.io/gateway-controller\". \n This field is not mutable and cannot be empty. \n The format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). \n Support: Core"
+                description: "Controller is a domain/path string that indicates the
+                  controller that is managing Gateways of this class. \n Example:
+                  \"acme.io/gateway-controller\". \n This field is not mutable and
+                  cannot be empty. \n The format of this field is DOMAIN \"/\" PATH,
+                  where DOMAIN and PATH are valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+                  \n Support: Core"
                 maxLength: 253
                 type: string
               parametersRef:
-                description: "ParametersRef is a reference to a resource that contains the configuration parameters corresponding to the GatewayClass. This is optional if the controller does not require any additional configuration. \n ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap, or an implementation-specific custom resource. The resource can be cluster-scoped or namespace-scoped. \n If the referent cannot be found, the GatewayClass's \"InvalidParameters\" status condition will be true. \n Support: Custom"
+                description: "ParametersRef is a reference to a resource that contains
+                  the configuration parameters corresponding to the GatewayClass.
+                  This is optional if the controller does not require any additional
+                  configuration. \n ParametersRef can reference a standard Kubernetes
+                  resource, i.e. ConfigMap, or an implementation-specific custom resource.
+                  The resource can be cluster-scoped or namespace-scoped. \n If the
+                  referent cannot be found, the GatewayClass's \"InvalidParameters\"
+                  status condition will be true. \n Support: Custom"
                 properties:
                   group:
                     description: Group is the group of the referent.
@@ -61,13 +84,16 @@ spec:
                     minLength: 1
                     type: string
                   namespace:
-                    description: Namespace is the namespace of the referent. This field is required when scope is set to "Namespace" and ignored when scope is set to "Cluster".
+                    description: Namespace is the namespace of the referent. This
+                      field is required when scope is set to "Namespace" and ignored
+                      when scope is set to "Cluster".
                     maxLength: 253
                     minLength: 1
                     type: string
                   scope:
                     default: Cluster
-                    description: Scope represents if the referent is a Cluster or Namespace scoped resource. This may be set to "Cluster" or "Namespace".
+                    description: Scope represents if the referent is a Cluster or
+                      Namespace scoped resource. This may be set to "Cluster" or "Namespace".
                     enum:
                     - Cluster
                     - Namespace
@@ -97,25 +123,49 @@ spec:
                   reason: Waiting
                   status: "False"
                   type: Admitted
-                description: "Conditions is the current status from the controller for this GatewayClass. \n Controllers should prefer to publish conditions using values of GatewayClassConditionType for the type of each Condition."
+                description: "Conditions is the current status from the controller
+                  for this GatewayClass. \n Controllers should prefer to publish conditions
+                  using values of GatewayClassConditionType for the type of each Condition."
                 items:
-                  description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions.  For example, type FooStatus struct{     // Represents the observations of a foo's current state.     // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\"     // +patchMergeKey=type     // +patchStrategy=merge     // +listType=map     // +listMapKey=type     Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n     // other fields }"
+                  description: "Condition contains details for one aspect of the current
+                    state of this API Resource. --- This struct is intended for direct
+                    use as an array at the field path .status.conditions.  For example,
+                    type FooStatus struct{     // Represents the observations of a
+                    foo's current state.     // Known .status.conditions.type are:
+                    \"Available\", \"Progressing\", and \"Degraded\"     // +patchMergeKey=type
+                    \    // +patchStrategy=merge     // +listType=map     // +listMapKey=type
+                    \    Conditions []metav1.Condition `json:\"conditions,omitempty\"
+                    patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
+                    \n     // other fields }"
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      description: lastTransitionTime is the last time the condition
+                        transitioned from one status to another. This should be when
+                        the underlying condition changed.  If that is not known, then
+                        using the time when the API field changed is acceptable.
                       format: date-time
                       type: string
                     message:
-                      description: message is a human readable message indicating details about the transition. This may be an empty string.
+                      description: message is a human readable message indicating
+                        details about the transition. This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
+                      description: observedGeneration represents the .metadata.generation
+                        that the condition was set based upon. For instance, if .metadata.generation
+                        is currently 12, but the .status.conditions[x].observedGeneration
+                        is 9, the condition is out of date with respect to the current
+                        state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
+                      description: reason contains a programmatic identifier indicating
+                        the reason for the condition's last transition. Producers
+                        of specific condition types may define expected values and
+                        meanings for this field, and whether the values are considered
+                        a guaranteed API. The value should be a CamelCase string.
+                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
@@ -128,7 +178,11 @@ spec:
                       - Unknown
                       type: string
                     type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        --- Many .condition.type values are consistent across resources
+                        like Available, but because arbitrary conditions can be useful
+                        (see .node.status.conditions), the ability to deconflict is
+                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                       maxLength: 316
                       pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                       type: string

docs/content/reference/dynamic-configuration/networking.x-k8s.io_gateways.yaml

@@ -4,12 +4,14 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.4.1
+    controller-gen.kubebuilder.io/version: v0.5.0
   creationTimestamp: null
   name: gateways.networking.x-k8s.io
 spec:
   group: networking.x-k8s.io
   names:
+    categories:
+    - gateway-api
     kind: Gateway
     listKind: GatewayList
     plural: gateways
@@ -22,16 +24,28 @@ spec:
     - jsonPath: .spec.gatewayClassName
       name: Class
       type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
     name: v1alpha1
     schema:
       openAPIV3Schema:
-        description: "Gateway represents an instantiation of a service-traffic handling infrastructure by binding Listeners to a set of IP addresses. \n Implementations should add the `gateway-exists-finalizer.networking.x-k8s.io` finalizer on the associated GatewayClass whenever Gateway(s) is running. This ensures that a GatewayClass associated with a Gateway(s) is not deleted while in use."
+        description: "Gateway represents an instantiation of a service-traffic handling
+          infrastructure by binding Listeners to a set of IP addresses. \n Implementations
+          should add the `gateway-exists-finalizer.networking.x-k8s.io` finalizer
+          on the associated GatewayClass whenever Gateway(s) is running. This ensures
+          that a GatewayClass associated with a Gateway(s) is not deleted while in
+          use."
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
             type: string
           metadata:
             type: object
@@ -39,9 +53,18 @@ spec:
             description: Spec defines the desired state of Gateway.
             properties:
               addresses:
-                description: "Addresses requested for this gateway. This is optional and behavior can depend on the GatewayClass. If a value is set in the spec and the requested address is invalid, the GatewayClass MUST indicate this in the associated entry in GatewayStatus.Addresses. \n If no Addresses are specified, the GatewayClass may schedule the Gateway in an implementation-defined manner, assigning an appropriate set of Addresses. \n The GatewayClass MUST bind all Listeners to every GatewayAddress that it assigns to the Gateway. \n Support: Core"
+                description: "Addresses requested for this gateway. This is optional
+                  and behavior can depend on the GatewayClass. If a value is set in
+                  the spec and the requested address is invalid, the GatewayClass
+                  MUST indicate this in the associated entry in GatewayStatus.Addresses.
+                  \n If no Addresses are specified, the GatewayClass may schedule
+                  the Gateway in an implementation-defined manner, assigning an appropriate
+                  set of Addresses. \n The GatewayClass MUST bind all Listeners to
+                  every GatewayAddress that it assigns to the Gateway. \n Support:
+                  Core"
                 items:
-                  description: GatewayAddress describes an address that can be bound to a Gateway.
+                  description: GatewayAddress describes an address that can be bound
+                    to a Gateway.
                   properties:
                     type:
                       default: IPAddress
@@ -51,7 +74,9 @@ spec:
                       - NamedAddress
                       type: string
                     value:
-                      description: "Value of the address. The validity of the values will depend on the type and support by the controller. \n Examples: `1.2.3.4`, `128::1`, `my-ip-address`."
+                      description: "Value of the address. The validity of the values
+                        will depend on the type and support by the controller. \n
+                        Examples: `1.2.3.4`, `128::1`, `my-ip-address`."
                       maxLength: 253
                       minLength: 1
                       type: string
@@ -61,70 +86,186 @@ spec:
                 maxItems: 16
                 type: array
               gatewayClassName:
-                description: GatewayClassName used for this Gateway. This is the name of a GatewayClass resource.
+                description: GatewayClassName used for this Gateway. This is the name
+                  of a GatewayClass resource.
                 maxLength: 253
                 minLength: 1
                 type: string
               listeners:
-                description: "Listeners associated with this Gateway. Listeners define logical endpoints that are bound on this Gateway's addresses. At least one Listener MUST be specified. \n An implementation MAY group Listeners by Port and then collapse each group of Listeners into a single Listener if the implementation determines that the Listeners in the group are \"compatible\". An implementation MAY also group together and collapse compatible Listeners belonging to different Gateways. \n For example, an implementation might consider Listeners to be compatible with each other if all of the following conditions are met: \n 1. Either each Listener within the group specifies the \"HTTP\"    Protocol or each Listener within the group specifies either    the \"HTTPS\" or \"TLS\" Protocol. \n 2. Each Listener within the group specifies a Hostname that is unique    within the group. \n 3. As a special case, one Listener within a group may omit Hostname,    in which case this Listener matches when no other Listener    matches. \n If the implementation does collapse compatible Listeners, the hostname provided in the incoming client request MUST be matched to a Listener to find the correct set of Routes. The incoming hostname MUST be matched using the Hostname field for each Listener in order of most to least specific. That is, exact matches must be processed before wildcard matches. \n If this field specifies multiple Listeners that have the same Port value but are not compatible, the implementation must raise a \"Conflicted\" condition in the Listener status. \n Support: Core"
+                description: "Listeners associated with this Gateway. Listeners define
+                  logical endpoints that are bound on this Gateway's addresses. At
+                  least one Listener MUST be specified. \n An implementation MAY group
+                  Listeners by Port and then collapse each group of Listeners into
+                  a single Listener if the implementation determines that the Listeners
+                  in the group are \"compatible\". An implementation MAY also group
+                  together and collapse compatible Listeners belonging to different
+                  Gateways. \n For example, an implementation might consider Listeners
+                  to be compatible with each other if all of the following conditions
+                  are met: \n 1. Either each Listener within the group specifies the
+                  \"HTTP\"    Protocol or each Listener within the group specifies
+                  either    the \"HTTPS\" or \"TLS\" Protocol. \n 2. Each Listener
+                  within the group specifies a Hostname that is unique    within the
+                  group. \n 3. As a special case, one Listener within a group may
+                  omit Hostname,    in which case this Listener matches when no other
+                  Listener    matches. \n If the implementation does collapse compatible
+                  Listeners, the hostname provided in the incoming client request
+                  MUST be matched to a Listener to find the correct set of Routes.
+                  The incoming hostname MUST be matched using the Hostname field for
+                  each Listener in order of most to least specific. That is, exact
+                  matches must be processed before wildcard matches. \n If this field
+                  specifies multiple Listeners that have the same Port value but are
+                  not compatible, the implementation must raise a \"Conflicted\" condition
+                  in the Listener status. \n Support: Core"
                 items:
-                  description: Listener embodies the concept of a logical endpoint where a Gateway can accept network connections. Each listener in a Gateway must have a unique combination of Hostname, Port, and Protocol. This will be enforced by a validating webhook.
+                  description: Listener embodies the concept of a logical endpoint
+                    where a Gateway can accept network connections. Each listener
+                    in a Gateway must have a unique combination of Hostname, Port,
+                    and Protocol. This will be enforced by a validating webhook.
                   properties:
                     hostname:
-                      description: "Hostname specifies the virtual hostname to match for protocol types that define this concept. When unspecified, \"\", or `*`, all hostnames are matched. This field can be omitted for protocols that don't require hostname based matching. \n Hostname is the fully qualified domain name of a network host, as defined by RFC 3986. Note the following deviations from the \"host\" part of the URI as defined in the RFC: \n 1. IP literals are not allowed. 2. The `:` delimiter is not respected because ports are not allowed. \n Hostname can be \"precise\" which is a domain name without the terminating dot of a network host (e.g. \"foo.example.com\") or \"wildcard\", which is a domain name prefixed with a single wildcard label (e.g. `*.example.com`). The wildcard character `*` must appear by itself as the first DNS label and matches only a single label. \n Support: Core"
+                      description: "Hostname specifies the virtual hostname to match
+                        for protocol types that define this concept. When unspecified,
+                        \"\", or `*`, all hostnames are matched. This field can be
+                        omitted for protocols that don't require hostname based matching.
+                        \n Hostname is the fully qualified domain name of a network
+                        host, as defined by RFC 3986. Note the following deviations
+                        from the \"host\" part of the URI as defined in the RFC: \n
+                        1. IP literals are not allowed. 2. The `:` delimiter is not
+                        respected because ports are not allowed. \n Hostname can be
+                        \"precise\" which is a domain name without the terminating
+                        dot of a network host (e.g. \"foo.example.com\") or \"wildcard\",
+                        which is a domain name prefixed with a single wildcard label
+                        (e.g. `*.example.com`). The wildcard character `*` must appear
+                        by itself as the first DNS label and matches only a single
+                        label. \n Support: Core"
                       maxLength: 253
                       minLength: 1
                       type: string
                     port:
-                      description: "Port is the network port. Multiple listeners may use the same port, subject to the Listener compatibility rules. \n Support: Core"
+                      description: "Port is the network port. Multiple listeners may
+                        use the same port, subject to the Listener compatibility rules.
+                        \n Support: Core"
                       format: int32
                       maximum: 65535
                       minimum: 1
                       type: integer
                     protocol:
-                      description: "Protocol specifies the network protocol this listener expects to receive. The GatewayClass MUST apply the Hostname match appropriately for each protocol: \n * For the \"TLS\" protocol, the Hostname match MUST be   applied to the [SNI](https://tools.ietf.org/html/rfc6066#section-3)   server name offered by the client. * For the \"HTTP\" protocol, the Hostname match MUST be   applied to the host portion of the   [effective request URI](https://tools.ietf.org/html/rfc7230#section-5.5)   or the [:authority pseudo-header](https://tools.ietf.org/html/rfc7540#section-8.1.2.3) * For the \"HTTPS\" protocol, the Hostname match MUST be   applied at both the TLS and HTTP protocol layers. \n Support: Core"
+                      description: "Protocol specifies the network protocol this listener
+                        expects to receive. The GatewayClass MUST apply the Hostname
+                        match appropriately for each protocol: \n * For the \"TLS\"
+                        protocol, the Hostname match MUST be   applied to the [SNI](https://tools.ietf.org/html/rfc6066#section-3)
+                        \  server name offered by the client. * For the \"HTTP\" protocol,
+                        the Hostname match MUST be   applied to the host portion of
+                        the   [effective request URI](https://tools.ietf.org/html/rfc7230#section-5.5)
+                        \  or the [:authority pseudo-header](https://tools.ietf.org/html/rfc7540#section-8.1.2.3)
+                        * For the \"HTTPS\" protocol, the Hostname match MUST be   applied
+                        at both the TLS and HTTP protocol layers. \n Support: Core"
                       type: string
                     routes:
-                      description: "Routes specifies a schema for associating routes with the Listener using selectors. A Route is a resource capable of servicing a request and allows a cluster operator to expose a cluster resource (i.e. Service) by externally-reachable URL, load-balance traffic and terminate SSL/TLS.  Typically, a route is a \"HTTPRoute\" or \"TCPRoute\" in group \"networking.x-k8s.io\", however, an implementation may support other types of resources. \n The Routes selector MUST select a set of objects that are compatible with the application protocol specified in the Protocol field. \n Although a client request may technically match multiple route rules, only one rule may ultimately receive the request. Matching precedence MUST be determined in order of the following criteria: \n * The most specific match. For example, the most specific HTTPRoute match   is determined by the longest matching combination of hostname and path. * The oldest Route based on creation timestamp. For example, a Route with   a creation timestamp of \"2020-09-08 01:02:03\" is given precedence over   a Route with a creation timestamp of \"2020-09-08 01:02:04\". * If everything else is equivalent, the Route appearing first in   alphabetical order (namespace/name) should be given precedence. For   example, foo/bar is given precedence over foo/baz. \n All valid portions of a Route selected by this field should be supported. Invalid portions of a Route can be ignored (sometimes that will mean the full Route). If a portion of a Route transitions from valid to invalid, support for that portion of the Route should be dropped to ensure consistency. For example, even if a filter specified by a Route is invalid, the rest of the Route should still be supported. \n Support: Core"
+                      description: "Routes specifies a schema for associating routes
+                        with the Listener using selectors. A Route is a resource capable
+                        of servicing a request and allows a cluster operator to expose
+                        a cluster resource (i.e. Service) by externally-reachable
+                        URL, load-balance traffic and terminate SSL/TLS.  Typically,
+                        a route is a \"HTTPRoute\" or \"TCPRoute\" in group \"networking.x-k8s.io\",
+                        however, an implementation may support other types of resources.
+                        \n The Routes selector MUST select a set of objects that are
+                        compatible with the application protocol specified in the
+                        Protocol field. \n Although a client request may technically
+                        match multiple route rules, only one rule may ultimately receive
+                        the request. Matching precedence MUST be determined in order
+                        of the following criteria: \n * The most specific match. For
+                        example, the most specific HTTPRoute match   is determined
+                        by the longest matching combination of hostname and path.
+                        * The oldest Route based on creation timestamp. For example,
+                        a Route with   a creation timestamp of \"2020-09-08 01:02:03\"
+                        is given precedence over   a Route with a creation timestamp
+                        of \"2020-09-08 01:02:04\". * If everything else is equivalent,
+                        the Route appearing first in   alphabetical order (namespace/name)
+                        should be given precedence. For   example, foo/bar is given
+                        precedence over foo/baz. \n All valid portions of a Route
+                        selected by this field should be supported. Invalid portions
+                        of a Route can be ignored (sometimes that will mean the full
+                        Route). If a portion of a Route transitions from valid to
+                        invalid, support for that portion of the Route should be dropped
+                        to ensure consistency. For example, even if a filter specified
+                        by a Route is invalid, the rest of the Route should still
+                        be supported. \n Support: Core"
                       properties:
                         group:
                           default: networking.x-k8s.io
-                          description: "Group is the group of the route resource to select. Omitting the value or specifying the empty string indicates the networking.x-k8s.io API group. For example, use the following to select an HTTPRoute: \n routes:   kind: HTTPRoute \n Otherwise, if an alternative API group is desired, specify the desired group: \n routes:   group: acme.io   kind: FooRoute \n Support: Core"
+                          description: "Group is the group of the route resource to
+                            select. Omitting the value or specifying the empty string
+                            indicates the networking.x-k8s.io API group. For example,
+                            use the following to select an HTTPRoute: \n routes:   kind:
+                            HTTPRoute \n Otherwise, if an alternative API group is
+                            desired, specify the desired group: \n routes:   group:
+                            acme.io   kind: FooRoute \n Support: Core"
                           maxLength: 253
                           minLength: 1
                           type: string
                         kind:
-                          description: "Kind is the kind of the route resource to select. \n Kind MUST correspond to kinds of routes that are compatible with the application protocol specified in the Listener's Protocol field. \n If an implementation does not support or recognize this resource type, it SHOULD set the \"ResolvedRefs\" condition to false for this listener with the \"InvalidRoutesRef\" reason. \n Support: Core"
+                          description: "Kind is the kind of the route resource to
+                            select. \n Kind MUST correspond to kinds of routes that
+                            are compatible with the application protocol specified
+                            in the Listener's Protocol field. \n If an implementation
+                            does not support or recognize this resource type, it SHOULD
+                            set the \"ResolvedRefs\" condition to false for this listener
+                            with the \"InvalidRoutesRef\" reason. \n Support: Core"
                           type: string
                         namespaces:
                           default:
                             from: Same
-                          description: "Namespaces indicates in which namespaces Routes should be selected for this Gateway. This is restricted to the namespace of this Gateway by default. \n Support: Core"
+                          description: "Namespaces indicates in which namespaces Routes
+                            should be selected for this Gateway. This is restricted
+                            to the namespace of this Gateway by default. \n Support:
+                            Core"
                           properties:
                             from:
                               default: Same
-                              description: "From indicates where Routes will be selected for this Gateway. Possible values are: * All: Routes in all namespaces may be used by this Gateway. * Selector: Routes in namespaces selected by the selector may be used by   this Gateway. * Same: Only Routes in the same namespace may be used by this Gateway. \n Support: Core"
+                              description: "From indicates where Routes will be selected
+                                for this Gateway. Possible values are: * All: Routes
+                                in all namespaces may be used by this Gateway. * Selector:
+                                Routes in namespaces selected by the selector may
+                                be used by   this Gateway. * Same: Only Routes in
+                                the same namespace may be used by this Gateway. \n
+                                Support: Core"
                               enum:
                               - All
                               - Selector
                               - Same
                               type: string
                             selector:
-                              description: "Selector must be specified when From is set to \"Selector\". In that case, only Routes in Namespaces matching this Selector will be selected by this Gateway. This field is ignored for other values of \"From\". \n Support: Core"
+                              description: "Selector must be specified when From is
+                                set to \"Selector\". In that case, only Routes in
+                                Namespaces matching this Selector will be selected
+                                by this Gateway. This field is ignored for other values
+                                of \"From\". \n Support: Core"
                               properties:
                                 matchExpressions:
-                                  description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
                                   items:
-                                    description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
+                                    description: A label selector requirement is a
+                                      selector that contains values, a key, and an
+                                      operator that relates the key and values.
                                     properties:
                                       key:
-                                        description: key is the label key that the selector applies to.
+                                        description: key is the label key that the
+                                          selector applies to.
                                         type: string
                                       operator:
-                                        description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        description: operator represents a key's relationship
+                                          to a set of values. Valid operators are
+                                          In, NotIn, Exists and DoesNotExist.
                                         type: string
                                       values:
-                                        description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+                                        description: values is an array of string
+                                          values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the
+                                          operator is Exists or DoesNotExist, the
+                                          values array must be empty. This array is
+                                          replaced during a strategic merge patch.
                                         items:
                                           type: string
                                         type: array
@@ -136,26 +277,46 @@ spec:
                                 matchLabels:
                                   additionalProperties:
                                     type: string
-                                  description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  description: matchLabels is a map of {key,value}
+                                    pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions,
+                                    whose key field is "key", the operator is "In",
+                                    and the values array contains only "value". The
+                                    requirements are ANDed.
                                   type: object
                               type: object
                           type: object
                         selector:
-                          description: "Selector specifies a set of route labels used for selecting routes to associate with the Gateway. If this Selector is defined, only routes matching the Selector are associated with the Gateway. An empty Selector matches all routes. \n Support: Core"
+                          description: "Selector specifies a set of route labels used
+                            for selecting routes to associate with the Gateway. If
+                            this Selector is defined, only routes matching the Selector
+                            are associated with the Gateway. An empty Selector matches
+                            all routes. \n Support: Core"
                           properties:
                             matchExpressions:
-                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
                               items:
-                                description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
+                                description: A label selector requirement is a selector
+                                  that contains values, a key, and an operator that
+                                  relates the key and values.
                                 properties:
                                   key:
-                                    description: key is the label key that the selector applies to.
+                                    description: key is the label key that the selector
+                                      applies to.
                                     type: string
                                   operator:
-                                    description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    description: operator represents a key's relationship
+                                      to a set of values. Valid operators are In,
+                                      NotIn, Exists and DoesNotExist.
                                     type: string
                                   values:
-                                    description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+                                    description: values is an array of string values.
+                                      If the operator is In or NotIn, the values array
+                                      must be non-empty. If the operator is Exists
+                                      or DoesNotExist, the values array must be empty.
+                                      This array is replaced during a strategic merge
+                                      patch.
                                     items:
                                       type: string
                                     type: array
@@ -167,17 +328,37 @@ spec:
                             matchLabels:
                               additionalProperties:
                                 type: string
-                              description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              description: matchLabels is a map of {key,value} pairs.
+                                A single {key,value} in the matchLabels map is equivalent
+                                to an element of matchExpressions, whose key field
+                                is "key", the operator is "In", and the values array
+                                contains only "value". The requirements are ANDed.
                               type: object
                           type: object
                       required:
                       - kind
                       type: object
                     tls:
-                      description: "TLS is the TLS configuration for the Listener. This field is required if the Protocol field is \"HTTPS\" or \"TLS\" and ignored otherwise. \n The association of SNIs to Certificate defined in GatewayTLSConfig is defined based on the Hostname field for this listener. \n The GatewayClass MUST use the longest matching SNI out of all available certificates for any TLS handshake. \n Support: Core"
+                      description: "TLS is the TLS configuration for the Listener.
+                        This field is required if the Protocol field is \"HTTPS\"
+                        or \"TLS\" and ignored otherwise. \n The association of SNIs
+                        to Certificate defined in GatewayTLSConfig is defined based
+                        on the Hostname field for this listener. \n The GatewayClass
+                        MUST use the longest matching SNI out of all available certificates
+                        for any TLS handshake. \n Support: Core"
                       properties:
                         certificateRef:
-                          description: "CertificateRef is the reference to Kubernetes object that contain a TLS certificate and private key. This certificate MUST be used for TLS handshakes for the domain this GatewayTLSConfig is associated with. \n This field is required when mode is set to \"Terminate\" (default) and optional otherwise. \n If an entry in this list omits or specifies the empty string for both the group and the resource, the resource defaults to \"secrets\". An implementation may support other resources (for example, resource \"mycertificates\" in group \"networking.acme.io\"). \n Support: Core (Kubernetes Secrets) \n Support: Implementation-specific (Other resource types)"
+                          description: "CertificateRef is a reference to a Kubernetes
+                            object that contains a TLS certificate and private key.
+                            This certificate is used to establish a TLS handshake
+                            for requests that match the hostname of the associated
+                            listener. The referenced object MUST reside in the same
+                            namespace as Gateway. \n This field is required when mode
+                            is set to \"Terminate\" (default) and optional otherwise.
+                            \n CertificateRef can reference a standard Kubernetes
+                            resource, i.e. Secret, or an implementation-specific custom
+                            resource. \n Support: Core (Kubernetes Secrets) \n Support:
+                            Implementation-specific (Other resource types)"
                           properties:
                             group:
                               description: Group is the group of the referent.
@@ -201,7 +382,16 @@ spec:
                           type: object
                         mode:
                           default: Terminate
-                          description: "Mode defines the TLS behavior for the TLS session initiated by the client. There are two possible modes: - Terminate: The TLS session between the downstream client   and the Gateway is terminated at the Gateway. This mode requires   certificateRef to be set. - Passthrough: The TLS session is NOT terminated by the Gateway. This   implies that the Gateway can't decipher the TLS stream except for   the ClientHello message of the TLS protocol.   CertificateRef field is ignored in this mode. \n Support: Core"
+                          description: "Mode defines the TLS behavior for the TLS
+                            session initiated by the client. There are two possible
+                            modes: - Terminate: The TLS session between the downstream
+                            client   and the Gateway is terminated at the Gateway.
+                            This mode requires   certificateRef to be set. - Passthrough:
+                            The TLS session is NOT terminated by the Gateway. This
+                            \  implies that the Gateway can't decipher the TLS stream
+                            except for   the ClientHello message of the TLS protocol.
+                            \  CertificateRef field is ignored in this mode. \n Support:
+                            Core"
                           enum:
                           - Terminate
                           - Passthrough
@@ -209,16 +399,29 @@ spec:
                         options:
                           additionalProperties:
                             type: string
-                          description: "Options are a list of key/value pairs to give extended options to the provider. \n There variation among providers as to how ciphersuites are expressed. If there is a common subset for expressing ciphers then it will make sense to loft that as a core API construct. \n Support: Implementation-specific"
+                          description: "Options are a list of key/value pairs to give
+                            extended options to the provider. \n There variation among
+                            providers as to how ciphersuites are expressed. If there
+                            is a common subset for expressing ciphers then it will
+                            make sense to loft that as a core API construct. \n Support:
+                            Implementation-specific"
                           type: object
                         routeOverride:
                           default:
                             certificate: Deny
-                          description: "RouteOverride dictates if TLS settings can be configured via Routes or not. \n CertificateRef must be defined even if `routeOverride.certificate` is set to 'Allow' as it will be used as the default certificate for the listener. \n Support: Core"
+                          description: "RouteOverride dictates if TLS settings can
+                            be configured via Routes or not. \n CertificateRef must
+                            be defined even if `routeOverride.certificate` is set
+                            to 'Allow' as it will be used as the default certificate
+                            for the listener. \n Support: Core"
                           properties:
                             certificate:
                               default: Deny
-                              description: "Certificate dictates if TLS certificates can be configured via Routes. If set to 'Allow', a TLS certificate for a hostname defined in a Route takes precedence over the certificate defined in Gateway. \n Support: Core"
+                              description: "Certificate dictates if TLS certificates
+                                can be configured via Routes. If set to 'Allow', a
+                                TLS certificate for a hostname defined in a Route
+                                takes precedence over the certificate defined in Gateway.
+                                \n Support: Core"
                               enum:
                               - Allow
                               - Deny
@@ -248,9 +451,13 @@ spec:
             description: Status defines the current state of Gateway.
             properties:
               addresses:
-                description: "Addresses lists the IP addresses that have actually been bound to the Gateway. These addresses may differ from the addresses in the Spec, e.g. if the Gateway automatically assigns an address from a reserved pool. \n These addresses should all be of type \"IPAddress\"."
+                description: "Addresses lists the IP addresses that have actually
+                  been bound to the Gateway. These addresses may differ from the addresses
+                  in the Spec, e.g. if the Gateway automatically assigns an address
+                  from a reserved pool. \n These addresses should all be of type \"IPAddress\"."
                 items:
-                  description: GatewayAddress describes an address that can be bound to a Gateway.
+                  description: GatewayAddress describes an address that can be bound
+                    to a Gateway.
                   properties:
                     type:
                       default: IPAddress
@@ -260,7 +467,9 @@ spec:
                       - NamedAddress
                       type: string
                     value:
-                      description: "Value of the address. The validity of the values will depend on the type and support by the controller. \n Examples: `1.2.3.4`, `128::1`, `my-ip-address`."
+                      description: "Value of the address. The validity of the values
+                        will depend on the type and support by the controller. \n
+                        Examples: `1.2.3.4`, `128::1`, `my-ip-address`."
                       maxLength: 253
                       minLength: 1
                       type: string
@@ -276,25 +485,52 @@ spec:
                   reason: NotReconciled
                   status: "False"
                   type: Scheduled
-                description: "Conditions describe the current conditions of the Gateway. \n Implementations should prefer to express Gateway conditions using the `GatewayConditionType` and `GatewayConditionReason` constants so that operators and tools can converge on a common vocabulary to describe Gateway state. \n Known condition types are: \n * \"Scheduled\" * \"Ready\""
+                description: "Conditions describe the current conditions of the Gateway.
+                  \n Implementations should prefer to express Gateway conditions using
+                  the `GatewayConditionType` and `GatewayConditionReason` constants
+                  so that operators and tools can converge on a common vocabulary
+                  to describe Gateway state. \n Known condition types are: \n * \"Scheduled\"
+                  * \"Ready\""
                 items:
-                  description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions.  For example, type FooStatus struct{     // Represents the observations of a foo's current state.     // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\"     // +patchMergeKey=type     // +patchStrategy=merge     // +listType=map     // +listMapKey=type     Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n     // other fields }"
+                  description: "Condition contains details for one aspect of the current
+                    state of this API Resource. --- This struct is intended for direct
+                    use as an array at the field path .status.conditions.  For example,
+                    type FooStatus struct{     // Represents the observations of a
+                    foo's current state.     // Known .status.conditions.type are:
+                    \"Available\", \"Progressing\", and \"Degraded\"     // +patchMergeKey=type
+                    \    // +patchStrategy=merge     // +listType=map     // +listMapKey=type
+                    \    Conditions []metav1.Condition `json:\"conditions,omitempty\"
+                    patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
+                    \n     // other fields }"
                   properties:
                     lastTransitionTime:
-                      description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      description: lastTransitionTime is the last time the condition
+                        transitioned from one status to another. This should be when
+                        the underlying condition changed.  If that is not known, then
+                        using the time when the API field changed is acceptable.
                       format: date-time
                       type: string
                     message:
-                      description: message is a human readable message indicating details about the transition. This may be an empty string.
+                      description: message is a human readable message indicating
+                        details about the transition. This may be an empty string.
                       maxLength: 32768
                       type: string
                     observedGeneration:
-                      description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
+                      description: observedGeneration represents the .metadata.generation
+                        that the condition was set based upon. For instance, if .metadata.generation
+                        is currently 12, but the .status.conditions[x].observedGeneration
+                        is 9, the condition is out of date with respect to the current
+                        state of the instance.
                       format: int64
                       minimum: 0
                       type: integer
                     reason:
-                      description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
+                      description: reason contains a programmatic identifier indicating
+                        the reason for the condition's last transition. Producers
+                        of specific condition types may define expected values and
+                        meanings for this field, and whether the values are considered
+                        a guaranteed API. The value should be a CamelCase string.
+                        This field may not be empty.
                       maxLength: 1024
                       minLength: 1
                       pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
@@ -307,7 +543,11 @@ spec:
                       - Unknown
                       type: string
                     type:
-                      description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        --- Many .condition.type values are consistent across resources
+                        like Available, but because arbitrary conditions can be useful
+                        (see .node.status.conditions), the ability to deconflict is
+                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                       maxLength: 316
                       pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                       type: string
@@ -324,43 +564,75 @@ spec:
                 - type
                 x-kubernetes-list-type: map
               listeners:
-                description: Listeners provide status for each unique listener port defined in the Spec.
+                description: Listeners provide status for each unique listener port
+                  defined in the Spec.
                 items:
                   description: ListenerStatus is the status associated with a Listener.
                   properties:
                     conditions:
-                      description: Conditions describe the current condition of this listener.
+                      description: Conditions describe the current condition of this
+                        listener.
                       items:
-                        description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions.  For example, type FooStatus struct{     // Represents the observations of a foo's current state.     // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\"     // +patchMergeKey=type     // +patchStrategy=merge     // +listType=map     // +listMapKey=type     Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n     // other fields }"
+                        description: "Condition contains details for one aspect of
+                          the current state of this API Resource. --- This struct
+                          is intended for direct use as an array at the field path
+                          .status.conditions.  For example, type FooStatus struct{
+                          \    // Represents the observations of a foo's current state.
+                          \    // Known .status.conditions.type are: \"Available\",
+                          \"Progressing\", and \"Degraded\"     // +patchMergeKey=type
+                          \    // +patchStrategy=merge     // +listType=map     //
+                          +listMapKey=type     Conditions []metav1.Condition `json:\"conditions,omitempty\"
+                          patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
+                          \n     // other fields }"
                         properties:
                           lastTransitionTime:
-                            description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                            description: lastTransitionTime is the last time the condition
+                              transitioned from one status to another. This should
+                              be when the underlying condition changed.  If that is
+                              not known, then using the time when the API field changed
+                              is acceptable.
                             format: date-time
                             type: string
                           message:
-                            description: message is a human readable message indicating details about the transition. This may be an empty string.
+                            description: message is a human readable message indicating
+                              details about the transition. This may be an empty string.
                             maxLength: 32768
                             type: string
                           observedGeneration:
-                            description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
+                            description: observedGeneration represents the .metadata.generation
+                              that the condition was set based upon. For instance,
+                              if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration
+                              is 9, the condition is out of date with respect to the
+                              current state of the instance.
                             format: int64
                             minimum: 0
                             type: integer
                           reason:
-                            description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
+                            description: reason contains a programmatic identifier
+                              indicating the reason for the condition's last transition.
+                              Producers of specific condition types may define expected
+                              values and meanings for this field, and whether the
+                              values are considered a guaranteed API. The value should
+                              be a CamelCase string. This field may not be empty.
                             maxLength: 1024
                             minLength: 1
                             pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                             type: string
                           status:
-                            description: status of the condition, one of True, False, Unknown.
+                            description: status of the condition, one of True, False,
+                              Unknown.
                             enum:
                             - "True"
                             - "False"
                             - Unknown
                             type: string
                           type:
-                            description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                            description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                              --- Many .condition.type values are consistent across
+                              resources like Available, but because arbitrary conditions
+                              can be useful (see .node.status.conditions), the ability
+                              to deconflict is important. The regex it matches is
+                              (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                             maxLength: 316
                             pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                             type: string
@@ -377,18 +649,21 @@ spec:
                       - type
                       x-kubernetes-list-type: map
                     hostname:
-                      description: Hostname is the Listener hostname value for which this message is reporting the status.
+                      description: Hostname is the Listener hostname value for which
+                        this message is reporting the status.
                       maxLength: 253
                       minLength: 1
                       type: string
                     port:
-                      description: Port is the unique Listener port value for which this message is reporting the status.
+                      description: Port is the unique Listener port value for which
+                        this message is reporting the status.
                       format: int32
                       maximum: 65535
                       minimum: 1
                       type: integer
                     protocol:
-                      description: Protocol is the Listener protocol value for which this message is reporting the status.
+                      description: Protocol is the Listener protocol value for which
+                        this message is reporting the status.
                       type: string
                   required:
                   - conditions

docs/content/reference/dynamic-configuration/networking.x-k8s.io_httproutes.yaml

@@ -4,12 +4,14 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.4.1
+    controller-gen.kubebuilder.io/version: v0.5.0
   creationTimestamp: null
   name: httproutes.networking.x-k8s.io
 spec:
   group: networking.x-k8s.io
   names:
+    categories:
+    - gateway-api
     kind: HTTPRoute
     listKind: HTTPRouteList
     plural: httproutes
@@ -20,16 +22,23 @@ spec:
     - jsonPath: .spec.hostnames
       name: Hostnames
       type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
     name: v1alpha1
     schema:
       openAPIV3Schema:
         description: HTTPRoute is the Schema for the HTTPRoute resource.
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
             type: string
           metadata:
             type: object
@@ -43,16 +52,24 @@ spec:
                 properties:
                   allow:
                     default: SameNamespace
-                    description: 'Allow indicates which Gateways will be allowed to use this route. Possible values are: * All: Gateways in any namespace can use this route. * FromList: Only Gateways specified in GatewayRefs may use this route. * SameNamespace: Only Gateways in the same namespace may use this route.'
+                    description: 'Allow indicates which Gateways will be allowed to
+                      use this route. Possible values are: * All: Gateways in any
+                      namespace can use this route. * FromList: Only Gateways specified
+                      in GatewayRefs may use this route. * SameNamespace: Only Gateways
+                      in the same namespace may use this route.'
                     enum:
                     - All
                     - FromList
                     - SameNamespace
                     type: string
                   gatewayRefs:
-                    description: GatewayRefs must be specified when Allow is set to "FromList". In that case, only Gateways referenced in this list will be allowed to use this route. This field is ignored for other values of "Allow".
+                    description: GatewayRefs must be specified when Allow is set to
+                      "FromList". In that case, only Gateways referenced in this list
+                      will be allowed to use this route. This field is ignored for
+                      other values of "Allow".
                     items:
-                      description: GatewayReference identifies a Gateway in a specified namespace.
+                      description: GatewayReference identifies a Gateway in a specified
+                        namespace.
                       properties:
                         name:
                           description: Name is the name of the referent.
@@ -71,9 +88,29 @@ spec:
                     type: array
                 type: object
               hostnames:
-                description: "Hostnames defines a set of hostname that should match against the HTTP Host header to select a HTTPRoute to process the request. Hostname is the fully qualified domain name of a network host, as defined by RFC 3986. Note the following deviations from the \"host\" part of the URI as defined in the RFC: \n 1. IPs are not allowed. 2. The `:` delimiter is not respected because ports are not allowed. \n Incoming requests are matched against the hostnames before the HTTPRoute rules. If no hostname is specified, traffic is routed based on the HTTPRouteRules. \n Hostname can be \"precise\" which is a domain name without the terminating dot of a network host (e.g. \"foo.example.com\") or \"wildcard\", which is a domain name prefixed with a single wildcard label (e.g. `*.example.com`). The wildcard character `*` must appear by itself as the first DNS label and matches only a single label. You cannot have a wildcard label by itself (e.g. Host == `*`). Requests will be matched against the Host field in the following order: \n 1. If Host is precise, the request matches this rule if    the HTTP Host header is equal to Host. 2. If Host is a wildcard, then the request matches this rule if    the HTTP Host header is to equal to the suffix    (removing the first label) of the wildcard rule. \n Support: Core"
+                description: "Hostnames defines a set of hostname that should match
+                  against the HTTP Host header to select a HTTPRoute to process the
+                  request. Hostname is the fully qualified domain name of a network
+                  host, as defined by RFC 3986. Note the following deviations from
+                  the \"host\" part of the URI as defined in the RFC: \n 1. IPs are
+                  not allowed. 2. The `:` delimiter is not respected because ports
+                  are not allowed. \n Incoming requests are matched against the hostnames
+                  before the HTTPRoute rules. If no hostname is specified, traffic
+                  is routed based on the HTTPRouteRules. \n Hostname can be \"precise\"
+                  which is a domain name without the terminating dot of a network
+                  host (e.g. \"foo.example.com\") or \"wildcard\", which is a domain
+                  name prefixed with a single wildcard label (e.g. `*.example.com`).
+                  The wildcard character `*` must appear by itself as the first DNS
+                  label and matches only a single label. You cannot have a wildcard
+                  label by itself (e.g. Host == `*`). Requests will be matched against
+                  the Host field in the following order: \n 1. If Host is precise,
+                  the request matches this rule if    the HTTP Host header is equal
+                  to Host. 2. If Host is a wildcard, then the request matches this
+                  rule if    the HTTP Host header is to equal to the suffix    (removing
+                  the first label) of the wildcard rule. \n Support: Core"
                 items:
-                  description: Hostname is used to specify a hostname that should be matched.
+                  description: Hostname is used to specify a hostname that should
+                    be matched.
                   maxLength: 253
                   minLength: 1
                   type: string
@@ -87,15 +124,40 @@ spec:
                       value: /
                 description: Rules are a list of HTTP matchers, filters and actions.
                 items:
-                  description: HTTPRouteRule defines semantics for matching an HTTP request based on conditions, optionally executing additional processing steps, and forwarding the request to an API object.
+                  description: HTTPRouteRule defines semantics for matching an HTTP
+                    request based on conditions, optionally executing additional processing
+                    steps, and forwarding the request to an API object.
                   properties:
                     filters:
-                      description: "Filters define the filters that are applied to requests that match this rule. \n The effects of ordering of multiple behaviors are currently unspecified. This can change in the future based on feedback during the alpha stage. \n Conformance-levels at this level are defined based on the type of filter: \n - ALL core filters MUST be supported by all implementations. - Implementers are encouraged to support extended filters. - Implementation-specific custom filters have no API guarantees across   implementations. \n Specifying a core filter multiple times has unspecified or custom conformance. \n Support: Core"
+                      description: "Filters define the filters that are applied to
+                        requests that match this rule. \n The effects of ordering
+                        of multiple behaviors are currently unspecified. This can
+                        change in the future based on feedback during the alpha stage.
+                        \n Conformance-levels at this level are defined based on the
+                        type of filter: \n - ALL core filters MUST be supported by
+                        all implementations. - Implementers are encouraged to support
+                        extended filters. - Implementation-specific custom filters
+                        have no API guarantees across   implementations. \n Specifying
+                        a core filter multiple times has unspecified or custom conformance.
+                        \n Support: Core"
                       items:
-                        description: 'HTTPRouteFilter defines additional processing steps that must be completed during the request or response lifecycle. HTTPRouteFilters are meant as an extension point to express additional processing that may be done in Gateway implementations. Some examples include request or response modification, implementing authentication strategies, rate-limiting, and traffic shaping. API guarantee/conformance is defined based on the type of the filter. TODO(hbagdi): re-render CRDs once controller-tools supports union tags: - https://github.com/kubernetes-sigs/controller-tools/pull/298 - https://github.com/kubernetes-sigs/controller-tools/issues/461'
+                        description: 'HTTPRouteFilter defines additional processing
+                          steps that must be completed during the request or response
+                          lifecycle. HTTPRouteFilters are meant as an extension point
+                          to express additional processing that may be done in Gateway
+                          implementations. Some examples include request or response
+                          modification, implementing authentication strategies, rate-limiting,
+                          and traffic shaping. API guarantee/conformance is defined
+                          based on the type of the filter. TODO(hbagdi): re-render
+                          CRDs once controller-tools supports union tags: - https://github.com/kubernetes-sigs/controller-tools/pull/298
+                          - https://github.com/kubernetes-sigs/controller-tools/issues/461'
                         properties:
                           extensionRef:
-                            description: "ExtensionRef is an optional, implementation-specific extension to the \"filter\" behavior.  For example, resource \"myroutefilter\" in group \"networking.acme.io\"). ExtensionRef MUST NOT be used for core and extended filters. \n Support: Implementation-specific"
+                            description: "ExtensionRef is an optional, implementation-specific
+                              extension to the \"filter\" behavior.  For example,
+                              resource \"myroutefilter\" in group \"networking.acme.io\").
+                              ExtensionRef MUST NOT be used for core and extended
+                              filters. \n Support: Implementation-specific"
                             properties:
                               group:
                                 description: Group is the group of the referent.
@@ -118,15 +180,30 @@ spec:
                             - name
                             type: object
                           requestHeaderModifier:
-                            description: "RequestHeaderModifier defines a schema for a filter that modifies request headers. \n Support: Core"
+                            description: "RequestHeaderModifier defines a schema for
+                              a filter that modifies request headers. \n Support:
+                              Core"
                             properties:
                               add:
                                 additionalProperties:
                                   type: string
-                                description: "Add adds the given header (name, value) to the request before the action. It appends to any existing values associated with the header name. \n Input:   GET /foo HTTP/1.1   my-header: foo \n Config:   add: {\"my-header\": \"bar\"} \n Output:   GET /foo HTTP/1.1   my-header: foo   my-header: bar \n Support: Extended"
+                                description: "Add adds the given header (name, value)
+                                  to the request before the action. It appends to
+                                  any existing values associated with the header name.
+                                  \n Input:   GET /foo HTTP/1.1   my-header: foo \n
+                                  Config:   add: {\"my-header\": \"bar\"} \n Output:
+                                  \  GET /foo HTTP/1.1   my-header: foo   my-header:
+                                  bar \n Support: Extended"
                                 type: object
                               remove:
-                                description: "Remove the given header(s) from the HTTP request before the action. The value of RemoveHeader is a list of HTTP header names. Note that the header names are case-insensitive [RFC-2616 4.2]. \n Input:   GET /foo HTTP/1.1   my-header1: foo   my-header2: bar   my-header3: baz \n Config:   remove: [\"my-header1\", \"my-header3\"] \n Output:   GET /foo HTTP/1.1   my-header2: bar \n Support: Extended"
+                                description: "Remove the given header(s) from the
+                                  HTTP request before the action. The value of RemoveHeader
+                                  is a list of HTTP header names. Note that the header
+                                  names are case-insensitive [RFC-2616 4.2]. \n Input:
+                                  \  GET /foo HTTP/1.1   my-header1: foo   my-header2:
+                                  bar   my-header3: baz \n Config:   remove: [\"my-header1\",
+                                  \"my-header3\"] \n Output:   GET /foo HTTP/1.1   my-header2:
+                                  bar \n Support: Extended"
                                 items:
                                   type: string
                                 maxItems: 16
@@ -134,14 +211,28 @@ spec:
                               set:
                                 additionalProperties:
                                   type: string
-                                description: "Set overwrites the request with the given header (name, value) before the action. \n Input:   GET /foo HTTP/1.1   my-header: foo \n Config:   set: {\"my-header\": \"bar\"} \n Output:   GET /foo HTTP/1.1   my-header: bar \n Support: Extended"
+                                description: "Set overwrites the request with the
+                                  given header (name, value) before the action. \n
+                                  Input:   GET /foo HTTP/1.1   my-header: foo \n Config:
+                                  \  set: {\"my-header\": \"bar\"} \n Output:   GET
+                                  /foo HTTP/1.1   my-header: bar \n Support: Extended"
                                 type: object
                             type: object
                           requestMirror:
-                            description: "RequestMirror defines a schema for a filter that mirrors requests. \n Support: Extended"
+                            description: "RequestMirror defines a schema for a filter
+                              that mirrors requests. \n Support: Extended"
                             properties:
                               backendRef:
-                                description: "BackendRef is a local object reference to mirror matched requests to. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. \n If the referent cannot be found, the rule is not included in the route. The controller should raise the \"ResolvedRefs\" condition on the Gateway with the \"DegradedRoutes\" reason. The gateway status for this route should be updated with a condition that describes the error more specifically. \n Support: Custom"
+                                description: "BackendRef is a local object reference
+                                  to mirror matched requests to. If both BackendRef
+                                  and ServiceName are specified, ServiceName will
+                                  be given precedence. \n If the referent cannot be
+                                  found, the rule is not included in the route. The
+                                  controller should raise the \"ResolvedRefs\" condition
+                                  on the Gateway with the \"DegradedRoutes\" reason.
+                                  The gateway status for this route should be updated
+                                  with a condition that describes the error more specifically.
+                                  \n Support: Custom"
                                 properties:
                                   group:
                                     description: Group is the group of the referent.
@@ -164,18 +255,51 @@ spec:
                                 - name
                                 type: object
                               port:
-                                description: "Port specifies the destination port number to use for the backend referenced by the ServiceName or BackendRef field. \n If unspecified, the destination port in the request is used when forwarding to a backendRef or serviceName."
+                                description: "Port specifies the destination port
+                                  number to use for the backend referenced by the
+                                  ServiceName or BackendRef field. \n If unspecified,
+                                  the destination port in the request is used when
+                                  forwarding to a backendRef or serviceName."
                                 format: int32
                                 maximum: 65535
                                 minimum: 1
                                 type: integer
                               serviceName:
-                                description: "ServiceName refers to the name of the Service to mirror matched requests to. When specified, this takes the place of BackendRef. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. \n If the referent cannot be found, the rule is not included in the route. The controller should raise the \"ResolvedRefs\" condition on the Gateway with the \"DegradedRoutes\" reason. The gateway status for this route should be updated with a condition that describes the error more specifically. \n Support: Core"
+                                description: "ServiceName refers to the name of the
+                                  Service to mirror matched requests to. When specified,
+                                  this takes the place of BackendRef. If both BackendRef
+                                  and ServiceName are specified, ServiceName will
+                                  be given precedence. \n If the referent cannot be
+                                  found, the rule is not included in the route. The
+                                  controller should raise the \"ResolvedRefs\" condition
+                                  on the Gateway with the \"DegradedRoutes\" reason.
+                                  The gateway status for this route should be updated
+                                  with a condition that describes the error more specifically.
+                                  \n Support: Core"
                                 maxLength: 253
                                 type: string
                             type: object
                           type:
-                            description: "Type identifies the type of filter to apply. As with other API fields, types are classified into three conformance levels: \n - Core: Filter types and their corresponding configuration defined by   \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All   implementations must support core filters. \n - Extended: Filter types and their corresponding configuration defined by   \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers   are encouraged to support extended filters. \n - Custom: Filters that are defined and supported by specific vendors.   In the future, filters showing convergence in behavior across multiple   implementations will be considered for inclusion in extended or core   conformance levels. Filter-specific configuration for such filters   is specified using the ExtensionRef field. `Type` should be set to   \"ExtensionRef\" for custom filters. \n Implementers are encouraged to define custom implementation types to extend the core API with implementation-specific behavior."
+                            description: "Type identifies the type of filter to apply.
+                              As with other API fields, types are classified into
+                              three conformance levels: \n - Core: Filter types and
+                              their corresponding configuration defined by   \"Support:
+                              Core\" in this package, e.g. \"RequestHeaderModifier\".
+                              All   implementations must support core filters. \n
+                              - Extended: Filter types and their corresponding configuration
+                              defined by   \"Support: Extended\" in this package,
+                              e.g. \"RequestMirror\". Implementers   are encouraged
+                              to support extended filters. \n - Custom: Filters that
+                              are defined and supported by specific vendors.   In
+                              the future, filters showing convergence in behavior
+                              across multiple   implementations will be considered
+                              for inclusion in extended or core   conformance levels.
+                              Filter-specific configuration for such filters   is
+                              specified using the ExtensionRef field. `Type` should
+                              be set to   \"ExtensionRef\" for custom filters. \n
+                              Implementers are encouraged to define custom implementation
+                              types to extend the core API with implementation-specific
+                              behavior."
                             enum:
                             - RequestHeaderModifier
                             - RequestMirror
@@ -187,12 +311,25 @@ spec:
                       maxItems: 16
                       type: array
                     forwardTo:
-                      description: ForwardTo defines the backend(s) where matching requests should be sent. If unspecified, the rule performs no forwarding. If unspecified and no filters are specified that would result in a response being sent, a 503 error code is returned.
+                      description: ForwardTo defines the backend(s) where matching
+                        requests should be sent. If unspecified, the rule performs
+                        no forwarding. If unspecified and no filters are specified
+                        that would result in a response being sent, a 503 error code
+                        is returned.
                       items:
-                        description: HTTPRouteForwardTo defines how a HTTPRoute should forward a request.
+                        description: HTTPRouteForwardTo defines how a HTTPRoute should
+                          forward a request.
                         properties:
                           backendRef:
-                            description: "BackendRef is a reference to a backend to forward matched requests to. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. \n If the referent cannot be found, the route must be dropped from the Gateway. The controller should raise the \"ResolvedRefs\" condition on the Gateway with the \"DegradedRoutes\" reason. The gateway status for this route should be updated with a condition that describes the error more specifically. \n Support: Custom"
+                            description: "BackendRef is a reference to a backend to
+                              forward matched requests to. If both BackendRef and
+                              ServiceName are specified, ServiceName will be given
+                              precedence. \n If the referent cannot be found, the
+                              route must be dropped from the Gateway. The controller
+                              should raise the \"ResolvedRefs\" condition on the Gateway
+                              with the \"DegradedRoutes\" reason. The gateway status
+                              for this route should be updated with a condition that
+                              describes the error more specifically. \n Support: Custom"
                             properties:
                               group:
                                 description: Group is the group of the referent.
@@ -215,12 +352,31 @@ spec:
                             - name
                             type: object
                           filters:
-                            description: "Filters defined at this-level should be executed if and only if the request is being forwarded to the backend defined here. \n Support: Custom (For broader support of filters, use the Filters field in HTTPRouteRule.)"
+                            description: "Filters defined at this-level should be
+                              executed if and only if the request is being forwarded
+                              to the backend defined here. \n Support: Custom (For
+                              broader support of filters, use the Filters field in
+                              HTTPRouteRule.)"
                             items:
-                              description: 'HTTPRouteFilter defines additional processing steps that must be completed during the request or response lifecycle. HTTPRouteFilters are meant as an extension point to express additional processing that may be done in Gateway implementations. Some examples include request or response modification, implementing authentication strategies, rate-limiting, and traffic shaping. API guarantee/conformance is defined based on the type of the filter. TODO(hbagdi): re-render CRDs once controller-tools supports union tags: - https://github.com/kubernetes-sigs/controller-tools/pull/298 - https://github.com/kubernetes-sigs/controller-tools/issues/461'
+                              description: 'HTTPRouteFilter defines additional processing
+                                steps that must be completed during the request or
+                                response lifecycle. HTTPRouteFilters are meant as
+                                an extension point to express additional processing
+                                that may be done in Gateway implementations. Some
+                                examples include request or response modification,
+                                implementing authentication strategies, rate-limiting,
+                                and traffic shaping. API guarantee/conformance is
+                                defined based on the type of the filter. TODO(hbagdi):
+                                re-render CRDs once controller-tools supports union
+                                tags: - https://github.com/kubernetes-sigs/controller-tools/pull/298
+                                - https://github.com/kubernetes-sigs/controller-tools/issues/461'
                               properties:
                                 extensionRef:
-                                  description: "ExtensionRef is an optional, implementation-specific extension to the \"filter\" behavior.  For example, resource \"myroutefilter\" in group \"networking.acme.io\"). ExtensionRef MUST NOT be used for core and extended filters. \n Support: Implementation-specific"
+                                  description: "ExtensionRef is an optional, implementation-specific
+                                    extension to the \"filter\" behavior.  For example,
+                                    resource \"myroutefilter\" in group \"networking.acme.io\").
+                                    ExtensionRef MUST NOT be used for core and extended
+                                    filters. \n Support: Implementation-specific"
                                   properties:
                                     group:
                                       description: Group is the group of the referent.
@@ -243,15 +399,32 @@ spec:
                                   - name
                                   type: object
                                 requestHeaderModifier:
-                                  description: "RequestHeaderModifier defines a schema for a filter that modifies request headers. \n Support: Core"
+                                  description: "RequestHeaderModifier defines a schema
+                                    for a filter that modifies request headers. \n
+                                    Support: Core"
                                   properties:
                                     add:
                                       additionalProperties:
                                         type: string
-                                      description: "Add adds the given header (name, value) to the request before the action. It appends to any existing values associated with the header name. \n Input:   GET /foo HTTP/1.1   my-header: foo \n Config:   add: {\"my-header\": \"bar\"} \n Output:   GET /foo HTTP/1.1   my-header: foo   my-header: bar \n Support: Extended"
+                                      description: "Add adds the given header (name,
+                                        value) to the request before the action. It
+                                        appends to any existing values associated
+                                        with the header name. \n Input:   GET /foo
+                                        HTTP/1.1   my-header: foo \n Config:   add:
+                                        {\"my-header\": \"bar\"} \n Output:   GET
+                                        /foo HTTP/1.1   my-header: foo   my-header:
+                                        bar \n Support: Extended"
                                       type: object
                                     remove:
-                                      description: "Remove the given header(s) from the HTTP request before the action. The value of RemoveHeader is a list of HTTP header names. Note that the header names are case-insensitive [RFC-2616 4.2]. \n Input:   GET /foo HTTP/1.1   my-header1: foo   my-header2: bar   my-header3: baz \n Config:   remove: [\"my-header1\", \"my-header3\"] \n Output:   GET /foo HTTP/1.1   my-header2: bar \n Support: Extended"
+                                      description: "Remove the given header(s) from
+                                        the HTTP request before the action. The value
+                                        of RemoveHeader is a list of HTTP header names.
+                                        Note that the header names are case-insensitive
+                                        [RFC-2616 4.2]. \n Input:   GET /foo HTTP/1.1
+                                        \  my-header1: foo   my-header2: bar   my-header3:
+                                        baz \n Config:   remove: [\"my-header1\",
+                                        \"my-header3\"] \n Output:   GET /foo HTTP/1.1
+                                        \  my-header2: bar \n Support: Extended"
                                       items:
                                         type: string
                                       maxItems: 16
@@ -259,14 +432,30 @@ spec:
                                     set:
                                       additionalProperties:
                                         type: string
-                                      description: "Set overwrites the request with the given header (name, value) before the action. \n Input:   GET /foo HTTP/1.1   my-header: foo \n Config:   set: {\"my-header\": \"bar\"} \n Output:   GET /foo HTTP/1.1   my-header: bar \n Support: Extended"
+                                      description: "Set overwrites the request with
+                                        the given header (name, value) before the
+                                        action. \n Input:   GET /foo HTTP/1.1   my-header:
+                                        foo \n Config:   set: {\"my-header\": \"bar\"}
+                                        \n Output:   GET /foo HTTP/1.1   my-header:
+                                        bar \n Support: Extended"
                                       type: object
                                   type: object
                                 requestMirror:
-                                  description: "RequestMirror defines a schema for a filter that mirrors requests. \n Support: Extended"
+                                  description: "RequestMirror defines a schema for
+                                    a filter that mirrors requests. \n Support: Extended"
                                   properties:
                                     backendRef:
-                                      description: "BackendRef is a local object reference to mirror matched requests to. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. \n If the referent cannot be found, the rule is not included in the route. The controller should raise the \"ResolvedRefs\" condition on the Gateway with the \"DegradedRoutes\" reason. The gateway status for this route should be updated with a condition that describes the error more specifically. \n Support: Custom"
+                                      description: "BackendRef is a local object reference
+                                        to mirror matched requests to. If both BackendRef
+                                        and ServiceName are specified, ServiceName
+                                        will be given precedence. \n If the referent
+                                        cannot be found, the rule is not included
+                                        in the route. The controller should raise
+                                        the \"ResolvedRefs\" condition on the Gateway
+                                        with the \"DegradedRoutes\" reason. The gateway
+                                        status for this route should be updated with
+                                        a condition that describes the error more
+                                        specifically. \n Support: Custom"
                                       properties:
                                         group:
                                           description: Group is the group of the referent.
@@ -289,18 +478,54 @@ spec:
                                       - name
                                       type: object
                                     port:
-                                      description: "Port specifies the destination port number to use for the backend referenced by the ServiceName or BackendRef field. \n If unspecified, the destination port in the request is used when forwarding to a backendRef or serviceName."
+                                      description: "Port specifies the destination
+                                        port number to use for the backend referenced
+                                        by the ServiceName or BackendRef field. \n
+                                        If unspecified, the destination port in the
+                                        request is used when forwarding to a backendRef
+                                        or serviceName."
                                       format: int32
                                       maximum: 65535
                                       minimum: 1
                                       type: integer
                                     serviceName:
-                                      description: "ServiceName refers to the name of the Service to mirror matched requests to. When specified, this takes the place of BackendRef. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. \n If the referent cannot be found, the rule is not included in the route. The controller should raise the \"ResolvedRefs\" condition on the Gateway with the \"DegradedRoutes\" reason. The gateway status for this route should be updated with a condition that describes the error more specifically. \n Support: Core"
+                                      description: "ServiceName refers to the name
+                                        of the Service to mirror matched requests
+                                        to. When specified, this takes the place of
+                                        BackendRef. If both BackendRef and ServiceName
+                                        are specified, ServiceName will be given precedence.
+                                        \n If the referent cannot be found, the rule
+                                        is not included in the route. The controller
+                                        should raise the \"ResolvedRefs\" condition
+                                        on the Gateway with the \"DegradedRoutes\"
+                                        reason. The gateway status for this route
+                                        should be updated with a condition that describes
+                                        the error more specifically. \n Support: Core"
                                       maxLength: 253
                                       type: string
                                   type: object
                                 type:
-                                  description: "Type identifies the type of filter to apply. As with other API fields, types are classified into three conformance levels: \n - Core: Filter types and their corresponding configuration defined by   \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All   implementations must support core filters. \n - Extended: Filter types and their corresponding configuration defined by   \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers   are encouraged to support extended filters. \n - Custom: Filters that are defined and supported by specific vendors.   In the future, filters showing convergence in behavior across multiple   implementations will be considered for inclusion in extended or core   conformance levels. Filter-specific configuration for such filters   is specified using the ExtensionRef field. `Type` should be set to   \"ExtensionRef\" for custom filters. \n Implementers are encouraged to define custom implementation types to extend the core API with implementation-specific behavior."
+                                  description: "Type identifies the type of filter
+                                    to apply. As with other API fields, types are
+                                    classified into three conformance levels: \n -
+                                    Core: Filter types and their corresponding configuration
+                                    defined by   \"Support: Core\" in this package,
+                                    e.g. \"RequestHeaderModifier\". All   implementations
+                                    must support core filters. \n - Extended: Filter
+                                    types and their corresponding configuration defined
+                                    by   \"Support: Extended\" in this package, e.g.
+                                    \"RequestMirror\". Implementers   are encouraged
+                                    to support extended filters. \n - Custom: Filters
+                                    that are defined and supported by specific vendors.
+                                    \  In the future, filters showing convergence
+                                    in behavior across multiple   implementations
+                                    will be considered for inclusion in extended or
+                                    core   conformance levels. Filter-specific configuration
+                                    for such filters   is specified using the ExtensionRef
+                                    field. `Type` should be set to   \"ExtensionRef\"
+                                    for custom filters. \n Implementers are encouraged
+                                    to define custom implementation types to extend
+                                    the core API with implementation-specific behavior."
                                   enum:
                                   - RequestHeaderModifier
                                   - RequestMirror
@@ -312,18 +537,53 @@ spec:
                             maxItems: 16
                             type: array
                           port:
-                            description: "Port specifies the destination port number to use for the backend referenced by the ServiceName or BackendRef field. If unspecified, the destination port in the request is used when forwarding to a backendRef or serviceName. \n Support: Core"
+                            description: "Port specifies the destination port number
+                              to use for the backend referenced by the ServiceName
+                              or BackendRef field. If unspecified, the destination
+                              port in the request is used when forwarding to a backendRef
+                              or serviceName. \n Support: Core"
                             format: int32
                             maximum: 65535
                             minimum: 1
                             type: integer
                           serviceName:
-                            description: "ServiceName refers to the name of the Service to forward matched requests to. When specified, this takes the place of BackendRef. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. \n If the referent cannot be found, the route must be dropped from the Gateway. The controller should raise the \"ResolvedRefs\" condition on the Gateway with the \"DegradedRoutes\" reason. The gateway status for this route should be updated with a condition that describes the error more specifically. \n The protocol to use should be specified with the AppProtocol field on Service resources. This field was introduced in Kubernetes 1.18. If using an earlier version of Kubernetes, a `networking.x-k8s.io/app-protocol` annotation on the BackendPolicy resource may be used to define the protocol. If the AppProtocol field is available, this annotation should not be used. The AppProtocol field, when populated, takes precedence over the annotation in the BackendPolicy resource. For custom backends, it is encouraged to add a semantically-equivalent field in the Custom Resource Definition. \n Support: Core"
+                            description: "ServiceName refers to the name of the Service
+                              to forward matched requests to. When specified, this
+                              takes the place of BackendRef. If both BackendRef and
+                              ServiceName are specified, ServiceName will be given
+                              precedence. \n If the referent cannot be found, the
+                              route must be dropped from the Gateway. The controller
+                              should raise the \"ResolvedRefs\" condition on the Gateway
+                              with the \"DegradedRoutes\" reason. The gateway status
+                              for this route should be updated with a condition that
+                              describes the error more specifically. \n The protocol
+                              to use should be specified with the AppProtocol field
+                              on Service resources. This field was introduced in Kubernetes
+                              1.18. If using an earlier version of Kubernetes, a `networking.x-k8s.io/app-protocol`
+                              annotation on the BackendPolicy resource may be used
+                              to define the protocol. If the AppProtocol field is
+                              available, this annotation should not be used. The AppProtocol
+                              field, when populated, takes precedence over the annotation
+                              in the BackendPolicy resource. For custom backends,
+                              it is encouraged to add a semantically-equivalent field
+                              in the Custom Resource Definition. \n Support: Core"
                             maxLength: 253
                             type: string
                           weight:
                             default: 1
-                            description: "Weight specifies the proportion of HTTP requests forwarded to the backend referenced by the ServiceName or BackendRef field. This is computed as weight/(sum of all weights in this ForwardTo list). For non-zero values, there may be some epsilon from the exact proportion defined here depending on the precision an implementation supports. Weight is not a percentage and the sum of weights does not need to equal 100. \n If only one backend is specified and it has a weight greater than 0, 100% of the traffic is forwarded to that backend. If weight is set to 0, no traffic should be forwarded for this entry. If unspecified, weight defaults to 1. \n Support: Core"
+                            description: "Weight specifies the proportion of HTTP
+                              requests forwarded to the backend referenced by the
+                              ServiceName or BackendRef field. This is computed as
+                              weight/(sum of all weights in this ForwardTo list).
+                              For non-zero values, there may be some epsilon from
+                              the exact proportion defined here depending on the precision
+                              an implementation supports. Weight is not a percentage
+                              and the sum of weights does not need to equal 100. \n
+                              If only one backend is specified and it has a weight
+                              greater than 0, 100% of the traffic is forwarded to
+                              that backend. If weight is set to 0, no traffic should
+                              be forwarded for this entry. If unspecified, weight
+                              defaults to 1. \n Support: Core"
                             format: int32
                             maximum: 1000000
                             minimum: 0
@@ -336,12 +596,55 @@ spec:
                       - path:
                           type: Prefix
                           value: /
-                      description: "Matches define conditions used for matching the rule against incoming HTTP requests. Each match is independent, i.e. this rule will be matched if **any** one of the matches is satisfied. \n For example, take the following matches configuration: \n ``` matches: - path:     value: \"/foo\"   headers:     values:       version: \"2\" - path:     value: \"/v2/foo\" ``` \n For a request to match against this rule, a request should satisfy EITHER of the two conditions: \n - path prefixed with `/foo` AND contains the header `version: \"2\"` - path prefix of `/v2/foo` \n See the documentation for HTTPRouteMatch on how to specify multiple match conditions that should be ANDed together. \n If no matches are specified, the default is a prefix path match on \"/\", which has the effect of matching every HTTP request. \n A client request may match multiple HTTP route rules. Matching precedence MUST be determined in order of the following criteria, continuing on ties: \n * The longest matching hostname. * The longest matching path. * The largest number of header matches * The oldest Route based on creation timestamp. For example, a Route with   a creation timestamp of \"2020-09-08 01:02:03\" is given precedence over   a Route with a creation timestamp of \"2020-09-08 01:02:04\". * The Route appearing first in alphabetical order (namespace/name) for   example, foo/bar is given precedence over foo/baz."
+                      description: "Matches define conditions used for matching the
+                        rule against incoming HTTP requests. Each match is independent,
+                        i.e. this rule will be matched if **any** one of the matches
+                        is satisfied. \n For example, take the following matches configuration:
+                        \n ``` matches: - path:     value: \"/foo\"   headers:     values:
+                        \      version: \"2\" - path:     value: \"/v2/foo\" ``` \n
+                        For a request to match against this rule, a request should
+                        satisfy EITHER of the two conditions: \n - path prefixed with
+                        `/foo` AND contains the header `version: \"2\"` - path prefix
+                        of `/v2/foo` \n See the documentation for HTTPRouteMatch on
+                        how to specify multiple match conditions that should be ANDed
+                        together. \n If no matches are specified, the default is a
+                        prefix path match on \"/\", which has the effect of matching
+                        every HTTP request. \n Each client request MUST map to a maximum
+                        of one route rule. If a request matches multiple rules, matching
+                        precedence MUST be determined in order of the following criteria,
+                        continuing on ties: \n * The longest matching hostname. *
+                        The longest matching path. * The largest number of header
+                        matches. \n If ties still exist across multiple Routes, matching
+                        precedence MUST be determined in order of the following criteria,
+                        continuing on ties: \n * The oldest Route based on creation
+                        timestamp. For example, a Route with   a creation timestamp
+                        of \"2020-09-08 01:02:03\" is given precedence over   a Route
+                        with a creation timestamp of \"2020-09-08 01:02:04\". * The
+                        Route appearing first in alphabetical order by   \"<namespace>/<name>\".
+                        For example, foo/bar is given precedence over   foo/baz. \n
+                        If ties still exist within the Route that has been given precedence,
+                        matching precedence MUST be granted to the first matching
+                        rule meeting the above criteria."
                       items:
-                        description: "HTTPRouteMatch defines the predicate used to match requests to a given action. Multiple match types are ANDed together, i.e. the match will evaluate to true only if all conditions are satisfied. \n For example, the match below will match a HTTP request only if its path starts with `/foo` AND it contains the `version: \"1\"` header: \n ``` match:   path:     value: \"/foo\"   headers:     values:       version: \"1\" ```"
+                        description: "HTTPRouteMatch defines the predicate used to
+                          match requests to a given action. Multiple match types are
+                          ANDed together, i.e. the match will evaluate to true only
+                          if all conditions are satisfied. \n For example, the match
+                          below will match a HTTP request only if its path starts
+                          with `/foo` AND it contains the `version: \"1\"` header:
+                          \n ``` match:   path:     value: \"/foo\"   headers:     values:
+                          \      version: \"1\" ```"
                         properties:
                           extensionRef:
-                            description: "ExtensionRef is an optional, implementation-specific extension to the \"match\" behavior. For example, resource \"myroutematcher\" in group \"networking.acme.io\". If the referent cannot be found, the rule is not included in the route. The controller should raise the \"ResolvedRefs\" condition on the Gateway with the \"DegradedRoutes\" reason. The gateway status for this route should be updated with a condition that describes the error more specifically. \n Support: Custom"
+                            description: "ExtensionRef is an optional, implementation-specific
+                              extension to the \"match\" behavior. For example, resource
+                              \"myroutematcher\" in group \"networking.acme.io\".
+                              If the referent cannot be found, the rule is not included
+                              in the route. The controller should raise the \"ResolvedRefs\"
+                              condition on the Gateway with the \"DegradedRoutes\"
+                              reason. The gateway status for this route should be
+                              updated with a condition that describes the error more
+                              specifically. \n Support: Custom"
                             properties:
                               group:
                                 description: Group is the group of the referent.
@@ -368,7 +671,15 @@ spec:
                             properties:
                               type:
                                 default: Exact
-                                description: "Type specifies how to match against the value of the header. \n Support: Core (Exact) \n Support: Custom (RegularExpression, ImplementationSpecific) \n Since RegularExpression PathType has custom conformance, implementations can support POSIX, PCRE or any other dialects of regular expressions. Please read the implementation's documentation to determine the supported dialect. \n HTTP Header name matching MUST be case-insensitive (RFC 2616 - section 4.2)."
+                                description: "Type specifies how to match against
+                                  the value of the header. \n Support: Core (Exact)
+                                  \n Support: Custom (RegularExpression, ImplementationSpecific)
+                                  \n Since RegularExpression PathType has custom conformance,
+                                  implementations can support POSIX, PCRE or any other
+                                  dialects of regular expressions. Please read the
+                                  implementation's documentation to determine the
+                                  supported dialect. \n HTTP Header name matching
+                                  MUST be case-insensitive (RFC 2616 - section 4.2)."
                                 enum:
                                 - Exact
                                 - RegularExpression
@@ -377,7 +688,14 @@ spec:
                               values:
                                 additionalProperties:
                                   type: string
-                                description: "Values is a map of HTTP Headers to be matched. It MUST contain at least one entry. \n The HTTP header field name to match is the map key, and the value of the HTTP header is the map value. HTTP header field name matching MUST be case-insensitive. \n Multiple match values are ANDed together, meaning, a request must match all the specified headers to select the route."
+                                description: "Values is a map of HTTP Headers to be
+                                  matched. It MUST contain at least one entry. \n
+                                  The HTTP header field name to match is the map key,
+                                  and the value of the HTTP header is the map value.
+                                  HTTP header field name matching MUST be case-insensitive.
+                                  \n Multiple match values are ANDed together, meaning,
+                                  a request must match all the specified headers to
+                                  select the route."
                                 type: object
                             required:
                             - values
@@ -386,11 +704,20 @@ spec:
                             default:
                               type: Prefix
                               value: /
-                            description: Path specifies a HTTP request path matcher. If this field is not specified, a default prefix match on the "/" path is provided.
+                            description: Path specifies a HTTP request path matcher.
+                              If this field is not specified, a default prefix match
+                              on the "/" path is provided.
                             properties:
                               type:
                                 default: Prefix
-                                description: "Type specifies how to match against the path Value. \n Support: Core (Exact, Prefix) \n Support: Custom (RegularExpression, ImplementationSpecific) \n Since RegularExpression PathType has custom conformance, implementations can support POSIX, PCRE or any other dialects of regular expressions. Please read the implementation's documentation to determine the supported dialect."
+                                description: "Type specifies how to match against
+                                  the path Value. \n Support: Core (Exact, Prefix)
+                                  \n Support: Custom (RegularExpression, ImplementationSpecific)
+                                  \n Since RegularExpression PathType has custom conformance,
+                                  implementations can support POSIX, PCRE or any other
+                                  dialects of regular expressions. Please read the
+                                  implementation's documentation to determine the
+                                  supported dialect."
                                 enum:
                                 - Exact
                                 - Prefix
@@ -398,11 +725,46 @@ spec:
                                 - ImplementationSpecific
                                 type: string
                               value:
+                                default: /
                                 description: Value of the HTTP path to match against.
-                                minLength: 1
                                 type: string
+                            type: object
+                          queryParams:
+                            description: QueryParams specifies a HTTP query parameter
+                              matcher.
+                            properties:
+                              type:
+                                default: Exact
+                                description: "Type specifies how to match against
+                                  the value of the query parameter. \n Support: Extended
+                                  (Exact) \n Support: Custom (RegularExpression, ImplementationSpecific)
+                                  \n Since RegularExpression QueryParamMatchType has
+                                  custom conformance, implementations can support
+                                  POSIX, PCRE or any other dialects of regular expressions.
+                                  Please read the implementation's documentation to
+                                  determine the supported dialect."
+                                enum:
+                                - Exact
+                                - RegularExpression
+                                - ImplementationSpecific
+                                type: string
+                              values:
+                                additionalProperties:
+                                  type: string
+                                description: "Values is a map of HTTP query parameters
+                                  to be matched. It MUST contain at least one entry.
+                                  \n The query parameter name to match is the map
+                                  key, and the value of the query parameter is the
+                                  map value. \n Multiple match values are ANDed together,
+                                  meaning, a request must match all the specified
+                                  query parameters to select the route. \n HTTP query
+                                  parameter matching MUST be case-sensitive for both
+                                  keys and values. (See https://tools.ietf.org/html/rfc7230#section-2.7.3).
+                                  \n Note that the query parameter key MUST always
+                                  be an exact match by string comparison."
+                                type: object
                             required:
-                            - value
+                            - values
                             type: object
                         type: object
                       maxItems: 8
@@ -411,10 +773,31 @@ spec:
                 maxItems: 16
                 type: array
               tls:
-                description: "TLS defines the TLS certificate to use for Hostnames defined in this Route. This configuration only takes effect if the AllowRouteOverride field is set to true in the associated Gateway resource. \n Collisions can happen if multiple HTTPRoutes define a TLS certificate for the same hostname. In such a case, conflict resolution guiding principles apply, specifically, if hostnames are same and two different certificates are specified then the certificate in the oldest resource wins. \n Please note that HTTP Route-selection takes place after the TLS Handshake (ClientHello). Due to this, TLS certificate defined here will take precedence even if the request has the potential to match multiple routes (in case multiple HTTPRoutes share the same hostname). \n Support: Core"
+                description: "TLS defines the TLS certificate to use for Hostnames
+                  defined in this Route. This configuration only takes effect if the
+                  AllowRouteOverride field is set to true in the associated Gateway
+                  resource. \n Collisions can happen if multiple HTTPRoutes define
+                  a TLS certificate for the same hostname. In such a case, conflict
+                  resolution guiding principles apply, specifically, if hostnames
+                  are same and two different certificates are specified then the certificate
+                  in the oldest resource wins. \n Please note that HTTP Route-selection
+                  takes place after the TLS Handshake (ClientHello). Due to this,
+                  TLS certificate defined here will take precedence even if the request
+                  has the potential to match multiple routes (in case multiple HTTPRoutes
+                  share the same hostname). \n Support: Core"
                 properties:
                   certificateRef:
-                    description: "CertificateRef refers to a Kubernetes object that contains a TLS certificate and private key. This certificate MUST be used for TLS handshakes for the domain this RouteTLSConfig is associated with. If an entry in this list omits or specifies the empty string for both the group and kind, the resource defaults to \"secrets\". An implementation may support other resources (for example, resource \"mycertificates\" in group \"networking.acme.io\"). \n Support: Core (Kubernetes Secrets) \n Support: Implementation-specific (Other resource types)"
+                    description: "CertificateRef is a reference to a Kubernetes object
+                      that contains a TLS certificate and private key. This certificate
+                      is used to establish a TLS handshake for requests that match
+                      the hostname of the associated HTTPRoute. The referenced object
+                      MUST reside in the same namespace as HTTPRoute. \n This field
+                      is required when the TLS configuration mode of the associated
+                      Gateway listener is set to \"Passthrough\". \n CertificateRef
+                      can reference a standard Kubernetes resource, i.e. Secret, or
+                      an implementation-specific custom resource. \n Support: Core
+                      (Kubernetes Secrets) \n Support: Implementation-specific (Other
+                      resource types)"
                     properties:
                       group:
                         description: Group is the group of the referent.
@@ -444,43 +827,87 @@ spec:
             description: Status defines the current state of HTTPRoute.
             properties:
               gateways:
-                description: "Gateways is a list of Gateways that are associated with the route, and the status of the route with respect to each Gateway. When a Gateway selects this route, the controller that manages the Gateway must add an entry to this list when the controller first sees the route and should update the entry as appropriate when the route is modified. \n A maximum of 100 Gateways will be represented in this list. If this list is full, there may be additional Gateways using this Route that are not included in the list. An empty list means the route has not been admitted by any Gateway."
+                description: "Gateways is a list of Gateways that are associated with
+                  the route, and the status of the route with respect to each Gateway.
+                  When a Gateway selects this route, the controller that manages the
+                  Gateway must add an entry to this list when the controller first
+                  sees the route and should update the entry as appropriate when the
+                  route is modified. \n A maximum of 100 Gateways will be represented
+                  in this list. If this list is full, there may be additional Gateways
+                  using this Route that are not included in the list. An empty list
+                  means the route has not been admitted by any Gateway."
                 items:
-                  description: RouteGatewayStatus describes the status of a route with respect to an associated Gateway.
+                  description: RouteGatewayStatus describes the status of a route
+                    with respect to an associated Gateway.
                   properties:
                     conditions:
-                      description: Conditions describes the status of the route with respect to the Gateway. The "Admitted" condition must always be specified by controllers to indicate whether the route has been admitted or rejected by the Gateway, and why. Note that the route's availability is also subject to the Gateway's own status conditions and listener status.
+                      description: Conditions describes the status of the route with
+                        respect to the Gateway. The "Admitted" condition must always
+                        be specified by controllers to indicate whether the route
+                        has been admitted or rejected by the Gateway, and why. Note
+                        that the route's availability is also subject to the Gateway's
+                        own status conditions and listener status.
                       items:
-                        description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions.  For example, type FooStatus struct{     // Represents the observations of a foo's current state.     // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\"     // +patchMergeKey=type     // +patchStrategy=merge     // +listType=map     // +listMapKey=type     Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n     // other fields }"
+                        description: "Condition contains details for one aspect of
+                          the current state of this API Resource. --- This struct
+                          is intended for direct use as an array at the field path
+                          .status.conditions.  For example, type FooStatus struct{
+                          \    // Represents the observations of a foo's current state.
+                          \    // Known .status.conditions.type are: \"Available\",
+                          \"Progressing\", and \"Degraded\"     // +patchMergeKey=type
+                          \    // +patchStrategy=merge     // +listType=map     //
+                          +listMapKey=type     Conditions []metav1.Condition `json:\"conditions,omitempty\"
+                          patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
+                          \n     // other fields }"
                         properties:
                           lastTransitionTime:
-                            description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                            description: lastTransitionTime is the last time the condition
+                              transitioned from one status to another. This should
+                              be when the underlying condition changed.  If that is
+                              not known, then using the time when the API field changed
+                              is acceptable.
                             format: date-time
                             type: string
                           message:
-                            description: message is a human readable message indicating details about the transition. This may be an empty string.
+                            description: message is a human readable message indicating
+                              details about the transition. This may be an empty string.
                             maxLength: 32768
                             type: string
                           observedGeneration:
-                            description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
+                            description: observedGeneration represents the .metadata.generation
+                              that the condition was set based upon. For instance,
+                              if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration
+                              is 9, the condition is out of date with respect to the
+                              current state of the instance.
                             format: int64
                             minimum: 0
                             type: integer
                           reason:
-                            description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
+                            description: reason contains a programmatic identifier
+                              indicating the reason for the condition's last transition.
+                              Producers of specific condition types may define expected
+                              values and meanings for this field, and whether the
+                              values are considered a guaranteed API. The value should
+                              be a CamelCase string. This field may not be empty.
                             maxLength: 1024
                             minLength: 1
                             pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                             type: string
                           status:
-                            description: status of the condition, one of True, False, Unknown.
+                            description: status of the condition, one of True, False,
+                              Unknown.
                             enum:
                             - "True"
                             - "False"
                             - Unknown
                             type: string
                           type:
-                            description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                            description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                              --- Many .condition.type values are consistent across
+                              resources like Available, but because arbitrary conditions
+                              can be useful (see .node.status.conditions), the ability
+                              to deconflict is important. The regex it matches is
+                              (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                             maxLength: 316
                             pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                             type: string
@@ -497,8 +924,18 @@ spec:
                       - type
                       x-kubernetes-list-type: map
                     gatewayRef:
-                      description: GatewayRef is a reference to a Gateway object that is associated with the route.
+                      description: GatewayRef is a reference to a Gateway object that
+                        is associated with the route.
                       properties:
+                        controller:
+                          description: "Controller is a domain/path string that indicates
+                            the controller implementing the Gateway. This corresponds
+                            with the controller field on GatewayClass. \n Example:
+                            \"acme.io/gateway-controller\". \n The format of this
+                            field is DOMAIN \"/\" PATH, where DOMAIN and PATH are
+                            valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names)."
+                          maxLength: 253
+                          type: string
                         name:
                           description: Name is the name of the referent.
                           maxLength: 253

docs/content/reference/dynamic-configuration/networking.x-k8s.io_tcproutes.yaml

@@ -0,0 +1,401 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.5.0
+  creationTimestamp: null
+  name: tcproutes.networking.x-k8s.io
+spec:
+  group: networking.x-k8s.io
+  names:
+    categories:
+    - gateway-api
+    kind: TCPRoute
+    listKind: TCPRouteList
+    plural: tcproutes
+    singular: tcproute
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: TCPRoute is the Schema for the TCPRoute resource.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec defines the desired state of TCPRoute.
+            properties:
+              gateways:
+                default:
+                  allow: SameNamespace
+                description: Gateways defines which Gateways can use this Route.
+                properties:
+                  allow:
+                    default: SameNamespace
+                    description: 'Allow indicates which Gateways will be allowed to
+                      use this route. Possible values are: * All: Gateways in any
+                      namespace can use this route. * FromList: Only Gateways specified
+                      in GatewayRefs may use this route. * SameNamespace: Only Gateways
+                      in the same namespace may use this route.'
+                    enum:
+                    - All
+                    - FromList
+                    - SameNamespace
+                    type: string
+                  gatewayRefs:
+                    description: GatewayRefs must be specified when Allow is set to
+                      "FromList". In that case, only Gateways referenced in this list
+                      will be allowed to use this route. This field is ignored for
+                      other values of "Allow".
+                    items:
+                      description: GatewayReference identifies a Gateway in a specified
+                        namespace.
+                      properties:
+                        name:
+                          description: Name is the name of the referent.
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                        namespace:
+                          description: Namespace is the namespace of the referent.
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                      required:
+                      - name
+                      - namespace
+                      type: object
+                    type: array
+                type: object
+              rules:
+                description: Rules are a list of TCP matchers and actions.
+                items:
+                  description: TCPRouteRule is the configuration for a given rule.
+                  properties:
+                    forwardTo:
+                      description: ForwardTo defines the backend(s) where matching
+                        requests should be sent.
+                      items:
+                        description: RouteForwardTo defines how a Route should forward
+                          a request.
+                        properties:
+                          backendRef:
+                            description: "BackendRef is a reference to a backend to
+                              forward matched requests to. If both BackendRef and
+                              ServiceName are specified, ServiceName will be given
+                              precedence. \n If the referent cannot be found, the
+                              rule is not included in the route. The controller should
+                              raise the \"ResolvedRefs\" condition on the Gateway
+                              with the \"DegradedRoutes\" reason. The gateway status
+                              for this route should be updated with a condition that
+                              describes the error more specifically. \n Support: Custom"
+                            properties:
+                              group:
+                                description: Group is the group of the referent.
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                              kind:
+                                description: Kind is kind of the referent.
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                              name:
+                                description: Name is the name of the referent.
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                            required:
+                            - group
+                            - kind
+                            - name
+                            type: object
+                          port:
+                            description: "Port specifies the destination port number
+                              to use for the backend referenced by the ServiceName
+                              or BackendRef field. If unspecified, the destination
+                              port in the request is used when forwarding to a backendRef
+                              or serviceName. \n Support: Core"
+                            format: int32
+                            maximum: 65535
+                            minimum: 1
+                            type: integer
+                          serviceName:
+                            description: "ServiceName refers to the name of the Service
+                              to forward matched requests to. When specified, this
+                              takes the place of BackendRef. If both BackendRef and
+                              ServiceName are specified, ServiceName will be given
+                              precedence. \n If the referent cannot be found, the
+                              rule is not included in the route. The controller should
+                              raise the \"ResolvedRefs\" condition on the Gateway
+                              with the \"DegradedRoutes\" reason. The gateway status
+                              for this route should be updated with a condition that
+                              describes the error more specifically. \n The protocol
+                              to use is defined using AppProtocol field (introduced
+                              in Kubernetes 1.18) in the Service resource. In the
+                              absence of the AppProtocol field a `networking.x-k8s.io/app-protocol`
+                              annotation on the BackendPolicy resource may be used
+                              to define the protocol. If the AppProtocol field is
+                              available, this annotation should not be used. The AppProtocol
+                              field, when populated, takes precedence over the annotation
+                              in the BackendPolicy resource. For custom backends,
+                              it is encouraged to add a semantically-equivalent field
+                              in the Custom Resource Definition. \n Support: Core"
+                            maxLength: 253
+                            type: string
+                          weight:
+                            default: 1
+                            description: "Weight specifies the proportion of HTTP
+                              requests forwarded to the backend referenced by the
+                              ServiceName or BackendRef field. This is computed as
+                              weight/(sum of all weights in this ForwardTo list).
+                              For non-zero values, there may be some epsilon from
+                              the exact proportion defined here depending on the precision
+                              an implementation supports. Weight is not a percentage
+                              and the sum of weights does not need to equal 100. \n
+                              If only one backend is specified and it has a weight
+                              greater than 0, 100% of the traffic is forwarded to
+                              that backend. If weight is set to 0, no traffic should
+                              be forwarded for this entry. If unspecified, weight
+                              defaults to 1. \n Support: Extended"
+                            format: int32
+                            maximum: 1000000
+                            minimum: 0
+                            type: integer
+                        type: object
+                      maxItems: 16
+                      minItems: 1
+                      type: array
+                    matches:
+                      description: "Matches define conditions used for matching the
+                        rule against incoming TCP connections. Each match is independent,
+                        i.e. this rule will be matched if **any** one of the matches
+                        is satisfied. If unspecified (i.e. empty), this Rule will
+                        match all requests for the associated Listener. \n Each client
+                        request MUST map to a maximum of one route rule. If a request
+                        matches multiple rules, matching precedence MUST be determined
+                        in order of the following criteria, continuing on ties: \n
+                        * The most specific match specified by ExtensionRef. Each
+                        implementation   that supports ExtensionRef may have different
+                        ways of determining the   specificity of the referenced extension.
+                        \n If ties still exist across multiple Routes, matching precedence
+                        MUST be determined in order of the following criteria, continuing
+                        on ties: \n * The oldest Route based on creation timestamp.
+                        For example, a Route with   a creation timestamp of \"2020-09-08
+                        01:02:03\" is given precedence over   a Route with a creation
+                        timestamp of \"2020-09-08 01:02:04\". * The Route appearing
+                        first in alphabetical order by   \"<namespace>/<name>\". For
+                        example, foo/bar is given precedence over   foo/baz. \n If
+                        ties still exist within the Route that has been given precedence,
+                        matching precedence MUST be granted to the first matching
+                        rule meeting the above criteria."
+                      items:
+                        description: TCPRouteMatch defines the predicate used to match
+                          connections to a given action.
+                        properties:
+                          extensionRef:
+                            description: "ExtensionRef is an optional, implementation-specific
+                              extension to the \"match\" behavior.  For example, resource
+                              \"mytcproutematcher\" in group \"networking.acme.io\".
+                              If the referent cannot be found, the rule is not included
+                              in the route. The controller should raise the \"ResolvedRefs\"
+                              condition on the Gateway with the \"DegradedRoutes\"
+                              reason. The gateway status for this route should be
+                              updated with a condition that describes the error more
+                              specifically. \n Support: Custom"
+                            properties:
+                              group:
+                                description: Group is the group of the referent.
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                              kind:
+                                description: Kind is kind of the referent.
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                              name:
+                                description: Name is the name of the referent.
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                            required:
+                            - group
+                            - kind
+                            - name
+                            type: object
+                        type: object
+                      maxItems: 8
+                      type: array
+                  required:
+                  - forwardTo
+                  type: object
+                maxItems: 16
+                minItems: 1
+                type: array
+            required:
+            - rules
+            type: object
+          status:
+            description: Status defines the current state of TCPRoute.
+            properties:
+              gateways:
+                description: "Gateways is a list of Gateways that are associated with
+                  the route, and the status of the route with respect to each Gateway.
+                  When a Gateway selects this route, the controller that manages the
+                  Gateway must add an entry to this list when the controller first
+                  sees the route and should update the entry as appropriate when the
+                  route is modified. \n A maximum of 100 Gateways will be represented
+                  in this list. If this list is full, there may be additional Gateways
+                  using this Route that are not included in the list. An empty list
+                  means the route has not been admitted by any Gateway."
+                items:
+                  description: RouteGatewayStatus describes the status of a route
+                    with respect to an associated Gateway.
+                  properties:
+                    conditions:
+                      description: Conditions describes the status of the route with
+                        respect to the Gateway. The "Admitted" condition must always
+                        be specified by controllers to indicate whether the route
+                        has been admitted or rejected by the Gateway, and why. Note
+                        that the route's availability is also subject to the Gateway's
+                        own status conditions and listener status.
+                      items:
+                        description: "Condition contains details for one aspect of
+                          the current state of this API Resource. --- This struct
+                          is intended for direct use as an array at the field path
+                          .status.conditions.  For example, type FooStatus struct{
+                          \    // Represents the observations of a foo's current state.
+                          \    // Known .status.conditions.type are: \"Available\",
+                          \"Progressing\", and \"Degraded\"     // +patchMergeKey=type
+                          \    // +patchStrategy=merge     // +listType=map     //
+                          +listMapKey=type     Conditions []metav1.Condition `json:\"conditions,omitempty\"
+                          patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
+                          \n     // other fields }"
+                        properties:
+                          lastTransitionTime:
+                            description: lastTransitionTime is the last time the condition
+                              transitioned from one status to another. This should
+                              be when the underlying condition changed.  If that is
+                              not known, then using the time when the API field changed
+                              is acceptable.
+                            format: date-time
+                            type: string
+                          message:
+                            description: message is a human readable message indicating
+                              details about the transition. This may be an empty string.
+                            maxLength: 32768
+                            type: string
+                          observedGeneration:
+                            description: observedGeneration represents the .metadata.generation
+                              that the condition was set based upon. For instance,
+                              if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration
+                              is 9, the condition is out of date with respect to the
+                              current state of the instance.
+                            format: int64
+                            minimum: 0
+                            type: integer
+                          reason:
+                            description: reason contains a programmatic identifier
+                              indicating the reason for the condition's last transition.
+                              Producers of specific condition types may define expected
+                              values and meanings for this field, and whether the
+                              values are considered a guaranteed API. The value should
+                              be a CamelCase string. This field may not be empty.
+                            maxLength: 1024
+                            minLength: 1
+                            pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                            type: string
+                          status:
+                            description: status of the condition, one of True, False,
+                              Unknown.
+                            enum:
+                            - "True"
+                            - "False"
+                            - Unknown
+                            type: string
+                          type:
+                            description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                              --- Many .condition.type values are consistent across
+                              resources like Available, but because arbitrary conditions
+                              can be useful (see .node.status.conditions), the ability
+                              to deconflict is important. The regex it matches is
+                              (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                            maxLength: 316
+                            pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                            type: string
+                        required:
+                        - lastTransitionTime
+                        - message
+                        - reason
+                        - status
+                        - type
+                        type: object
+                      maxItems: 8
+                      type: array
+                      x-kubernetes-list-map-keys:
+                      - type
+                      x-kubernetes-list-type: map
+                    gatewayRef:
+                      description: GatewayRef is a reference to a Gateway object that
+                        is associated with the route.
+                      properties:
+                        controller:
+                          description: "Controller is a domain/path string that indicates
+                            the controller implementing the Gateway. This corresponds
+                            with the controller field on GatewayClass. \n Example:
+                            \"acme.io/gateway-controller\". \n The format of this
+                            field is DOMAIN \"/\" PATH, where DOMAIN and PATH are
+                            valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names)."
+                          maxLength: 253
+                          type: string
+                        name:
+                          description: Name is the name of the referent.
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                        namespace:
+                          description: Namespace is the namespace of the referent.
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                      required:
+                      - name
+                      - namespace
+                      type: object
+                  required:
+                  - gatewayRef
+                  type: object
+                maxItems: 100
+                type: array
+            required:
+            - gateways
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

docs/content/reference/dynamic-configuration/networking.x-k8s.io_tlsroutes.yaml

@@ -0,0 +1,437 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.5.0
+  creationTimestamp: null
+  name: tlsroutes.networking.x-k8s.io
+spec:
+  group: networking.x-k8s.io
+  names:
+    categories:
+    - gateway-api
+    kind: TLSRoute
+    listKind: TLSRouteList
+    plural: tlsroutes
+    singular: tlsroute
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: "The TLSRoute resource is similar to TCPRoute, but can be configured
+          to match against TLS-specific metadata. This allows more flexibility in
+          matching streams for a given TLS listener. \n If you need to forward traffic
+          to a single target for a TLS listener, you could choose to use a TCPRoute
+          with a TLS listener."
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec defines the desired state of TLSRoute.
+            properties:
+              gateways:
+                default:
+                  allow: SameNamespace
+                description: Gateways defines which Gateways can use this Route.
+                properties:
+                  allow:
+                    default: SameNamespace
+                    description: 'Allow indicates which Gateways will be allowed to
+                      use this route. Possible values are: * All: Gateways in any
+                      namespace can use this route. * FromList: Only Gateways specified
+                      in GatewayRefs may use this route. * SameNamespace: Only Gateways
+                      in the same namespace may use this route.'
+                    enum:
+                    - All
+                    - FromList
+                    - SameNamespace
+                    type: string
+                  gatewayRefs:
+                    description: GatewayRefs must be specified when Allow is set to
+                      "FromList". In that case, only Gateways referenced in this list
+                      will be allowed to use this route. This field is ignored for
+                      other values of "Allow".
+                    items:
+                      description: GatewayReference identifies a Gateway in a specified
+                        namespace.
+                      properties:
+                        name:
+                          description: Name is the name of the referent.
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                        namespace:
+                          description: Namespace is the namespace of the referent.
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                      required:
+                      - name
+                      - namespace
+                      type: object
+                    type: array
+                type: object
+              rules:
+                description: Rules are a list of TLS matchers and actions.
+                items:
+                  description: TLSRouteRule is the configuration for a given rule.
+                  properties:
+                    forwardTo:
+                      description: ForwardTo defines the backend(s) where matching
+                        requests should be sent.
+                      items:
+                        description: RouteForwardTo defines how a Route should forward
+                          a request.
+                        properties:
+                          backendRef:
+                            description: "BackendRef is a reference to a backend to
+                              forward matched requests to. If both BackendRef and
+                              ServiceName are specified, ServiceName will be given
+                              precedence. \n If the referent cannot be found, the
+                              rule is not included in the route. The controller should
+                              raise the \"ResolvedRefs\" condition on the Gateway
+                              with the \"DegradedRoutes\" reason. The gateway status
+                              for this route should be updated with a condition that
+                              describes the error more specifically. \n Support: Custom"
+                            properties:
+                              group:
+                                description: Group is the group of the referent.
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                              kind:
+                                description: Kind is kind of the referent.
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                              name:
+                                description: Name is the name of the referent.
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                            required:
+                            - group
+                            - kind
+                            - name
+                            type: object
+                          port:
+                            description: "Port specifies the destination port number
+                              to use for the backend referenced by the ServiceName
+                              or BackendRef field. If unspecified, the destination
+                              port in the request is used when forwarding to a backendRef
+                              or serviceName. \n Support: Core"
+                            format: int32
+                            maximum: 65535
+                            minimum: 1
+                            type: integer
+                          serviceName:
+                            description: "ServiceName refers to the name of the Service
+                              to forward matched requests to. When specified, this
+                              takes the place of BackendRef. If both BackendRef and
+                              ServiceName are specified, ServiceName will be given
+                              precedence. \n If the referent cannot be found, the
+                              rule is not included in the route. The controller should
+                              raise the \"ResolvedRefs\" condition on the Gateway
+                              with the \"DegradedRoutes\" reason. The gateway status
+                              for this route should be updated with a condition that
+                              describes the error more specifically. \n The protocol
+                              to use is defined using AppProtocol field (introduced
+                              in Kubernetes 1.18) in the Service resource. In the
+                              absence of the AppProtocol field a `networking.x-k8s.io/app-protocol`
+                              annotation on the BackendPolicy resource may be used
+                              to define the protocol. If the AppProtocol field is
+                              available, this annotation should not be used. The AppProtocol
+                              field, when populated, takes precedence over the annotation
+                              in the BackendPolicy resource. For custom backends,
+                              it is encouraged to add a semantically-equivalent field
+                              in the Custom Resource Definition. \n Support: Core"
+                            maxLength: 253
+                            type: string
+                          weight:
+                            default: 1
+                            description: "Weight specifies the proportion of HTTP
+                              requests forwarded to the backend referenced by the
+                              ServiceName or BackendRef field. This is computed as
+                              weight/(sum of all weights in this ForwardTo list).
+                              For non-zero values, there may be some epsilon from
+                              the exact proportion defined here depending on the precision
+                              an implementation supports. Weight is not a percentage
+                              and the sum of weights does not need to equal 100. \n
+                              If only one backend is specified and it has a weight
+                              greater than 0, 100% of the traffic is forwarded to
+                              that backend. If weight is set to 0, no traffic should
+                              be forwarded for this entry. If unspecified, weight
+                              defaults to 1. \n Support: Extended"
+                            format: int32
+                            maximum: 1000000
+                            minimum: 0
+                            type: integer
+                        type: object
+                      maxItems: 16
+                      minItems: 1
+                      type: array
+                    matches:
+                      description: "Matches define conditions used for matching the
+                        rule against incoming TLS connections. Each match is independent,
+                        i.e. this rule will be matched if **any** one of the matches
+                        is satisfied. If unspecified (i.e. empty), this Rule will
+                        match all requests for the associated Listener. \n Each client
+                        request MUST map to a maximum of one route rule. If a request
+                        matches multiple rules, matching precedence MUST be determined
+                        in order of the following criteria, continuing on ties: \n
+                        * The longest matching SNI. * The longest matching precise
+                        SNI (without a wildcard). This means that   \"b.example.com\"
+                        should be given precedence over \"*.example.com\". * The most
+                        specific match specified by ExtensionRef. Each implementation
+                        \  that supports ExtensionRef may have different ways of determining
+                        the   specificity of the referenced extension. \n If ties
+                        still exist across multiple Routes, matching precedence MUST
+                        be determined in order of the following criteria, continuing
+                        on ties: \n * The oldest Route based on creation timestamp.
+                        For example, a Route with   a creation timestamp of \"2020-09-08
+                        01:02:03\" is given precedence over   a Route with a creation
+                        timestamp of \"2020-09-08 01:02:04\". * The Route appearing
+                        first in alphabetical order by   \"<namespace>/<name>\". For
+                        example, foo/bar is given precedence over   foo/baz. \n If
+                        ties still exist within the Route that has been given precedence,
+                        matching precedence MUST be granted to the first matching
+                        rule meeting the above criteria."
+                      items:
+                        description: TLSRouteMatch defines the predicate used to match
+                          connections to a given action.
+                        properties:
+                          extensionRef:
+                            description: "ExtensionRef is an optional, implementation-specific
+                              extension to the \"match\" behavior.  For example, resource
+                              \"mytlsroutematcher\" in group \"networking.acme.io\".
+                              If the referent cannot be found, the rule is not included
+                              in the route. The controller should raise the \"ResolvedRefs\"
+                              condition on the Gateway with the \"DegradedRoutes\"
+                              reason. The gateway status for this route should be
+                              updated with a condition that describes the error more
+                              specifically. \n Support: Custom"
+                            properties:
+                              group:
+                                description: Group is the group of the referent.
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                              kind:
+                                description: Kind is kind of the referent.
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                              name:
+                                description: Name is the name of the referent.
+                                maxLength: 253
+                                minLength: 1
+                                type: string
+                            required:
+                            - group
+                            - kind
+                            - name
+                            type: object
+                          snis:
+                            description: "SNIs defines a set of SNI names that should
+                              match against the SNI attribute of TLS ClientHello message
+                              in TLS handshake. \n SNI can be \"precise\" which is
+                              a domain name without the terminating dot of a network
+                              host (e.g. \"foo.example.com\") or \"wildcard\", which
+                              is a domain name prefixed with a single wildcard label
+                              (e.g. `*.example.com`). The wildcard character `*` must
+                              appear by itself as the first DNS label and matches
+                              only a single label. You cannot have a wildcard label
+                              by itself (e.g. Host == `*`). \n Requests will be matched
+                              against the Host field in the following order: \n 1.
+                              If SNI is precise, the request matches this rule if
+                              the SNI in    ClientHello is equal to one of the defined
+                              SNIs. 2. If SNI is a wildcard, then the request matches
+                              this rule if the    SNI is to equal to the suffix (removing
+                              the first label) of the    wildcard rule. 3. If SNIs
+                              is unspecified, all requests associated with the gateway
+                              TLS    listener will match. This can be used to define
+                              a default backend    for a TLS listener. \n Support:
+                              Core"
+                            items:
+                              description: Hostname is used to specify a hostname
+                                that should be matched.
+                              maxLength: 253
+                              minLength: 1
+                              type: string
+                            maxItems: 16
+                            type: array
+                        type: object
+                      maxItems: 8
+                      type: array
+                  required:
+                  - forwardTo
+                  type: object
+                maxItems: 16
+                minItems: 1
+                type: array
+            required:
+            - rules
+            type: object
+          status:
+            description: Status defines the current state of TLSRoute.
+            properties:
+              gateways:
+                description: "Gateways is a list of Gateways that are associated with
+                  the route, and the status of the route with respect to each Gateway.
+                  When a Gateway selects this route, the controller that manages the
+                  Gateway must add an entry to this list when the controller first
+                  sees the route and should update the entry as appropriate when the
+                  route is modified. \n A maximum of 100 Gateways will be represented
+                  in this list. If this list is full, there may be additional Gateways
+                  using this Route that are not included in the list. An empty list
+                  means the route has not been admitted by any Gateway."
+                items:
+                  description: RouteGatewayStatus describes the status of a route
+                    with respect to an associated Gateway.
+                  properties:
+                    conditions:
+                      description: Conditions describes the status of the route with
+                        respect to the Gateway. The "Admitted" condition must always
+                        be specified by controllers to indicate whether the route
+                        has been admitted or rejected by the Gateway, and why. Note
+                        that the route's availability is also subject to the Gateway's
+                        own status conditions and listener status.
+                      items:
+                        description: "Condition contains details for one aspect of
+                          the current state of this API Resource. --- This struct
+                          is intended for direct use as an array at the field path
+                          .status.conditions.  For example, type FooStatus struct{
+                          \    // Represents the observations of a foo's current state.
+                          \    // Known .status.conditions.type are: \"Available\",
+                          \"Progressing\", and \"Degraded\"     // +patchMergeKey=type
+                          \    // +patchStrategy=merge     // +listType=map     //
+                          +listMapKey=type     Conditions []metav1.Condition `json:\"conditions,omitempty\"
+                          patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
+                          \n     // other fields }"
+                        properties:
+                          lastTransitionTime:
+                            description: lastTransitionTime is the last time the condition
+                              transitioned from one status to another. This should
+                              be when the underlying condition changed.  If that is
+                              not known, then using the time when the API field changed
+                              is acceptable.
+                            format: date-time
+                            type: string
+                          message:
+                            description: message is a human readable message indicating
+                              details about the transition. This may be an empty string.
+                            maxLength: 32768
+                            type: string
+                          observedGeneration:
+                            description: observedGeneration represents the .metadata.generation
+                              that the condition was set based upon. For instance,
+                              if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration
+                              is 9, the condition is out of date with respect to the
+                              current state of the instance.
+                            format: int64
+                            minimum: 0
+                            type: integer
+                          reason:
+                            description: reason contains a programmatic identifier
+                              indicating the reason for the condition's last transition.
+                              Producers of specific condition types may define expected
+                              values and meanings for this field, and whether the
+                              values are considered a guaranteed API. The value should
+                              be a CamelCase string. This field may not be empty.
+                            maxLength: 1024
+                            minLength: 1
+                            pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                            type: string
+                          status:
+                            description: status of the condition, one of True, False,
+                              Unknown.
+                            enum:
+                            - "True"
+                            - "False"
+                            - Unknown
+                            type: string
+                          type:
+                            description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                              --- Many .condition.type values are consistent across
+                              resources like Available, but because arbitrary conditions
+                              can be useful (see .node.status.conditions), the ability
+                              to deconflict is important. The regex it matches is
+                              (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                            maxLength: 316
+                            pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                            type: string
+                        required:
+                        - lastTransitionTime
+                        - message
+                        - reason
+                        - status
+                        - type
+                        type: object
+                      maxItems: 8
+                      type: array
+                      x-kubernetes-list-map-keys:
+                      - type
+                      x-kubernetes-list-type: map
+                    gatewayRef:
+                      description: GatewayRef is a reference to a Gateway object that
+                        is associated with the route.
+                      properties:
+                        controller:
+                          description: "Controller is a domain/path string that indicates
+                            the controller implementing the Gateway. This corresponds
+                            with the controller field on GatewayClass. \n Example:
+                            \"acme.io/gateway-controller\". \n The format of this
+                            field is DOMAIN \"/\" PATH, where DOMAIN and PATH are
+                            valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names)."
+                          maxLength: 253
+                          type: string
+                        name:
+                          description: Name is the name of the referent.
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                        namespace:
+                          description: Namespace is the namespace of the referent.
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                      required:
+                      - name
+                      - namespace
+                      type: object
+                  required:
+                  - gatewayRef
+                  type: object
+                maxItems: 100
+                type: array
+            required:
+            - gateways
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_ingressroutes.yaml

@@ -0,0 +1,198 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.1
+  creationTimestamp: null
+  name: ingressroutes.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: IngressRoute
+    listKind: IngressRouteList
+    plural: ingressroutes
+    singular: ingressroute
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: IngressRoute is an Ingress CRD specification.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: IngressRouteSpec is a specification for a IngressRouteSpec
+              resource.
+            properties:
+              entryPoints:
+                items:
+                  type: string
+                type: array
+              routes:
+                items:
+                  description: Route contains the set of routes.
+                  properties:
+                    kind:
+                      enum:
+                      - Rule
+                      type: string
+                    match:
+                      type: string
+                    middlewares:
+                      items:
+                        description: MiddlewareRef is a ref to the Middleware resources.
+                        properties:
+                          name:
+                            type: string
+                          namespace:
+                            type: string
+                        required:
+                        - name
+                        type: object
+                      type: array
+                    priority:
+                      type: integer
+                    services:
+                      items:
+                        description: Service defines an upstream to proxy traffic.
+                        properties:
+                          kind:
+                            enum:
+                            - Service
+                            - TraefikService
+                            type: string
+                          name:
+                            description: Name is a reference to a Kubernetes Service
+                              object (for a load-balancer of servers), or to a TraefikService
+                              object (service load-balancer, mirroring, etc). The
+                              differentiation between the two is specified in the
+                              Kind field.
+                            type: string
+                          namespace:
+                            type: string
+                          passHostHeader:
+                            type: boolean
+                          port:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            x-kubernetes-int-or-string: true
+                          responseForwarding:
+                            description: ResponseForwarding holds configuration for
+                              the forward of the response.
+                            properties:
+                              flushInterval:
+                                type: string
+                            type: object
+                          scheme:
+                            type: string
+                          serversTransport:
+                            type: string
+                          sticky:
+                            description: Sticky holds the sticky configuration.
+                            properties:
+                              cookie:
+                                description: Cookie holds the sticky configuration
+                                  based on cookie.
+                                properties:
+                                  httpOnly:
+                                    type: boolean
+                                  name:
+                                    type: string
+                                  sameSite:
+                                    type: string
+                                  secure:
+                                    type: boolean
+                                type: object
+                            type: object
+                          strategy:
+                            type: string
+                          weight:
+                            description: Weight should only be specified when Name
+                              references a TraefikService object (and to be precise,
+                              one that embeds a Weighted Round Robin).
+                            type: integer
+                        required:
+                        - name
+                        type: object
+                      type: array
+                  required:
+                  - kind
+                  - match
+                  type: object
+                type: array
+              tls:
+                description: "TLS contains the TLS certificates configuration of the
+                  routes. To enable Let's Encrypt, use an empty TLS struct, e.g. in
+                  YAML: \n \t tls: {} # inline format \n \t tls: \t   secretName:
+                  # block format"
+                properties:
+                  certResolver:
+                    type: string
+                  domains:
+                    items:
+                      description: Domain holds a domain name with SANs.
+                      properties:
+                        main:
+                          type: string
+                        sans:
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    type: array
+                  options:
+                    description: Options is a reference to a TLSOption, that specifies
+                      the parameters of the TLS connection.
+                    properties:
+                      name:
+                        type: string
+                      namespace:
+                        type: string
+                    required:
+                    - name
+                    type: object
+                  secretName:
+                    description: SecretName is the name of the referenced Kubernetes
+                      Secret to specify the certificate details.
+                    type: string
+                  store:
+                    description: Store is a reference to a TLSStore, that specifies
+                      the parameters of the TLS store.
+                    properties:
+                      name:
+                        type: string
+                      namespace:
+                        type: string
+                    required:
+                    - name
+                    type: object
+                type: object
+            required:
+            - routes
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_ingressroutetcps.yaml

@@ -0,0 +1,160 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.1
+  creationTimestamp: null
+  name: ingressroutetcps.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: IngressRouteTCP
+    listKind: IngressRouteTCPList
+    plural: ingressroutetcps
+    singular: ingressroutetcp
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: IngressRouteTCP is an Ingress CRD specification.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: IngressRouteTCPSpec is a specification for a IngressRouteTCPSpec
+              resource.
+            properties:
+              entryPoints:
+                items:
+                  type: string
+                type: array
+              routes:
+                items:
+                  description: RouteTCP contains the set of routes.
+                  properties:
+                    match:
+                      type: string
+                    middlewares:
+                      description: Middlewares contains references to MiddlewareTCP
+                        resources.
+                      items:
+                        description: ObjectReference is a generic reference to a Traefik
+                          resource.
+                        properties:
+                          name:
+                            type: string
+                          namespace:
+                            type: string
+                        required:
+                        - name
+                        type: object
+                      type: array
+                    services:
+                      items:
+                        description: ServiceTCP defines an upstream to proxy traffic.
+                        properties:
+                          name:
+                            type: string
+                          namespace:
+                            type: string
+                          port:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            x-kubernetes-int-or-string: true
+                          proxyProtocol:
+                            description: ProxyProtocol holds the ProxyProtocol configuration.
+                            properties:
+                              version:
+                                type: integer
+                            type: object
+                          terminationDelay:
+                            type: integer
+                          weight:
+                            type: integer
+                        required:
+                        - name
+                        - port
+                        type: object
+                      type: array
+                  required:
+                  - match
+                  type: object
+                type: array
+              tls:
+                description: "TLSTCP contains the TLS certificates configuration of
+                  the routes. To enable Let's Encrypt, use an empty TLS struct, e.g.
+                  in YAML: \n \t tls: {} # inline format \n \t tls: \t   secretName:
+                  # block format"
+                properties:
+                  certResolver:
+                    type: string
+                  domains:
+                    items:
+                      description: Domain holds a domain name with SANs.
+                      properties:
+                        main:
+                          type: string
+                        sans:
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    type: array
+                  options:
+                    description: Options is a reference to a TLSOption, that specifies
+                      the parameters of the TLS connection.
+                    properties:
+                      name:
+                        type: string
+                      namespace:
+                        type: string
+                    required:
+                    - name
+                    type: object
+                  passthrough:
+                    type: boolean
+                  secretName:
+                    description: SecretName is the name of the referenced Kubernetes
+                      Secret to specify the certificate details.
+                    type: string
+                  store:
+                    description: Store is a reference to a TLSStore, that specifies
+                      the parameters of the TLS store.
+                    properties:
+                      name:
+                        type: string
+                      namespace:
+                        type: string
+                    required:
+                    - name
+                    type: object
+                type: object
+            required:
+            - routes
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_ingressrouteudps.yaml

@@ -0,0 +1,84 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.1
+  creationTimestamp: null
+  name: ingressrouteudps.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: IngressRouteUDP
+    listKind: IngressRouteUDPList
+    plural: ingressrouteudps
+    singular: ingressrouteudp
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: IngressRouteUDP is an Ingress CRD specification.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: IngressRouteUDPSpec is a specification for a IngressRouteUDPSpec
+              resource.
+            properties:
+              entryPoints:
+                items:
+                  type: string
+                type: array
+              routes:
+                items:
+                  description: RouteUDP contains the set of routes.
+                  properties:
+                    services:
+                      items:
+                        description: ServiceUDP defines an upstream to proxy traffic.
+                        properties:
+                          name:
+                            type: string
+                          namespace:
+                            type: string
+                          port:
+                            anyOf:
+                            - type: integer
+                            - type: string
+                            x-kubernetes-int-or-string: true
+                          weight:
+                            type: integer
+                        required:
+                        - name
+                        - port
+                        type: object
+                      type: array
+                  type: object
+                type: array
+            required:
+            - routes
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_middlewares.yaml

@@ -0,0 +1,566 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.1
+  creationTimestamp: null
+  name: middlewares.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: Middleware
+    listKind: MiddlewareList
+    plural: middlewares
+    singular: middleware
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Middleware is a specification for a Middleware resource.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: MiddlewareSpec holds the Middleware configuration.
+            properties:
+              addPrefix:
+                description: AddPrefix holds the AddPrefix configuration.
+                properties:
+                  prefix:
+                    type: string
+                type: object
+              basicAuth:
+                description: BasicAuth holds the HTTP basic authentication configuration.
+                properties:
+                  headerField:
+                    type: string
+                  realm:
+                    type: string
+                  removeHeader:
+                    type: boolean
+                  secret:
+                    type: string
+                type: object
+              buffering:
+                description: Buffering holds the request/response buffering configuration.
+                properties:
+                  maxRequestBodyBytes:
+                    format: int64
+                    type: integer
+                  maxResponseBodyBytes:
+                    format: int64
+                    type: integer
+                  memRequestBodyBytes:
+                    format: int64
+                    type: integer
+                  memResponseBodyBytes:
+                    format: int64
+                    type: integer
+                  retryExpression:
+                    type: string
+                type: object
+              chain:
+                description: Chain holds a chain of middlewares.
+                properties:
+                  middlewares:
+                    items:
+                      description: MiddlewareRef is a ref to the Middleware resources.
+                      properties:
+                        name:
+                          type: string
+                        namespace:
+                          type: string
+                      required:
+                      - name
+                      type: object
+                    type: array
+                type: object
+              circuitBreaker:
+                description: CircuitBreaker holds the circuit breaker configuration.
+                properties:
+                  expression:
+                    type: string
+                type: object
+              compress:
+                description: Compress holds the compress configuration.
+                properties:
+                  excludedContentTypes:
+                    items:
+                      type: string
+                    type: array
+                type: object
+              contentType:
+                description: ContentType middleware - or rather its unique `autoDetect`
+                  option - specifies whether to let the `Content-Type` header, if
+                  it has not been set by the backend, be automatically set to a value
+                  derived from the contents of the response. As a proxy, the default
+                  behavior should be to leave the header alone, regardless of what
+                  the backend did with it. However, the historic default was to always
+                  auto-detect and set the header if it was nil, and it is going to
+                  be kept that way in order to support users currently relying on
+                  it. This middleware exists to enable the correct behavior until
+                  at least the default one can be changed in a future version.
+                properties:
+                  autoDetect:
+                    type: boolean
+                type: object
+              digestAuth:
+                description: DigestAuth holds the Digest HTTP authentication configuration.
+                properties:
+                  headerField:
+                    type: string
+                  realm:
+                    type: string
+                  removeHeader:
+                    type: boolean
+                  secret:
+                    type: string
+                type: object
+              errors:
+                description: ErrorPage holds the custom error page configuration.
+                properties:
+                  query:
+                    type: string
+                  service:
+                    description: Service defines an upstream to proxy traffic.
+                    properties:
+                      kind:
+                        enum:
+                        - Service
+                        - TraefikService
+                        type: string
+                      name:
+                        description: Name is a reference to a Kubernetes Service object
+                          (for a load-balancer of servers), or to a TraefikService
+                          object (service load-balancer, mirroring, etc). The differentiation
+                          between the two is specified in the Kind field.
+                        type: string
+                      namespace:
+                        type: string
+                      passHostHeader:
+                        type: boolean
+                      port:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        x-kubernetes-int-or-string: true
+                      responseForwarding:
+                        description: ResponseForwarding holds configuration for the
+                          forward of the response.
+                        properties:
+                          flushInterval:
+                            type: string
+                        type: object
+                      scheme:
+                        type: string
+                      serversTransport:
+                        type: string
+                      sticky:
+                        description: Sticky holds the sticky configuration.
+                        properties:
+                          cookie:
+                            description: Cookie holds the sticky configuration based
+                              on cookie.
+                            properties:
+                              httpOnly:
+                                type: boolean
+                              name:
+                                type: string
+                              sameSite:
+                                type: string
+                              secure:
+                                type: boolean
+                            type: object
+                        type: object
+                      strategy:
+                        type: string
+                      weight:
+                        description: Weight should only be specified when Name references
+                          a TraefikService object (and to be precise, one that embeds
+                          a Weighted Round Robin).
+                        type: integer
+                    required:
+                    - name
+                    type: object
+                  status:
+                    items:
+                      type: string
+                    type: array
+                type: object
+              forwardAuth:
+                description: ForwardAuth holds the http forward authentication configuration.
+                properties:
+                  address:
+                    type: string
+                  authRequestHeaders:
+                    items:
+                      type: string
+                    type: array
+                  authResponseHeaders:
+                    items:
+                      type: string
+                    type: array
+                  authResponseHeadersRegex:
+                    type: string
+                  tls:
+                    description: ClientTLS holds TLS specific configurations as client.
+                    properties:
+                      caOptional:
+                        type: boolean
+                      caSecret:
+                        type: string
+                      certSecret:
+                        type: string
+                      insecureSkipVerify:
+                        type: boolean
+                    type: object
+                  trustForwardHeader:
+                    type: boolean
+                type: object
+              headers:
+                description: Headers holds the custom header configuration.
+                properties:
+                  accessControlAllowCredentials:
+                    description: AccessControlAllowCredentials is only valid if true.
+                      false is ignored.
+                    type: boolean
+                  accessControlAllowHeaders:
+                    description: AccessControlAllowHeaders must be used in response
+                      to a preflight request with Access-Control-Request-Headers set.
+                    items:
+                      type: string
+                    type: array
+                  accessControlAllowMethods:
+                    description: AccessControlAllowMethods must be used in response
+                      to a preflight request with Access-Control-Request-Method set.
+                    items:
+                      type: string
+                    type: array
+                  accessControlAllowOriginList:
+                    description: AccessControlAllowOriginList is a list of allowable
+                      origins. Can also be a wildcard origin "*".
+                    items:
+                      type: string
+                    type: array
+                  accessControlAllowOriginListRegex:
+                    description: AccessControlAllowOriginListRegex is a list of allowable
+                      origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).
+                    items:
+                      type: string
+                    type: array
+                  accessControlExposeHeaders:
+                    description: AccessControlExposeHeaders sets valid headers for
+                      the response.
+                    items:
+                      type: string
+                    type: array
+                  accessControlMaxAge:
+                    description: AccessControlMaxAge sets the time that a preflight
+                      request may be cached.
+                    format: int64
+                    type: integer
+                  addVaryHeader:
+                    description: AddVaryHeader controls if the Vary header is automatically
+                      added/updated when the AccessControlAllowOriginList is set.
+                    type: boolean
+                  allowedHosts:
+                    items:
+                      type: string
+                    type: array
+                  browserXssFilter:
+                    type: boolean
+                  contentSecurityPolicy:
+                    type: string
+                  contentTypeNosniff:
+                    type: boolean
+                  customBrowserXSSValue:
+                    type: string
+                  customFrameOptionsValue:
+                    type: string
+                  customRequestHeaders:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  customResponseHeaders:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  featurePolicy:
+                    description: 'Deprecated: use PermissionsPolicy instead.'
+                    type: string
+                  forceSTSHeader:
+                    type: boolean
+                  frameDeny:
+                    type: boolean
+                  hostsProxyHeaders:
+                    items:
+                      type: string
+                    type: array
+                  isDevelopment:
+                    type: boolean
+                  permissionsPolicy:
+                    type: string
+                  publicKey:
+                    type: string
+                  referrerPolicy:
+                    type: string
+                  sslForceHost:
+                    description: 'Deprecated: use RedirectRegex instead.'
+                    type: boolean
+                  sslHost:
+                    description: 'Deprecated: use RedirectRegex instead.'
+                    type: string
+                  sslProxyHeaders:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  sslRedirect:
+                    description: 'Deprecated: use EntryPoint redirection or RedirectScheme
+                      instead.'
+                    type: boolean
+                  sslTemporaryRedirect:
+                    description: 'Deprecated: use EntryPoint redirection or RedirectScheme
+                      instead.'
+                    type: boolean
+                  stsIncludeSubdomains:
+                    type: boolean
+                  stsPreload:
+                    type: boolean
+                  stsSeconds:
+                    format: int64
+                    type: integer
+                type: object
+              inFlightReq:
+                description: InFlightReq limits the number of requests being processed
+                  and served concurrently.
+                properties:
+                  amount:
+                    format: int64
+                    type: integer
+                  sourceCriterion:
+                    description: SourceCriterion defines what criterion is used to
+                      group requests as originating from a common source. If none
+                      are set, the default is to use the request's remote address
+                      field. All fields are mutually exclusive.
+                    properties:
+                      ipStrategy:
+                        description: IPStrategy holds the ip strategy configuration.
+                        properties:
+                          depth:
+                            type: integer
+                          excludedIPs:
+                            items:
+                              type: string
+                            type: array
+                        type: object
+                      requestHeaderName:
+                        type: string
+                      requestHost:
+                        type: boolean
+                    type: object
+                type: object
+              ipWhiteList:
+                description: IPWhiteList holds the ip white list configuration.
+                properties:
+                  ipStrategy:
+                    description: IPStrategy holds the ip strategy configuration.
+                    properties:
+                      depth:
+                        type: integer
+                      excludedIPs:
+                        items:
+                          type: string
+                        type: array
+                    type: object
+                  sourceRange:
+                    items:
+                      type: string
+                    type: array
+                type: object
+              passTLSClientCert:
+                description: PassTLSClientCert holds the TLS client cert headers configuration.
+                properties:
+                  info:
+                    description: TLSClientCertificateInfo holds the client TLS certificate
+                      info configuration.
+                    properties:
+                      issuer:
+                        description: TLSCLientCertificateDNInfo holds the client TLS
+                          certificate distinguished name info configuration. cf https://tools.ietf.org/html/rfc3739
+                        properties:
+                          commonName:
+                            type: boolean
+                          country:
+                            type: boolean
+                          domainComponent:
+                            type: boolean
+                          locality:
+                            type: boolean
+                          organization:
+                            type: boolean
+                          province:
+                            type: boolean
+                          serialNumber:
+                            type: boolean
+                        type: object
+                      notAfter:
+                        type: boolean
+                      notBefore:
+                        type: boolean
+                      sans:
+                        type: boolean
+                      serialNumber:
+                        type: boolean
+                      subject:
+                        description: TLSCLientCertificateDNInfo holds the client TLS
+                          certificate distinguished name info configuration. cf https://tools.ietf.org/html/rfc3739
+                        properties:
+                          commonName:
+                            type: boolean
+                          country:
+                            type: boolean
+                          domainComponent:
+                            type: boolean
+                          locality:
+                            type: boolean
+                          organization:
+                            type: boolean
+                          province:
+                            type: boolean
+                          serialNumber:
+                            type: boolean
+                        type: object
+                    type: object
+                  pem:
+                    type: boolean
+                type: object
+              plugin:
+                additionalProperties:
+                  x-kubernetes-preserve-unknown-fields: true
+                type: object
+              rateLimit:
+                description: RateLimit holds the rate limiting configuration for a
+                  given router.
+                properties:
+                  average:
+                    format: int64
+                    type: integer
+                  burst:
+                    format: int64
+                    type: integer
+                  period:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    x-kubernetes-int-or-string: true
+                  sourceCriterion:
+                    description: SourceCriterion defines what criterion is used to
+                      group requests as originating from a common source. If none
+                      are set, the default is to use the request's remote address
+                      field. All fields are mutually exclusive.
+                    properties:
+                      ipStrategy:
+                        description: IPStrategy holds the ip strategy configuration.
+                        properties:
+                          depth:
+                            type: integer
+                          excludedIPs:
+                            items:
+                              type: string
+                            type: array
+                        type: object
+                      requestHeaderName:
+                        type: string
+                      requestHost:
+                        type: boolean
+                    type: object
+                type: object
+              redirectRegex:
+                description: RedirectRegex holds the redirection configuration.
+                properties:
+                  permanent:
+                    type: boolean
+                  regex:
+                    type: string
+                  replacement:
+                    type: string
+                type: object
+              redirectScheme:
+                description: RedirectScheme holds the scheme redirection configuration.
+                properties:
+                  permanent:
+                    type: boolean
+                  port:
+                    type: string
+                  scheme:
+                    type: string
+                type: object
+              replacePath:
+                description: ReplacePath holds the ReplacePath configuration.
+                properties:
+                  path:
+                    type: string
+                type: object
+              replacePathRegex:
+                description: ReplacePathRegex holds the ReplacePathRegex configuration.
+                properties:
+                  regex:
+                    type: string
+                  replacement:
+                    type: string
+                type: object
+              retry:
+                description: Retry holds the retry configuration.
+                properties:
+                  attempts:
+                    type: integer
+                  initialInterval:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    x-kubernetes-int-or-string: true
+                type: object
+              stripPrefix:
+                description: StripPrefix holds the StripPrefix configuration.
+                properties:
+                  forceSlash:
+                    type: boolean
+                  prefixes:
+                    items:
+                      type: string
+                    type: array
+                type: object
+              stripPrefixRegex:
+                description: StripPrefixRegex holds the StripPrefixRegex configuration.
+                properties:
+                  regex:
+                    items:
+                      type: string
+                    type: array
+                type: object
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_middlewaretcps.yaml

@@ -0,0 +1,59 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.1
+  creationTimestamp: null
+  name: middlewaretcps.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: MiddlewareTCP
+    listKind: MiddlewareTCPList
+    plural: middlewaretcps
+    singular: middlewaretcp
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: MiddlewareTCP is a specification for a MiddlewareTCP resource.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: MiddlewareTCPSpec holds the MiddlewareTCP configuration.
+            properties:
+              ipWhiteList:
+                description: TCPIPWhiteList holds the TCP ip white list configuration.
+                properties:
+                  sourceRange:
+                    items:
+                      type: string
+                    type: array
+                type: object
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_serverstransports.yaml

@@ -0,0 +1,105 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.1
+  creationTimestamp: null
+  name: serverstransports.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: ServersTransport
+    listKind: ServersTransportList
+    plural: serverstransports
+    singular: serverstransport
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: ServersTransport is a specification for a ServersTransport resource.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ServersTransportSpec options to configure communication between
+              Traefik and the servers.
+            properties:
+              certificatesSecrets:
+                description: Certificates for mTLS.
+                items:
+                  type: string
+                type: array
+              disableHTTP2:
+                description: Disable HTTP/2 for connections with backend servers.
+                type: boolean
+              forwardingTimeouts:
+                description: Timeouts for requests forwarded to the backend servers.
+                properties:
+                  dialTimeout:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: The amount of time to wait until a connection to
+                      a backend server can be established. If zero, no timeout exists.
+                    x-kubernetes-int-or-string: true
+                  idleConnTimeout:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: The maximum period for which an idle HTTP keep-alive
+                      connection will remain open before closing itself.
+                    x-kubernetes-int-or-string: true
+                  responseHeaderTimeout:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    description: The amount of time to wait for a server's response
+                      headers after fully writing the request (including its body,
+                      if any). If zero, no timeout exists.
+                    x-kubernetes-int-or-string: true
+                type: object
+              insecureSkipVerify:
+                description: Disable SSL certificate verification.
+                type: boolean
+              maxIdleConnsPerHost:
+                description: If non-zero, controls the maximum idle (keep-alive) to
+                  keep per-host. If zero, DefaultMaxIdleConnsPerHost is used.
+                type: integer
+              peerCertURI:
+                description: URI used to match against SAN URI during the peer certificate
+                  verification.
+                type: string
+              rootCAsSecrets:
+                description: Add cert file for self-signed certificate.
+                items:
+                  type: string
+                type: array
+              serverName:
+                description: ServerName used to contact the server.
+                type: string
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_tlsoptions.yaml

@@ -0,0 +1,87 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.1
+  creationTimestamp: null
+  name: tlsoptions.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: TLSOption
+    listKind: TLSOptionList
+    plural: tlsoptions
+    singular: tlsoption
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: TLSOption is a specification for a TLSOption resource.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: TLSOptionSpec configures TLS for an entry point.
+            properties:
+              cipherSuites:
+                items:
+                  type: string
+                type: array
+              clientAuth:
+                description: ClientAuth defines the parameters of the client authentication
+                  part of the TLS connection, if any.
+                properties:
+                  clientAuthType:
+                    description: ClientAuthType defines the client authentication
+                      type to apply.
+                    enum:
+                    - NoClientCert
+                    - RequestClientCert
+                    - VerifyClientCertIfGiven
+                    - RequireAndVerifyClientCert
+                    type: string
+                  secretNames:
+                    description: SecretName is the name of the referenced Kubernetes
+                      Secret to specify the certificate details.
+                    items:
+                      type: string
+                    type: array
+                type: object
+              curvePreferences:
+                items:
+                  type: string
+                type: array
+              maxVersion:
+                type: string
+              minVersion:
+                type: string
+              preferServerCipherSuites:
+                type: boolean
+              sniStrict:
+                type: boolean
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_tlsstores.yaml

@@ -0,0 +1,64 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.1
+  creationTimestamp: null
+  name: tlsstores.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: TLSStore
+    listKind: TLSStoreList
+    plural: tlsstores
+    singular: tlsstore
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: TLSStore is a specification for a TLSStore resource.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: TLSStoreSpec configures a TLSStore resource.
+            properties:
+              defaultCertificate:
+                description: DefaultCertificate holds a secret name for the TLSOption
+                  resource.
+                properties:
+                  secretName:
+                    description: SecretName is the name of the referenced Kubernetes
+                      Secret to specify the certificate details.
+                    type: string
+                required:
+                - secretName
+                type: object
+            required:
+            - defaultCertificate
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

docs/content/reference/dynamic-configuration/traefik.containo.us_traefikservices.yaml

@@ -0,0 +1,270 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.1
+  creationTimestamp: null
+  name: traefikservices.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  names:
+    kind: TraefikService
+    listKind: TraefikServiceList
+    plural: traefikservices
+    singular: traefikservice
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: TraefikService is the specification for a service (that an IngressRoute
+          refers to) that is usually not a terminal service (i.e. not a pod of servers),
+          as opposed to a Kubernetes Service. That is to say, it usually refers to
+          other (children) services, which themselves can be TraefikServices or Services.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ServiceSpec defines whether a TraefikService is a load-balancer
+              of services or a mirroring service.
+            properties:
+              mirroring:
+                description: Mirroring defines a mirroring service, which is composed
+                  of a main load-balancer, and a list of mirrors.
+                properties:
+                  kind:
+                    enum:
+                    - Service
+                    - TraefikService
+                    type: string
+                  maxBodySize:
+                    format: int64
+                    type: integer
+                  mirrors:
+                    items:
+                      description: MirrorService defines one of the mirrors of a Mirroring
+                        service.
+                      properties:
+                        kind:
+                          enum:
+                          - Service
+                          - TraefikService
+                          type: string
+                        name:
+                          description: Name is a reference to a Kubernetes Service
+                            object (for a load-balancer of servers), or to a TraefikService
+                            object (service load-balancer, mirroring, etc). The differentiation
+                            between the two is specified in the Kind field.
+                          type: string
+                        namespace:
+                          type: string
+                        passHostHeader:
+                          type: boolean
+                        percent:
+                          type: integer
+                        port:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          x-kubernetes-int-or-string: true
+                        responseForwarding:
+                          description: ResponseForwarding holds configuration for
+                            the forward of the response.
+                          properties:
+                            flushInterval:
+                              type: string
+                          type: object
+                        scheme:
+                          type: string
+                        serversTransport:
+                          type: string
+                        sticky:
+                          description: Sticky holds the sticky configuration.
+                          properties:
+                            cookie:
+                              description: Cookie holds the sticky configuration based
+                                on cookie.
+                              properties:
+                                httpOnly:
+                                  type: boolean
+                                name:
+                                  type: string
+                                sameSite:
+                                  type: string
+                                secure:
+                                  type: boolean
+                              type: object
+                          type: object
+                        strategy:
+                          type: string
+                        weight:
+                          description: Weight should only be specified when Name references
+                            a TraefikService object (and to be precise, one that embeds
+                            a Weighted Round Robin).
+                          type: integer
+                      required:
+                      - name
+                      type: object
+                    type: array
+                  name:
+                    description: Name is a reference to a Kubernetes Service object
+                      (for a load-balancer of servers), or to a TraefikService object
+                      (service load-balancer, mirroring, etc). The differentiation
+                      between the two is specified in the Kind field.
+                    type: string
+                  namespace:
+                    type: string
+                  passHostHeader:
+                    type: boolean
+                  port:
+                    anyOf:
+                    - type: integer
+                    - type: string
+                    x-kubernetes-int-or-string: true
+                  responseForwarding:
+                    description: ResponseForwarding holds configuration for the forward
+                      of the response.
+                    properties:
+                      flushInterval:
+                        type: string
+                    type: object
+                  scheme:
+                    type: string
+                  serversTransport:
+                    type: string
+                  sticky:
+                    description: Sticky holds the sticky configuration.
+                    properties:
+                      cookie:
+                        description: Cookie holds the sticky configuration based on
+                          cookie.
+                        properties:
+                          httpOnly:
+                            type: boolean
+                          name:
+                            type: string
+                          sameSite:
+                            type: string
+                          secure:
+                            type: boolean
+                        type: object
+                    type: object
+                  strategy:
+                    type: string
+                  weight:
+                    description: Weight should only be specified when Name references
+                      a TraefikService object (and to be precise, one that embeds
+                      a Weighted Round Robin).
+                    type: integer
+                required:
+                - name
+                type: object
+              weighted:
+                description: WeightedRoundRobin defines a load-balancer of services.
+                properties:
+                  services:
+                    items:
+                      description: Service defines an upstream to proxy traffic.
+                      properties:
+                        kind:
+                          enum:
+                          - Service
+                          - TraefikService
+                          type: string
+                        name:
+                          description: Name is a reference to a Kubernetes Service
+                            object (for a load-balancer of servers), or to a TraefikService
+                            object (service load-balancer, mirroring, etc). The differentiation
+                            between the two is specified in the Kind field.
+                          type: string
+                        namespace:
+                          type: string
+                        passHostHeader:
+                          type: boolean
+                        port:
+                          anyOf:
+                          - type: integer
+                          - type: string
+                          x-kubernetes-int-or-string: true
+                        responseForwarding:
+                          description: ResponseForwarding holds configuration for
+                            the forward of the response.
+                          properties:
+                            flushInterval:
+                              type: string
+                          type: object
+                        scheme:
+                          type: string
+                        serversTransport:
+                          type: string
+                        sticky:
+                          description: Sticky holds the sticky configuration.
+                          properties:
+                            cookie:
+                              description: Cookie holds the sticky configuration based
+                                on cookie.
+                              properties:
+                                httpOnly:
+                                  type: boolean
+                                name:
+                                  type: string
+                                sameSite:
+                                  type: string
+                                secure:
+                                  type: boolean
+                              type: object
+                          type: object
+                        strategy:
+                          type: string
+                        weight:
+                          description: Weight should only be specified when Name references
+                            a TraefikService object (and to be precise, one that embeds
+                            a Weighted Round Robin).
+                          type: integer
+                      required:
+                      - name
+                      type: object
+                    type: array
+                  sticky:
+                    description: Sticky holds the sticky configuration.
+                    properties:
+                      cookie:
+                        description: Cookie holds the sticky configuration based on
+                          cookie.
+                        properties:
+                          httpOnly:
+                            type: boolean
+                          name:
+                            type: string
+                          sameSite:
+                            type: string
+                          secure:
+                            type: boolean
+                        type: object
+                    type: object
+                type: object
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

docs/content/reference/static-configuration/cli-ref.md

@@ -102,6 +102,9 @@ Entry points definition. (Default: ```false```)
 `--entrypoints.<name>.address`:  
 Entry point address.
 
+`--entrypoints.<name>.enablehttp3`:  
+Enable HTTP3. (Default: ```false```)
+
 `--entrypoints.<name>.forwardedheaders.insecure`:  
 Trust all forwarded headers. (Default: ```false```)
 
@@ -168,15 +171,21 @@ ReadTimeout is the maximum duration for reading the entire request, including th
 `--entrypoints.<name>.transport.respondingtimeouts.writetimeout`:  
 WriteTimeout is the maximum duration before timing out writes of the response. If zero, no timeout is set. (Default: ```0```)
 
-`--experimental.devplugin.gopath`:  
-plugin's GOPATH.
+`--entrypoints.<name>.udp.timeout`:  
+Timeout defines how long to wait on an idle session before releasing the related resources. (Default: ```3```)
 
-`--experimental.devplugin.modulename`:  
-plugin's module name.
+`--experimental.http3`:  
+Enable HTTP3. (Default: ```false```)
 
 `--experimental.kubernetesgateway`:  
 Allow the Kubernetes gateway api provider usage. (Default: ```false```)
 
+`--experimental.localplugins.<name>`:  
+Local plugins configuration. (Default: ```false```)
+
+`--experimental.localplugins.<name>.modulename`:  
+plugin's module name.
+
 `--experimental.plugins.<name>.modulename`:  
 plugin's module name.
 
@@ -222,6 +231,9 @@ Enable metrics on entry points. (Default: ```true```)
 `--metrics.datadog.address`:  
 Datadog's address. (Default: ```localhost:8125```)
 
+`--metrics.datadog.addrouterslabels`:  
+Enable metrics on routers. (Default: ```false```)
+
 `--metrics.datadog.addserviceslabels`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -237,6 +249,9 @@ Enable metrics on entry points. (Default: ```true```)
 `--metrics.influxdb.address`:  
 InfluxDB address. (Default: ```localhost:8089```)
 
+`--metrics.influxdb.addrouterslabels`:  
+Enable metrics on routers. (Default: ```false```)
+
 `--metrics.influxdb.addserviceslabels`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -264,6 +279,9 @@ Prometheus metrics exporter type. (Default: ```false```)
 `--metrics.prometheus.addentrypointslabels`:  
 Enable metrics on entry points. (Default: ```true```)
 
+`--metrics.prometheus.addrouterslabels`:  
+Enable metrics on routers. (Default: ```false```)
+
 `--metrics.prometheus.addserviceslabels`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -285,6 +303,9 @@ Enable metrics on entry points. (Default: ```true```)
 `--metrics.statsd.address`:  
 StatsD address. (Default: ```localhost:8125```)
 
+`--metrics.statsd.addrouterslabels`:  
+Enable metrics on routers. (Default: ```false```)
+
 `--metrics.statsd.addserviceslabels`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -348,6 +369,12 @@ Enable ConsulCatalog backend with default settings. (Default: ```false```)
 `--providers.consulcatalog.cache`:  
 Use local agent caching for catalog reads. (Default: ```false```)
 
+`--providers.consulcatalog.connectaware`:  
+Enable Consul Connect support. (Default: ```false```)
+
+`--providers.consulcatalog.connectbydefault`:  
+Consider every service as Connect capable by default. (Default: ```false```)
+
 `--providers.consulcatalog.constraints`:  
 Constraints is an expression that Traefik matches against the container's labels to determine whether to create any route for that container.
 
@@ -355,7 +382,7 @@ Constraints is an expression that Traefik matches against the container's labels
 Default rule. (Default: ```Host(`{{ normalize .Name }}`)```)
 
 `--providers.consulcatalog.endpoint.address`:  
-The address of the Consul server (Default: ```127.0.0.1:8500```)
+The address of the Consul server
 
 `--providers.consulcatalog.endpoint.datacenter`:  
 Data center to use. If not provided, the default agent data center is used
@@ -402,6 +429,9 @@ Interval for check Consul API. Default 15s (Default: ```15```)
 `--providers.consulcatalog.requireconsistent`:  
 Forces the read to be fully consistent. (Default: ```false```)
 
+`--providers.consulcatalog.servicename`:  
+Name of the Traefik service in Consul Catalog (needs to be registered via the orchestrator or manually). (Default: ```traefik```)
+
 `--providers.consulcatalog.stale`:  
 Use stale consistency for catalog reads. (Default: ```false```)
 
@@ -606,6 +636,9 @@ Kubernetes bearer token (not needed for in-cluster client).
 `--providers.kubernetesingress`:  
 Enable Kubernetes backend with default settings. (Default: ```false```)
 
+`--providers.kubernetesingress.allowemptyservices`:  
+Allow creation of services without endpoints. (Default: ```false```)
+
 `--providers.kubernetesingress.allowexternalnameservices`:  
 Allow ExternalName services. (Default: ```false```)
 
@@ -616,7 +649,7 @@ Kubernetes certificate authority file path (not needed for in-cluster client).
 Kubernetes server endpoint (required for external cluster client).
 
 `--providers.kubernetesingress.ingressclass`:  
-Value of kubernetes.io/ingress.class annotation to watch for.
+Value of kubernetes.io/ingress.class annotation or IngressClass name to watch for.
 
 `--providers.kubernetesingress.ingressendpoint.hostname`:  
 Hostname used for Kubernetes Ingress endpoints.
@@ -702,6 +735,9 @@ Display additional provider logs. (Default: ```false```)
 `--providers.marathon.watch`:  
 Watch provider. (Default: ```true```)
 
+`--providers.plugin.<name>`:  
+Plugins configuration.
+
 `--providers.providersthrottleduration`:  
 Backends throttle duration: minimum duration between 2 events from providers before applying a new configuration. It avoids unnecessary reloads if multiples events are sent in a short amount of time. (Default: ```2```)
 

docs/content/reference/static-configuration/env-ref.md

@@ -102,6 +102,9 @@ Entry points definition. (Default: ```false```)
 `TRAEFIK_ENTRYPOINTS_<NAME>_ADDRESS`:  
 Entry point address.
 
+`TRAEFIK_ENTRYPOINTS_<NAME>_ENABLEHTTP3`:  
+Enable HTTP3. (Default: ```false```)
+
 `TRAEFIK_ENTRYPOINTS_<NAME>_FORWARDEDHEADERS_INSECURE`:  
 Trust all forwarded headers. (Default: ```false```)
 
@@ -168,15 +171,21 @@ ReadTimeout is the maximum duration for reading the entire request, including th
 `TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_RESPONDINGTIMEOUTS_WRITETIMEOUT`:  
 WriteTimeout is the maximum duration before timing out writes of the response. If zero, no timeout is set. (Default: ```0```)
 
-`TRAEFIK_EXPERIMENTAL_DEVPLUGIN_GOPATH`:  
-plugin's GOPATH.
+`TRAEFIK_ENTRYPOINTS_<NAME>_UDP_TIMEOUT`:  
+Timeout defines how long to wait on an idle session before releasing the related resources. (Default: ```3```)
 
-`TRAEFIK_EXPERIMENTAL_DEVPLUGIN_MODULENAME`:  
-plugin's module name.
+`TRAEFIK_EXPERIMENTAL_HTTP3`:  
+Enable HTTP3. (Default: ```false```)
 
 `TRAEFIK_EXPERIMENTAL_KUBERNETESGATEWAY`:  
 Allow the Kubernetes gateway api provider usage. (Default: ```false```)
 
+`TRAEFIK_EXPERIMENTAL_LOCALPLUGINS_<NAME>`:  
+Local plugins configuration. (Default: ```false```)
+
+`TRAEFIK_EXPERIMENTAL_LOCALPLUGINS_<NAME>_MODULENAME`:  
+plugin's module name.
+
 `TRAEFIK_EXPERIMENTAL_PLUGINS_<NAME>_MODULENAME`:  
 plugin's module name.
 
@@ -222,6 +231,9 @@ Enable metrics on entry points. (Default: ```true```)
 `TRAEFIK_METRICS_DATADOG_ADDRESS`:  
 Datadog's address. (Default: ```localhost:8125```)
 
+`TRAEFIK_METRICS_DATADOG_ADDROUTERSLABELS`:  
+Enable metrics on routers. (Default: ```false```)
+
 `TRAEFIK_METRICS_DATADOG_ADDSERVICESLABELS`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -237,6 +249,9 @@ Enable metrics on entry points. (Default: ```true```)
 `TRAEFIK_METRICS_INFLUXDB_ADDRESS`:  
 InfluxDB address. (Default: ```localhost:8089```)
 
+`TRAEFIK_METRICS_INFLUXDB_ADDROUTERSLABELS`:  
+Enable metrics on routers. (Default: ```false```)
+
 `TRAEFIK_METRICS_INFLUXDB_ADDSERVICESLABELS`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -264,6 +279,9 @@ Prometheus metrics exporter type. (Default: ```false```)
 `TRAEFIK_METRICS_PROMETHEUS_ADDENTRYPOINTSLABELS`:  
 Enable metrics on entry points. (Default: ```true```)
 
+`TRAEFIK_METRICS_PROMETHEUS_ADDROUTERSLABELS`:  
+Enable metrics on routers. (Default: ```false```)
+
 `TRAEFIK_METRICS_PROMETHEUS_ADDSERVICESLABELS`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -285,6 +303,9 @@ Enable metrics on entry points. (Default: ```true```)
 `TRAEFIK_METRICS_STATSD_ADDRESS`:  
 StatsD address. (Default: ```localhost:8125```)
 
+`TRAEFIK_METRICS_STATSD_ADDROUTERSLABELS`:  
+Enable metrics on routers. (Default: ```false```)
+
 `TRAEFIK_METRICS_STATSD_ADDSERVICESLABELS`:  
 Enable metrics on services. (Default: ```true```)
 
@@ -321,6 +342,12 @@ Enable ConsulCatalog backend with default settings. (Default: ```false```)
 `TRAEFIK_PROVIDERS_CONSULCATALOG_CACHE`:  
 Use local agent caching for catalog reads. (Default: ```false```)
 
+`TRAEFIK_PROVIDERS_CONSULCATALOG_CONNECTAWARE`:  
+Enable Consul Connect support. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_CONSULCATALOG_CONNECTBYDEFAULT`:  
+Consider every service as Connect capable by default. (Default: ```false```)
+
 `TRAEFIK_PROVIDERS_CONSULCATALOG_CONSTRAINTS`:  
 Constraints is an expression that Traefik matches against the container's labels to determine whether to create any route for that container.
 
@@ -328,7 +355,7 @@ Constraints is an expression that Traefik matches against the container's labels
 Default rule. (Default: ```Host(`{{ normalize .Name }}`)```)
 
 `TRAEFIK_PROVIDERS_CONSULCATALOG_ENDPOINT_ADDRESS`:  
-The address of the Consul server (Default: ```127.0.0.1:8500```)
+The address of the Consul server
 
 `TRAEFIK_PROVIDERS_CONSULCATALOG_ENDPOINT_DATACENTER`:  
 Data center to use. If not provided, the default agent data center is used
@@ -375,6 +402,9 @@ Interval for check Consul API. Default 15s (Default: ```15```)
 `TRAEFIK_PROVIDERS_CONSULCATALOG_REQUIRECONSISTENT`:  
 Forces the read to be fully consistent. (Default: ```false```)
 
+`TRAEFIK_PROVIDERS_CONSULCATALOG_SERVICENAME`:  
+Name of the Traefik service in Consul Catalog (needs to be registered via the orchestrator or manually). (Default: ```traefik```)
+
 `TRAEFIK_PROVIDERS_CONSULCATALOG_STALE`:  
 Use stale consistency for catalog reads. (Default: ```false```)
 
@@ -606,6 +636,9 @@ Kubernetes bearer token (not needed for in-cluster client).
 `TRAEFIK_PROVIDERS_KUBERNETESINGRESS`:  
 Enable Kubernetes backend with default settings. (Default: ```false```)
 
+`TRAEFIK_PROVIDERS_KUBERNETESINGRESS_ALLOWEMPTYSERVICES`:  
+Allow creation of services without endpoints. (Default: ```false```)
+
 `TRAEFIK_PROVIDERS_KUBERNETESINGRESS_ALLOWEXTERNALNAMESERVICES`:  
 Allow ExternalName services. (Default: ```false```)
 
@@ -616,7 +649,7 @@ Kubernetes certificate authority file path (not needed for in-cluster client).
 Kubernetes server endpoint (required for external cluster client).
 
 `TRAEFIK_PROVIDERS_KUBERNETESINGRESS_INGRESSCLASS`:  
-Value of kubernetes.io/ingress.class annotation to watch for.
+Value of kubernetes.io/ingress.class annotation or IngressClass name to watch for.
 
 `TRAEFIK_PROVIDERS_KUBERNETESINGRESS_INGRESSENDPOINT_HOSTNAME`:  
 Hostname used for Kubernetes Ingress endpoints.
@@ -702,6 +735,9 @@ Display additional provider logs. (Default: ```false```)
 `TRAEFIK_PROVIDERS_MARATHON_WATCH`:  
 Watch provider. (Default: ```true```)
 
+`TRAEFIK_PROVIDERS_PLUGIN_<NAME>`:  
+Plugins configuration.
+
 `TRAEFIK_PROVIDERS_PROVIDERSTHROTTLEDURATION`:  
 Backends throttle duration: minimum duration between 2 events from providers before applying a new configuration. It avoids unnecessary reloads if multiples events are sent in a short amount of time. (Default: ```2```)
 

docs/content/reference/static-configuration/file.toml

@@ -14,6 +14,7 @@
 [entryPoints]
   [entryPoints.EntryPoint0]
     address = "foobar"
+    enableHTTP3 = true
     [entryPoints.EntryPoint0.transport]
       [entryPoints.EntryPoint0.transport.lifeCycle]
         requestAcceptGraceTimeout = 42
@@ -28,6 +29,8 @@
     [entryPoints.EntryPoint0.forwardedHeaders]
       insecure = true
       trustedIPs = ["foobar", "foobar"]
+    [entryPoints.EntryPoint0.udp]
+      timeout = 42
     [entryPoints.EntryPoint0.http]
       middlewares = ["foobar", "foobar"]
       [entryPoints.EntryPoint0.http.redirections]
@@ -103,6 +106,7 @@
     labelSelector = "foobar"
     ingressClass = "foobar"
     throttleDuration = "42s"
+    allowEmptyServices = true
     [providers.kubernetesIngress.ingressEndpoint]
       ip = "foobar"
       hostname = "foobar"
@@ -222,6 +226,9 @@
       cert = "foobar"
       key = "foobar"
       insecureSkipVerify = true
+  [providers.plugin]
+    [providers.plugin.Descriptor0]
+    [providers.plugin.Descriptor1]
 
 [api]
   insecure = true
@@ -232,6 +239,7 @@
   [metrics.prometheus]
     buckets = [42.0, 42.0]
     addEntryPointsLabels = true
+    addRoutersLabels = true
     addServicesLabels = true
     entryPoint = "foobar"
     manualRouting = true
@@ -239,11 +247,13 @@
     address = "foobar"
     pushInterval = "42s"
     addEntryPointsLabels = true
+    addRoutersLabels = true
     addServicesLabels = true
   [metrics.statsD]
     address = "foobar"
     pushInterval = "42s"
     addEntryPointsLabels = true
+    addRoutersLabels = true
     addServicesLabels = true
     prefix = "foobar"
   [metrics.influxDB]
@@ -255,6 +265,7 @@
     username = "foobar"
     password = "foobar"
     addEntryPointsLabels = true
+    addRoutersLabels = true
     addServicesLabels = true
 
 [ping]
@@ -382,6 +393,7 @@
 
 [experimental]
   kubernetesGateway = true
+  http3 = true
   [experimental.plugins]
     [experimental.plugins.Descriptor0]
       moduleName = "foobar"
@@ -389,6 +401,8 @@
     [experimental.plugins.Descriptor1]
       moduleName = "foobar"
       version = "foobar"
-  [experimental.devPlugin]
-    goPath = "foobar"
-    moduleName = "foobar"
+  [experimental.localPlugins]
+    [experimental.localPlugins.Descriptor0]
+      moduleName = "foobar"
+    [experimental.localPlugins.Descriptor1]
+      moduleName = "foobar"

docs/content/reference/static-configuration/file.yaml

@@ -32,6 +32,9 @@ entryPoints:
       trustedIPs:
       - foobar
       - foobar
+    enableHTTP3: true
+    udp:
+      timeout: 42
     http:
       redirections:
         entryPoint:
@@ -111,6 +114,7 @@ providers:
     labelSelector: foobar
     ingressClass: foobar
     throttleDuration: 42s
+    allowEmptyServices: true
     ingressEndpoint:
       ip: foobar
       hostname: foobar
@@ -244,6 +248,9 @@ providers:
       cert: foobar
       key: foobar
       insecureSkipVerify: true
+  plugin:
+    Descriptor0: {}
+    Descriptor1: {}
 api:
   insecure: true
   dashboard: true
@@ -254,6 +261,7 @@ metrics:
     - 42
     - 42
     addEntryPointsLabels: true
+    addRoutersLabels: true
     addServicesLabels: true
     entryPoint: foobar
     manualRouting: true
@@ -261,11 +269,13 @@ metrics:
     address: foobar
     pushInterval: 42
     addEntryPointsLabels: true
+    addRoutersLabels: true
     addServicesLabels: true
   statsD:
     address: foobar
     pushInterval: 42
     addEntryPointsLabels: true
+    addRoutersLabels: true
     addServicesLabels: true
     prefix: foobar
   influxDB:
@@ -277,6 +287,7 @@ metrics:
     username: foobar
     password: foobar
     addEntryPointsLabels: true
+    addRoutersLabels: true
     addServicesLabels: true
 ping:
   entryPoint: foobar
@@ -402,6 +413,7 @@ pilot:
   dashboard: true
 experimental:
   kubernetesGateway: true
+  http3: true
   plugins:
     Descriptor0:
       moduleName: foobar
@@ -409,7 +421,8 @@ experimental:
     Descriptor1:
       moduleName: foobar
       version: foobar
-  devPlugin:
-    goPath: foobar
-    moduleName: foobar
-
+  localPlugins:
+    Descriptor0:
+      moduleName: foobar
+    Descriptor1:
+      moduleName: foobar

docs/content/routing/entrypoints.md

@@ -100,6 +100,7 @@ They can be defined by using a file (YAML or TOML) or CLI arguments.
     entryPoints:
       name:
         address: ":8888" # same as ":8888/tcp"
+        enableHTTP3: true
         transport:
           lifeCycle:
             requestAcceptGraceTimeout: 42
@@ -125,6 +126,7 @@ They can be defined by using a file (YAML or TOML) or CLI arguments.
     [entryPoints]
       [entryPoints.name]
         address = ":8888" # same as ":8888/tcp"
+        enableHTTP3 = true
         [entryPoints.name.transport]
           [entryPoints.name.transport.lifeCycle]
             requestAcceptGraceTimeout = 42
@@ -144,6 +146,7 @@ They can be defined by using a file (YAML or TOML) or CLI arguments.
     ```bash tab="CLI"
     ## Static configuration
     --entryPoints.name.address=:8888 # same as :8888/tcp
+    --entryPoints.name.http3=true
     --entryPoints.name.transport.lifeCycle.requestAcceptGraceTimeout=42
     --entryPoints.name.transport.lifeCycle.graceTimeOut=42
     --entryPoints.name.transport.respondingTimeouts.readTimeout=42
@@ -218,6 +221,43 @@ If both TCP and UDP are wanted for the same port, two entryPoints definitions ar
 
     Full details for how to specify `address` can be found in [net.Listen](https://golang.org/pkg/net/#Listen) (and [net.Dial](https://golang.org/pkg/net/#Dial)) of the doc for go.
 
+### EnableHTTP3
+
+`enableHTTP3` defines that you want to enable HTTP3 on this `address`.
+You can only enable HTTP3 on a TCP entrypoint.
+Enabling HTTP3 will automatically add the correct headers for the connection upgrade to HTTP3.
+
+??? info "HTTP3 uses UDP+TLS"
+
+    As HTTP3 uses UDP, you can't have a TCP entrypoint with HTTP3 on the same port as a UDP entrypoint.
+    Since HTTP3 requires the use of TLS, only routers with TLS enabled will be usable with HTTP3.
+
+!!! warning "Enabling Experimental HTTP3"
+
+    As the HTTP3 spec is still in draft, HTTP3 support in Traefik is an experimental feature and needs to be activated 
+    in the experimental section of the static configuration.
+    
+    ```yaml tab="File (YAML)"
+    experimental:
+      http3: true
+    
+    entryPoints:
+      name:
+        enableHTTP3: true
+    ```
+
+    ```toml tab="File (TOML)"
+    [experimental]
+      http3 = true
+    
+    [entryPoints.name]
+      enableHTTP3 = true
+    ```
+    
+    ```bash tab="CLI"
+    --experimental.http3=true --entrypoints.name.enablehttp3=true
+    ```
+
 ### Forwarded Headers
 
 You can configure Traefik to trust the forwarded headers information (`X-Forwarded-*`).
@@ -824,3 +864,35 @@ entryPoints:
     --entrypoints.websecure.address=:443
     --entrypoints.websecure.http.tls.certResolver=leresolver
     ```
+
+## UDP Options
+
+This whole section is dedicated to options, keyed by entry point, that will apply only to UDP routing.
+
+### Timeout
+
+_Optional, Default=3s_
+
+Timeout defines how long to wait on an idle session before releasing the related resources.
+The Timeout value must be greater than zero.
+
+```yaml tab="File (YAML)"
+entryPoints:
+  foo:
+    address: ':8000/udp'
+    udp:
+      timeout: 10s
+```
+
+```toml tab="File (TOML)"
+[entryPoints.foo]
+  address = ":8000/udp"
+
+    [entryPoints.foo.udp]
+      timeout = "10s"
+```
+
+```bash tab="CLI"
+entrypoints.foo.address=:8000/udp
+entrypoints.foo.udp.timeout=10s
+```

docs/content/routing/overview.md

@@ -22,7 +22,7 @@ If they do, the router might transform the request using pieces of [middleware](
 ## Example with a File Provider
 
 Below is an example of a full configuration file for the [file provider](../providers/file.md) that forwards `http://domain/whoami/` requests to a service reachable on `http://private/whoami-service/`.
-In the process, Traefik will make sure that the user is authenticated (using the [BasicAuth middleware](../middlewares/basicauth.md)).
+In the process, Traefik will make sure that the user is authenticated (using the [BasicAuth middleware](../middlewares/http/basicauth.md)).
 
 Static configuration:
 

docs/content/routing/providers/consul-catalog.md

@@ -263,7 +263,7 @@ you'd add the tag `traefik.http.services.{name-of-your-choice}.loadbalancer.pass
 
 You can declare pieces of middleware using tags starting with `traefik.http.middlewares.{name-of-your-choice}.`, followed by the middleware type/options.
 
-For example, to declare a middleware [`redirectscheme`](../../middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
+For example, to declare a middleware [`redirectscheme`](../../middlewares/http/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
 
 More information about available middlewares in the dedicated [middlewares section](../../middlewares/overview.md).
 
@@ -454,6 +454,16 @@ You can tell Traefik to consider (or not) the service by setting `traefik.enable
 
 This option overrides the value of `exposedByDefault`.
 
+#### `traefik.consulcatalog.connect`
+
+```yaml
+traefik.consulcatalog.connect=true
+```
+
+You can tell Traefik to consider (or not) the service as a Connect capable one by setting `traefik.consulcatalog.connect` to true or false.
+
+This option overrides the value of `connectByDefault`.
+
 #### Port Lookup
 
 Traefik is capable of detecting the port to use, by following the default consul Catalog flow.

docs/content/routing/providers/docker.md

@@ -419,7 +419,7 @@ you'd add the label `traefik.http.services.<name-of-your-choice>.loadbalancer.pa
 You can declare pieces of middleware using labels starting with `traefik.http.middlewares.<name-of-your-choice>.`,
 followed by the middleware type/options.
 
-For example, to declare a middleware [`redirectscheme`](../../middlewares/redirectscheme.md) named `my-redirect`,
+For example, to declare a middleware [`redirectscheme`](../../middlewares/http/redirectscheme.md) named `my-redirect`,
 you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme=https`.
 
 More information about available middlewares in the dedicated [middlewares section](../../middlewares/overview.md).

docs/content/routing/providers/ecs.md

@@ -268,7 +268,7 @@ you'd add the label `traefik.http.services.{name-of-your-choice}.loadbalancer.pa
 
 You can declare pieces of middleware using labels starting with `traefik.http.middlewares.{name-of-your-choice}.`, followed by the middleware type/options.
 
-For example, to declare a middleware [`redirectscheme`](../../middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
+For example, to declare a middleware [`redirectscheme`](../../middlewares/http/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
 
 More information about available middlewares in the dedicated [middlewares section](../../middlewares/overview.md).
 

docs/content/routing/providers/kubernetes-crd.md

@@ -9,7 +9,7 @@ The Kubernetes Ingress Controller, The Custom Resource Way.
 
     ```yaml tab="Resource Definition"
     # All resources definition must be declared
-    --8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition.yml"
+    --8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml"
     ```
     
     ```yaml tab="RBAC"
@@ -43,7 +43,7 @@ The Kubernetes Ingress Controller, The Custom Resource Way.
           serviceAccountName: traefik-ingress-controller
           containers:
             - name: traefik
-              image: traefik:v2.4
+              image: traefik:v2.5
               args:
                 - --log.level=DEBUG
                 - --api
@@ -145,7 +145,7 @@ The Kubernetes Ingress Controller, The Custom Resource Way.
     
     spec:
       entryPoints:
-        - fooudp
+        - udpep
       routes:
       - kind: Rule
         services:
@@ -332,7 +332,7 @@ Register the `IngressRoute` [kind](../../reference/dynamic-configuration/kuberne
           name: foo
           namespace: default
           passHostHeader: true
-          port: 80
+          port: 80                      # [9]
           responseForwarding:
             flushInterval: 1ms
           scheme: https
@@ -345,38 +345,39 @@ Register the `IngressRoute` [kind](../../reference/dynamic-configuration/kuberne
               sameSite: none
           strategy: RoundRobin
           weight: 10
-      tls:                              # [9]
-        secretName: supersecret         # [10]
-        options:                        # [11]
-          name: opt                     # [12]
-          namespace: default            # [13]
-        certResolver: foo               # [14]
-        domains:                        # [15]
-        - main: example.net             # [16]
-          sans:                         # [17]
+      tls:                              # [10]
+        secretName: supersecret         # [11]
+        options:                        # [12]
+          name: opt                     # [13]
+          namespace: default            # [14]
+        certResolver: foo               # [15]
+        domains:                        # [16]
+        - main: example.net             # [17]
+          sans:                         # [18]
           - a.example.net
           - b.example.net
     ```
 
-| Ref  | Attribute                  | Purpose                                                                                                                                                                                                                  |
-|------|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| [1]  | `entryPoints`              | List of [entry points](../routers/index.md#entrypoints) names                                                                                                                                                            |
-| [2]  | `routes`                   | List of routes                                                                                                                                                                                                           |
-| [3]  | `routes[n].match`          | Defines the [rule](../routers/index.md#rule) corresponding to an underlying router.                                                                                                                                      |
-| [4]  | `routes[n].priority`       | [Disambiguate](../routers/index.md#priority) rules of the same length, for route matching                                                                                                                                |
-| [5]  | `routes[n].middlewares`    | List of reference to [Middleware](#kind-middleware)                                                                                                                                                                      |
-| [6]  | `middlewares[n].name`      | Defines the [Middleware](#kind-middleware) name                                                                                                                                                                          |
-| [7]  | `middlewares[n].namespace` | Defines the [Middleware](#kind-middleware) namespace                                                                                                                                                                     |
-| [8]  | `routes[n].services`       | List of any combination of [TraefikService](#kind-traefikservice) and reference to a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) (See below for `ExternalName Service` setup) |
-| [9]  | `tls`                      | Defines [TLS](../routers/index.md#tls) certificate configuration                                                                                                                                                         |
-| [10] | `tls.secretName`           | Defines the [secret](https://kubernetes.io/docs/concepts/configuration/secret/) name used to store the certificate (in the `IngressRoute` namespace)                                                                     |
-| [11] | `tls.options`              | Defines the reference to a [TLSOption](#kind-tlsoption)                                                                                                                                                                  |
-| [12] | `options.name`             | Defines the [TLSOption](#kind-tlsoption) name                                                                                                                                                                            |
-| [13] | `options.namespace`        | Defines the [TLSOption](#kind-tlsoption) namespace                                                                                                                                                                       |
-| [14] | `tls.certResolver`         | Defines the reference to a [CertResolver](../routers/index.md#certresolver)                                                                                                                                              |
-| [15] | `tls.domains`              | List of [domains](../routers/index.md#domains)                                                                                                                                                                           |
-| [16] | `domains[n].main`          | Defines the main domain name                                                                                                                                                                                             |
-| [17] | `domains[n].sans`          | List of SANs (alternative domains)                                                                                                                                                                                       |
+| Ref  | Attribute                    | Purpose                                                                                                                                                                                                                  |
+|------|------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [1]  | `entryPoints`                | List of [entry points](../routers/index.md#entrypoints) names                                                                                                                                                            |
+| [2]  | `routes`                     | List of routes                                                                                                                                                                                                           |
+| [3]  | `routes[n].match`            | Defines the [rule](../routers/index.md#rule) corresponding to an underlying router.                                                                                                                                      |
+| [4]  | `routes[n].priority`         | [Disambiguate](../routers/index.md#priority) rules of the same length, for route matching                                                                                                                                |
+| [5]  | `routes[n].middlewares`      | List of reference to [Middleware](#kind-middleware)                                                                                                                                                                      |
+| [6]  | `middlewares[n].name`        | Defines the [Middleware](#kind-middleware) name                                                                                                                                                                          |
+| [7]  | `middlewares[n].namespace`   | Defines the [Middleware](#kind-middleware) namespace                                                                                                                                                                     |
+| [8]  | `routes[n].services`         | List of any combination of [TraefikService](#kind-traefikservice) and reference to a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) (See below for `ExternalName Service` setup) |
+| [9]  | `services[n].port`           | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). This can be a reference to a named port.                                                                   |
+| [10] | `tls`                        | Defines [TLS](../routers/index.md#tls) certificate configuration                                                                                                                                                         |
+| [11] | `tls.secretName`             | Defines the [secret](https://kubernetes.io/docs/concepts/configuration/secret/) name used to store the certificate (in the `IngressRoute` namespace)                                                                     |
+| [12] | `tls.options`                | Defines the reference to a [TLSOption](#kind-tlsoption)                                                                                                                                                                  |
+| [13] | `options.name`               | Defines the [TLSOption](#kind-tlsoption) name                                                                                                                                                                            |
+| [14] | `options.namespace`          | Defines the [TLSOption](#kind-tlsoption) namespace                                                                                                                                                                       |
+| [15] | `tls.certResolver`           | Defines the reference to a [CertResolver](../routers/index.md#certresolver)                                                                                                                                              |
+| [16] | `tls.domains`                | List of [domains](../routers/index.md#domains)                                                                                                                                                                           |
+| [17] | `domains[n].main`            | Defines the main domain name                                                                                                                                                                                             |
+| [18] | `domains[n].sans`            | List of SANs (alternative domains)                                                                                                                                                                                       |
 
 ??? example "Declaring an IngressRoute"
 
@@ -1115,7 +1116,7 @@ Register the `IngressRouteTCP` [kind](../../reference/dynamic-configuration/kube
 | [3]  | `routes[n].match`              | Defines the [rule](../routers/index.md#rule_1) corresponding to an underlying router                                                                                                                                                                                                                                                                                                 |
 | [4]  | `routes[n].services`           | List of [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) definitions  (See below for `ExternalName Service` setup)                                                                                                                                                                                                                             |
 | [5]  | `services[n].name`             | Defines the name of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/)                                                                                                                                                                                                                                                                         |
-| [6]  | `services[n].port`             | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/)                                                                                                                                                                                                                                                                         |
+| [6]  | `services[n].port`             | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). This can be a reference to a named port.                                                                                                                                                                                                                               |
 | [7]  | `services[n].weight`           | Defines the weight to apply to the server load balancing                                                                                                                                                                                                                                                                                                                             |
 | [8]  | `services[n].terminationDelay` | corresponds to the deadline that the proxy sets, after one of its connected peers indicates it has closed the writing capability of its connection, to close the reading capability as well, hence fully terminating the connection. It is a duration in milliseconds, defaulting to 100. A negative value means an infinite deadline (i.e. the reading capability is never closed). |
 | [9]  | `proxyProtocol`                | Defines the [PROXY protocol](../services/index.md#proxy-protocol) configuration                                                                                                                                                                                                                                                                                                      |
@@ -1292,9 +1293,9 @@ Register the `IngressRouteUDP` [kind](../../reference/dynamic-configuration/kube
 |------|--------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | [1]  | `entryPoints`                  | List of [entrypoints](../routers/index.md#entrypoints_1) names                                                                                                                                                                                                                                                                                                                           |
 | [2]  | `routes`                       | List of routes                                                                                                                                                                                                                                                                                                                                                                           |
-| [3]  | `routes[n].services`           | List of [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) definitions                                                                                                                                                                                                                                                                               |
+| [3]  | `routes[n].services`           | List of [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) definitions (See below for `ExternalName Service` setup)                                                                                                                                                                                                                                  |
 | [4]  | `services[n].name`             | Defines the name of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/)                                                                                                                                                                                                                                                                             |
-| [6]  | `services[n].port`             | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/)                                                                                                                                                                                                                                                                             |
+| [6]  | `services[n].port`             | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). This can be a reference to a named port.                                                                                                                                                                                                                                   |
 | [7]  | `services[n].weight`           | Defines the weight to apply to the server load balancing                                                                                                                                                                                                                                                                                                                                 |
 
 ??? example "Declaring an IngressRouteUDP"
@@ -1318,6 +1319,105 @@ Register the `IngressRouteUDP` [kind](../../reference/dynamic-configuration/kube
           weight: 10
     ```
 
+!!! important "Using Kubernetes ExternalName Service"
+
+    Traefik backends creation needs a port to be set, however Kubernetes [ExternalName Service](https://kubernetes.io/fr/docs/concepts/services-networking/service/#externalname) could be defined without any port.
+    Accordingly, Traefik supports defining a port in two ways:
+    
+    - only on `IngressRouteUDP` service
+    - on both sides, you'll be warned if the ports don't match, and the `IngressRouteUDP` service port is used
+    
+    Thus, in case of two sides port definition, Traefik expects a match between ports.
+    
+    ??? example "Examples"
+        
+        ```yaml tab="IngressRouteUDP"
+        ---
+        apiVersion: traefik.containo.us/v1alpha1
+        kind: IngressRouteUDP
+        metadata:
+          name: test.route
+          namespace: default
+        
+        spec:
+          entryPoints:
+            - foo
+        
+          routes:
+          - services:
+            - name: external-svc
+              port: 80
+        
+        ---
+        apiVersion: v1
+        kind: Service
+        metadata:
+          name: external-svc
+          namespace: default
+        spec:
+          externalName: external.domain
+          type: ExternalName
+        ```
+        
+        ```yaml tab="ExternalName Service"
+        ---
+        apiVersion: traefik.containo.us/v1alpha1
+        kind: IngressRouteUDP
+        metadata:
+          name: test.route
+          namespace: default
+        
+        spec:
+          entryPoints:
+            - foo
+        
+          routes:
+          - services:
+            - name: external-svc
+        
+        ---
+        apiVersion: v1
+        kind: Service
+        metadata:
+          name: external-svc
+          namespace: default
+        spec:
+          externalName: external.domain
+          type: ExternalName
+          ports:
+            - port: 80
+        ```
+        
+        ```yaml tab="Both sides"
+        ---
+        apiVersion: traefik.containo.us/v1alpha1
+        kind: IngressRouteUDP
+        metadata:
+          name: test.route
+          namespace: default
+        
+        spec:
+          entryPoints:
+            - foo
+        
+          routes:
+          - services:
+            - name: external-svc
+              port: 80
+        
+        ---
+        apiVersion: v1
+        kind: Service
+        metadata:
+          name: external-svc
+          namespace: default
+        spec:
+          externalName: external.domain
+          type: ExternalName
+          ports:
+            - port: 80
+        ```
+
 ### Kind: `TLSOption`
 
 `TLSOption` is the CRD implementation of a [Traefik "TLS Option"](../../https/tls.md#tls-options).
@@ -1351,16 +1451,20 @@ or referencing TLS options in the [`IngressRoute`](#kind-ingressroute) / [`Ingre
       sniStrict: true                               # [8]
     ```
 
-| Ref | Attribute                   | Purpose                                                                                                                                                                    |
-|-----|-----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| [1] | `minVersion`                | Defines the [minimum TLS version](../../https/tls.md#minimum-tls-version) that is acceptable                                                                               |
-| [2] | `maxVersion`                | Defines the [maximum TLS version](../../https/tls.md#maximum-tls-version) that is acceptable                                                                               |
-| [3] | `cipherSuites`              | list of supported [cipher suites](../../https/tls.md#cipher-suites) for TLS versions up to TLS 1.2                                                                         |
-| [4] | `curvePreferences`          | List of the [elliptic curves references](../../https/tls.md#curve-preferences) that will be used in an ECDHE handshake, in preference order                                |
-| [5] | `clientAuth`                | determines the server's policy for TLS [Client Authentication](../../https/tls.md#client-authentication-mtls)                                                              |
-| [6] | `clientAuth.secretNames`    | list of names of the referenced Kubernetes [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) (in TLSOption namespace)                                   |
-| [7] | `clientAuth.clientAuthType` | defines the client authentication type to apply. The available values are: `NoClientCert`, `RequestClientCert`, `VerifyClientCertIfGiven` and `RequireAndVerifyClientCert` |
-| [8] | `sniStrict`                 | if `true`, Traefik won't allow connections from clients connections that do not specify a server_name extension                                                            |
+| Ref | Attribute                   | Purpose                                                                                                                                                                                                                    |
+|-----|-----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [1] | `minVersion`                | Defines the [minimum TLS version](../../https/tls.md#minimum-tls-version) that is acceptable                                                                                                                               |
+| [2] | `maxVersion`                | Defines the [maximum TLS version](../../https/tls.md#maximum-tls-version) that is acceptable                                                                                                                               |
+| [3] | `cipherSuites`              | list of supported [cipher suites](../../https/tls.md#cipher-suites) for TLS versions up to TLS 1.2                                                                                                                         |
+| [4] | `curvePreferences`          | List of the [elliptic curves references](../../https/tls.md#curve-preferences) that will be used in an ECDHE handshake, in preference order                                                                                |
+| [5] | `clientAuth`                | determines the server's policy for TLS [Client Authentication](../../https/tls.md#client-authentication-mtls)                                                                                                              |
+| [6] | `clientAuth.secretNames`    | list of names of the referenced Kubernetes [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) (in TLSOption namespace). The secret must contain a certificate under either a `tls.ca` or a `ca.crt` key. |
+| [7] | `clientAuth.clientAuthType` | defines the client authentication type to apply. The available values are: `NoClientCert`, `RequestClientCert`, `VerifyClientCertIfGiven` and `RequireAndVerifyClientCert`                                                 |
+| [8] | `sniStrict`                 | if `true`, Traefik won't allow connections from clients connections that do not specify a server_name extension                                                                                                            |
+
+!!! info "CA Secret"
+
+    The CA secret must contain a base64 encoded certificate under either a `tls.ca` or a `ca.crt` key.
 
 ??? example "Declaring and referencing a TLSOption"
    
@@ -1413,6 +1517,7 @@ or referencing TLS options in the [`IngressRoute`](#kind-ingressroute) / [`Ingre
       namespace: default
     
     data:
+      # Must contain a certificate under either a `tls.ca` or a `ca.crt` key.
       tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
     
     ---
@@ -1423,6 +1528,7 @@ or referencing TLS options in the [`IngressRoute`](#kind-ingressroute) / [`Ingre
       namespace: default
     
     data:
+      # Must contain a certificate under either a `tls.ca` or a `ca.crt` key. 
       tls.ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
     ```
         
@@ -1542,19 +1648,25 @@ or referencing TLS stores in the [`IngressRoute`](#kind-ingressroute) / [`Ingres
         dialTimeout: 42s               # [7]
         responseHeaderTimeout: 42s     # [8]
         idleConnTimeout: 42s           # [9]
+      peerCertURI: foobar              # [10]
     ```
 
-| Ref | Attribute               | Purpose                                                                                                                                              |
-|-----|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|
-| [1] | `serverName`            | ServerName used to contact the server.                                                                                                               |
-| [2] | `insecureSkipVerify`    | Disable SSL certificate verification.                                                                                                                |
-| [3] | `rootCAsSecrets`        | Add cert file for self-signed certificate.                                                                                                           |
-| [4] | `certificatesSecrets`   | Certificates for mTLS.                                                                                                                               |
-| [5] | `maxIdleConnsPerHost`   | If non-zero, controls the maximum idle (keep-alive) to keep per-host. If zero, `defaultMaxIdleConnsPerHost` is used.                                 |
-| [6] | `forwardingTimeouts`    | Timeouts for requests forwarded to the backend servers.                                                                                              |
-| [7] | `dialTimeout`           | The amount of time to wait until a connection to a backend server can be established. If zero, no timeout exists.                                    |
-| [8] | `responseHeaderTimeout` | The amount of time to wait for a server's response headers after fully writing the request (including its body, if any). If zero, no timeout exists. |
-| [9] | `idleConnTimeout`       | The maximum period for which an idle HTTP keep-alive connection will remain open before closing itself.                                              |
+| Ref  | Attribute               | Purpose                                                                                                                                              |
+|------|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [1]  | `serverName`            | ServerName used to contact the server.                                                                                                               |
+| [2]  | `insecureSkipVerify`    | Disable SSL certificate verification.                                                                                                                |
+| [3]  | `rootCAsSecrets`        | Add cert file for self-signed certificate. The secret must contain a certificate under either a tls.ca or a ca.crt key.                              |
+| [4]  | `certificatesSecrets`   | Certificates for mTLS.                                                                                                                               |
+| [5]  | `maxIdleConnsPerHost`   | If non-zero, controls the maximum idle (keep-alive) to keep per-host. If zero, `defaultMaxIdleConnsPerHost` is used.                                 |
+| [6]  | `forwardingTimeouts`    | Timeouts for requests forwarded to the backend servers.                                                                                              |
+| [7]  | `dialTimeout`           | The amount of time to wait until a connection to a backend server can be established. If zero, no timeout exists.                                    |
+| [8]  | `responseHeaderTimeout` | The amount of time to wait for a server's response headers after fully writing the request (including its body, if any). If zero, no timeout exists. |
+| [9]  | `idleConnTimeout`       | The maximum period for which an idle HTTP keep-alive connection will remain open before closing itself.                                              |
+| [10] | `peerCertURI`           | URI used to match with service certificate.                                                                                                          |
+
+!!! info "CA Secret"
+
+    The CA secret must contain a base64 encoded certificate under either a `tls.ca` or a `ca.crt` key.
 
 ??? example "Declaring and referencing a ServersTransport"
    

docs/content/routing/providers/kubernetes-gateway.md

@@ -33,11 +33,13 @@ The Kubernetes Gateway API, The Experimental Way.
     
 You can find an excerpt of the supported Kubernetes Gateway API resources in the table below:
 
-| Kind                               | Purpose                                                                   | Concept Behind                                                              |
-|------------------------------------|---------------------------------------------------------------------------|-----------------------------------------------------------------------------|
-| [GatewayClass](#kind-gatewayclass) | Defines a set of Gateways that share a common configuration and behaviour | [GatewayClass](https://gateway-api.sigs.k8s.io/api-types/gatewayclass)  |
-| [Gateway](#kind-gateway)           | Describes how traffic can be translated to Services within the cluster    | [Gateway](https://gateway-api.sigs.k8s.io/api-types/gateway)            |
-| [HTTPRoute](#kind-httproute)       | HTTP rules for mapping requests from a Gateway to Kubernetes Services     | [Route](https://gateway-api.sigs.k8s.io/api-types/httproute)      |
+| Kind                               | Purpose                                                                   | Concept Behind                                                                       |
+|------------------------------------|---------------------------------------------------------------------------|--------------------------------------------------------------------------------------|
+| [GatewayClass](#kind-gatewayclass) | Defines a set of Gateways that share a common configuration and behaviour | [GatewayClass](https://gateway-api.sigs.k8s.io/api-types/gatewayclass)               |
+| [Gateway](#kind-gateway)           | Describes how traffic can be translated to Services within the cluster    | [Gateway](https://gateway-api.sigs.k8s.io/api-types/gateway)                         |
+| [HTTPRoute](#kind-httproute)       | HTTP rules for mapping requests from a Gateway to Kubernetes Services     | [Route](https://gateway-api.sigs.k8s.io/api-types/httproute)                         |
+| [TCPRoute](#kind-tcproute)         | Allows mapping TCP requests from a Gateway to Kubernetes Services         | [Route](https://gateway-api.sigs.k8s.io/concepts/api-overview/#httptcpfooroute)      |
+| [TLSRoute](#kind-tlsroute)         | Allows mapping TLS requests from a Gateway to Kubernetes Services         | [Route](https://gateway-api.sigs.k8s.io/concepts/api-overview/#httptcpfooroute)      |
 
 ### Kind: `GatewayClass`
 
@@ -70,43 +72,114 @@ More details on the Gateway [official documentation](https://gateway-api.sigs.k8
 Register the `Gateway` [definition](../../reference/dynamic-configuration/kubernetes-gateway.md#definitions) in the
 Kubernetes cluster before creating `Gateway` objects.
 
+Depending on the Listener Protocol, different modes and Route types are supported.
+
+| Listener Protocol | TLS Mode       | Route Type Supported         |
+|-------------------|----------------|------------------------------|
+| TCP               | Not applicable | [TCPRoute](#kind-tcproute)   |
+| TLS               | Passthrough    | [TLSRoute](#kind-tlsroute)   |
+| TLS               | Terminate      | [TCPRoute](#kind-tcproute)   |
+| HTTP              | Not applicable | [HTTPRoute](#kind-httproute) |
+| HTTPS             | Terminate      | [HTTPRoute](#kind-httproute) |
+
 !!! info "Declaring Gateway"
 
-    ```
+    ```yaml tab="HTTP Listener"
     kind: Gateway
     apiVersion: networking.x-k8s.io/v1alpha1
     metadata:
-      name: my-gateway
+      name: my-http-gateway
+      namespace: default
+    spec:
+      gatewayClassName: my-gateway-class        # [1]
+      listeners:                                # [2]
+        - protocol: HTTP                        # [3] 
+          port: 80                              # [4]
+          routes:                               # [8]
+            kind: HTTPRoute                     # [9]
+            selector:                           # [10]
+              matchLabels:                      # [11]
+                app: foo
+    ```
+
+    ```yaml tab="HTTPS Listener"
+    kind: Gateway
+    apiVersion: networking.x-k8s.io/v1alpha1
+    metadata:
+      name: my-https-gateway
       namespace: default
     spec:
       gatewayClassName: my-gateway-class        # [1]
       listeners:                                # [2]
         - protocol: HTTPS                       # [3] 
           port: 443                             # [4]
-          tls:                                  # [5]
-            certificateRef:                     # [6]
+          tls:                                  # [6]
+            certificateRef:                     # [7]
               group: "core"
               kind: "Secret"
               name: "mysecret"
-          routes:                               # [7]
-            kind: HTTPRoute                     # [8]
-            selector:                           # [9]
-              matchLabels:                      # [10]
+          routes:                               # [8]
+            kind: HTTPRoute                     # [9]
+            selector:                           # [10]
+              matchLabels:                      # [11]
                 app: foo
     ```
 
-| Ref  | Attribute          | Description                                                                                                                 |
-|------|--------------------|-----------------------------------------------------------------------------------------------------------------------------|
-| [1]  | `gatewayClassName` | GatewayClassName used for this Gateway. This is the name of a GatewayClass resource.                                        |
-| [2]  | `listeners`        | Logical endpoints that are bound on this Gateway's addresses. At least one Listener MUST be specified.                      |
-| [3]  | `protocol`         | The network protocol this listener expects to receive (only HTTP and HTTPS are implemented).                                |
-| [4]  | `port`             | The network port.                                                                                                           |
-| [5]  | `tls`              | TLS configuration for the Listener. This field is required if the Protocol field is "HTTPS" or "TLS" and ignored otherwise. |
-| [6]  | `certificateRef`   | The reference to Kubernetes object that contains a TLS certificate and private key.                                         |
-| [7]  | `routes`           | A schema for associating routes with the Listener using selectors.                                                          |
-| [8]  | `kind`             | The kind of the referent.                                                                                                   |
-| [9]  | `selector`         | Routes in namespaces selected by the selector may be used by this Gateway routes to associate with the Gateway.   |
-| [10] | `matchLabels`      | A set of route labels used for selecting routes to associate with the Gateway.                                              |
+    ```yaml tab="TCP Listener"
+    kind: Gateway
+    apiVersion: networking.x-k8s.io/v1alpha1
+    metadata:
+      name: my-tcp-gateway
+      namespace: default
+    spec:
+      gatewayClassName: my-gateway-class        # [1]
+      listeners:                                # [2]
+        - protocol: TCP                         # [3] 
+          port: 8000                            # [4]
+          routes:                               # [8]
+            kind: TCPRoute                      # [9]
+            selector:                           # [10]
+              matchLabels:                      # [11]
+                app: footcp
+    ```
+
+    ```yaml tab="TLS Listener"
+    kind: Gateway
+    apiVersion: networking.x-k8s.io/v1alpha1
+    metadata:
+      name: my-tls-gateway
+      namespace: default
+    spec:
+      gatewayClassName: my-gateway-class        # [1]
+      listeners:                                # [2]
+        - protocol: TLS                         # [3] 
+          port: 443                             # [4]
+          hostname: foo.com                     # [5]
+          tls:                                  # [6]
+            certificateRef:                     # [7]
+              group: "core"
+              kind: "Secret"
+              name: "mysecret"
+          routes:                               # [8]
+            kind: TLSRoute                      # [9]
+            selector:                           # [10]
+              matchLabels:                      # [11]
+                app: footcp
+    ```
+
+| Ref  | Attribute          | Description                                                                                                                                          |
+|------|--------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [1]  | `gatewayClassName` | GatewayClassName used for this Gateway. This is the name of a GatewayClass resource.                                                                 |
+| [2]  | `listeners`        | Logical endpoints that are bound on this Gateway's addresses. At least one Listener MUST be specified.                                               |
+| [3]  | `protocol`         | The network protocol this listener expects to receive (only HTTP and HTTPS are implemented).                                                         |
+| [4]  | `port`             | The network port.                                                                                                                                    |
+| [5]  | `hostname`         | Hostname specifies the virtual hostname to match for protocol types that define this concept. When unspecified, “”, or *, all hostnames are matched. |
+| [6]  | `tls`              | TLS configuration for the Listener. This field is required if the Protocol field is "HTTPS" or "TLS" and ignored otherwise.                          |
+| [7]  | `certificateRef`   | The reference to Kubernetes object that contains a TLS certificate and private key.                                                                  |
+| [8]  | `routes`           | A schema for associating routes with the Listener using selectors.                                                                                   |
+| [9]  | `kind`             | The kind of the referent.                                                                                                                            |
+| [10] | `selector`         | Routes in namespaces selected by the selector may be used by this Gateway routes to associate with the Gateway.                                      |
+| [11] | `matchLabels`      | A set of route labels used for selecting routes to associate with the Gateway.                                                                       |
 
 ### Kind: `HTTPRoute`
 
@@ -123,39 +196,133 @@ Kubernetes cluster before creating `HTTPRoute` objects.
     metadata:
       name: http-app-1
       namespace: default
-      labels:                       # [1]
+      labels:                                   # [1]
         app: foo
     spec:
-      hostnames:                    # [2]
+      hostnames:                                # [2]
         - "whoami"
-      rules:                        # [3]
-        - matches:                  # [4]
-            - path:                 # [5]
-                type: Exact         # [6]
-                value: /bar         # [7]
-            - headers:              # [8]
-                type: Exact         # [9]
-                values:             # [10]
+      rules:                                    # [3]
+        - matches:                              # [4]
+            - path:                             # [5]
+                type: Exact                     # [6]
+                value: /bar                     # [7]
+            - headers:                          # [8]
+                type: Exact                     # [9]
+                values:                         # [10]
                   foo: bar
-          forwardTo:                # [11]
-            - serviceName: whoami   # [12]
-              weight: 1             # [13]
-              port: 80              # [14]
+          forwardTo:                            # [11]
+            - serviceName: whoami               # [12]
+              weight: 1                         # [13]
+              port: 80                          # [14]
+            - backendRef:                       # [15]
+                group: traefik.containo.us      # [16]
+                kind: TraefikService            # [17]
+                name: api@internal              # [18]
+              port: 80
+              weight: 1
     ```
 
-| Ref  | Attribute     | Description                                                                                                                                                                 |
-|------|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| [1]  | `labels`      | Labels to match with the `Gateway` labelselector.                                                                                                                           |
-| [2]  | `hostnames`   | A set of hostname that should match against the HTTP Host header to select a HTTPRoute to process the request.                                                              |
-| [3]  | `rules`       | A list of HTTP matchers, filters and actions.                                                                                                                               |
-| [4]  | `matches`     | Conditions used for matching the rule against incoming HTTP requests. Each match is independent, i.e. this rule will be matched if **any** one of the matches is satisfied. |
-| [5]  | `path`        | An HTTP request path matcher. If this field is not specified, a default prefix match on the "/" path is provided.                                                           |
-| [6]  | `type`        | Type of match against the path Value (supported types: `Exact`, `Prefix`).                                                                                                  |
-| [7]  | `value`       | The value of the HTTP path to match against.                                                                                                                                |
-| [8]  | `headers`     | Conditions to select a HTTP route by matching HTTP request headers.                                                                                                         |
-| [9]  | `type`        | Type of match for the HTTP request header match against the `values` (supported types: `Exact`).                                                                            |
-| [10] | `values`      | A map of HTTP Headers to be matched. It MUST contain at least one entry.                                                                                                    |
-| [11] | `forwardTo`   | The upstream target(s) where the request should be sent.                                                                                                                    |
-| [12] | `serviceName` | The name of the referent service.                                                                                                                                           |
-| [13] | `weight`      | The proportion of traffic forwarded to a targetRef, computed as weight/(sum of all weights in targetRefs).                                                                  |
-| [14] | `port`        | The port of the referent service.                                                                                                                                           |
+| Ref  | Attribute     | Description                                                                                                                                                                                                                                  |
+|------|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [1]  | `labels`      | Labels to match with the `Gateway` labelselector.                                                                                                                                                                                            |
+| [2]  | `hostnames`   | A set of hostname that should match against the HTTP Host header to select a HTTPRoute to process the request.                                                                                                                               |
+| [3]  | `rules`       | A list of HTTP matchers, filters and actions.                                                                                                                                                                                                |
+| [4]  | `matches`     | Conditions used for matching the rule against incoming HTTP requests. Each match is independent, i.e. this rule will be matched if **any** one of the matches is satisfied.                                                                  |
+| [5]  | `path`        | An HTTP request path matcher. If this field is not specified, a default prefix match on the "/" path is provided.                                                                                                                            |
+| [6]  | `type`        | Type of match against the path Value (supported types: `Exact`, `Prefix`).                                                                                                                                                                   |
+| [7]  | `value`       | The value of the HTTP path to match against.                                                                                                                                                                                                 |
+| [8]  | `headers`     | Conditions to select a HTTP route by matching HTTP request headers.                                                                                                                                                                          |
+| [9]  | `type`        | Type of match for the HTTP request header match against the `values` (supported types: `Exact`).                                                                                                                                             |
+| [10] | `values`      | A map of HTTP Headers to be matched. It MUST contain at least one entry.                                                                                                                                                                     |
+| [11] | `forwardTo`   | The upstream target(s) where the request should be sent.                                                                                                                                                                                     |
+| [12] | `serviceName` | The name of the referent service.                                                                                                                                                                                                            |
+| [13] | `weight`      | The proportion of traffic forwarded to a targetRef, computed as weight/(sum of all weights in targetRefs).                                                                                                                                   |
+| [14] | `port`        | The port of the referent service.                                                                                                                                                                                                            |
+| [15] | `backendRef`  | The BackendRef is a reference to a backend (API object within a known namespace) to forward matched requests to. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. Only `TraefikService` is supported. |
+| [16] | `group`       | Group is the group of the referent. Only `traefik.containo.us` value is supported.                                                                                                                                                           |
+| [17] | `kind`        | Kind is kind of the referent. Only `TraefikService` value is supported.                                                                                                                                                                      |
+| [18] | `name`        | Name is the name of the referent.                                                                                                                                                                                                            |
+
+### Kind: `TCPRoute`
+
+`TCPRoute` allows mapping TCP requests from a `Gateway` to Kubernetes Services
+
+Register the `TCPRoute` [definition](../../reference/dynamic-configuration/kubernetes-gateway.md#definitions) in the
+Kubernetes cluster before creating `TCPRoute` objects.
+
+!!! info "Declaring TCPRoute"
+
+    ```yaml
+    kind: TCPRoute
+    apiVersion: networking.x-k8s.io/v1alpha1
+    metadata:
+      name: tcp-app-1
+      namespace: default
+      labels:                                   # [1]
+        app: tcp-app-1
+    spec:
+      rules:                                    # [2]
+        - forwardTo:                            # [3]
+            - serviceName: whoamitcp            # [4]
+              weight: 1                         # [5]
+              port: 8080                        # [6]
+            - backendRef:                       # [7]
+                group: traefik.containo.us      # [8]
+                kind: TraefikService            # [9]
+                name: api@internal              # [10]
+    ```
+
+| Ref  | Attribute     | Description                                                                                                                                                                                                                                  |
+|------|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [1]  | `labels`      | Labels to match with the `Gateway` labelselector.                                                                                                                                                                                            |
+| [2]  | `rules`       | Rules are a list of TCP matchers and actions.                                                                                                                                                                                                |
+| [3]  | `forwardTo`   | The upstream target(s) where the request should be sent.                                                                                                                                                                                     |
+| [4]  | `serviceName` | The name of the referent service.                                                                                                                                                                                                            |
+| [5]  | `weight`      | The proportion of traffic forwarded to a targetRef, computed as weight/(sum of all weights in targetRefs).                                                                                                                                   |
+| [6]  | `port`        | The port of the referent service.                                                                                                                                                                                                            |
+| [7]  | `backendRef`  | The BackendRef is a reference to a backend (API object within a known namespace) to forward matched requests to. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. Only `TraefikService` is supported. |
+| [8]  | `group`       | Group is the group of the referent. Only `traefik.containo.us` value is supported.                                                                                                                                                           |
+| [9]  | `kind`        | Kind is kind of the referent. Only `TraefikService` value is supported.                                                                                                                                                                      |
+| [10] | `name`        | Name is the name of the referent.                                                                                                                                                                                                            |
+
+### Kind: `TLSRoute`
+
+`TLSRoute` allows mapping TLS requests from a `Gateway` to Kubernetes Services
+
+Register the `TLSRoute` [definition](../../reference/dynamic-configuration/kubernetes-gateway.md#definitions) in the
+Kubernetes cluster before creating `TLSRoute` objects.
+
+!!! info "Declaring TCPRoute"
+
+    ```yaml
+    kind: TLSRoute
+    apiVersion: networking.x-k8s.io/v1alpha1
+    metadata:
+      name: tls-app-1
+      namespace: default
+      labels:                                   # [1]
+        app: tls-app-1
+    spec:
+      rules:                                    # [2]
+        - forwardTo:                            # [3]
+            - serviceName: whoamitcp            # [4]
+              weight: 1                         # [5]
+              port: 8080                        # [6]
+            - backendRef:                       # [7]
+                group: traefik.containo.us      # [8]
+                kind: TraefikService            # [9]
+                name: api@internal              # [10]
+    ```
+
+| Ref  | Attribute     | Description                                                                                                                                                                                                                                  |
+|------|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| [1]  | `labels`      | Labels to match with the `Gateway` labelselector.                                                                                                                                                                                            |
+| [2]  | `rules`       | Rules are a list of TCP matchers and actions.                                                                                                                                                                                                |
+| [3]  | `forwardTo`   | The upstream target(s) where the request should be sent.                                                                                                                                                                                     |
+| [4]  | `serviceName` | The name of the referent service.                                                                                                                                                                                                            |
+| [5]  | `weight`      | The proportion of traffic forwarded to a targetRef, computed as weight/(sum of all weights in targetRefs).                                                                                                                                   |
+| [6]  | `port`        | The port of the referent service.                                                                                                                                                                                                            |
+| [7]  | `backendRef`  | The BackendRef is a reference to a backend (API object within a known namespace) to forward matched requests to. If both BackendRef and ServiceName are specified, ServiceName will be given precedence. Only `TraefikService` is supported. |
+| [8]  | `group`       | Group is the group of the referent. Only `traefik.containo.us` value is supported.                                                                                                                                                           |
+| [9]  | `kind`        | Kind is kind of the referent. Only `TraefikService` value is supported.                                                                                                                                                                      |
+| [10] | `name`        | Name is the name of the referent.                                                                                                                                                                                                            |

docs/content/routing/providers/kubernetes-ingress.md

@@ -85,6 +85,33 @@ which in turn will create the resulting routers, services, handlers, etc.
                   servicePort: 80
     ```
     
+    ```yaml tab="Ingress Kubernetes v1.19+"
+    kind: Ingress
+    apiVersion: networking.k8s.io/v1
+    metadata:
+      name: myingress
+      annotations:
+        traefik.ingress.kubernetes.io/router.entrypoints: web
+    
+    spec:
+      rules:
+        - host: example.com
+          http:
+            paths:
+              - path: /bar
+                backend:
+                  service:
+                    name:  whoami
+                    port:
+                      number: 80
+              - path: /foo
+                backend:
+                  service:
+                    name:  whoami
+                    port:
+                      number: 80
+    ```
+    
     ```yaml tab="Traefik"
     apiVersion: v1
     kind: ServiceAccount
@@ -112,7 +139,7 @@ which in turn will create the resulting routers, services, handlers, etc.
           serviceAccountName: traefik-ingress-controller
           containers:
             - name: traefik
-              image: traefik:v2.4
+              image: traefik:v2.5
               args:
                 - --entrypoints.web.address=:80
                 - --providers.kubernetesingress
@@ -267,6 +294,14 @@ which in turn will create the resulting routers, services, handlers, etc.
     traefik.ingress.kubernetes.io/service.serversscheme: h2c
     ```
 
+??? info "`traefik.ingress.kubernetes.io/service.serverstransport`"
+
+    See [ServersTransport](../services/index.md#serverstransport) for more information.
+
+    ```yaml
+    traefik.ingress.kubernetes.io/service.serverstransport: foobar@file
+    ```
+
 ??? info "`traefik.ingress.kubernetes.io/service.passhostheader`"
 
     See [pass Host header](../services/index.md#pass-host-header) for more information.
@@ -434,6 +469,33 @@ This way, any Ingress attached to this Entrypoint will have TLS termination by d
                   servicePort: 80
     ```
     
+    ```yaml tab="Ingress Kubernetes v1.19+"
+    kind: Ingress
+    apiVersion: networking.k8s.io/v1
+    metadata:
+      name: myingress
+      annotations:
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    
+    spec:
+      rules:
+        - host: example.com
+          http:
+            paths:
+              - path: /bar
+                backend:
+                  service:
+                    name:  whoami
+                    port:
+                      number: 80
+              - path: /foo
+                backend:
+                  service:
+                    name:  whoami
+                    port:
+                      number: 80
+    ```
+    
     ```yaml tab="Traefik"
     apiVersion: v1
     kind: ServiceAccount
@@ -461,7 +523,7 @@ This way, any Ingress attached to this Entrypoint will have TLS termination by d
           serviceAccountName: traefik-ingress-controller
           containers:
             - name: traefik
-              image: traefik:v2.4
+              image: traefik:v2.5
               args:
                 - --entrypoints.websecure.address=:443
                 - --entrypoints.websecure.http.tls
@@ -613,6 +675,34 @@ For more options, please refer to the available [annotations](#on-ingress).
                   servicePort: 80
     ```
     
+    ```yaml tab="Ingress Kubernetes v1.19+"
+    kind: Ingress
+    apiVersion: networking.k8s.io/v1
+    metadata:
+      name: myingress
+      annotations:
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: true
+    
+    spec:
+      rules:
+        - host: example.com
+          http:
+            paths:
+              - path: /bar
+                backend:
+                  service:
+                    name:  whoami
+                    port:
+                      number: 80
+              - path: /foo
+                backend:
+                  service:
+                    name:  whoami
+                    port:
+                      number: 80
+    ```
+    
     ```yaml tab="Traefik"
     apiVersion: v1
     kind: ServiceAccount
@@ -640,7 +730,7 @@ For more options, please refer to the available [annotations](#on-ingress).
           serviceAccountName: traefik-ingress-controller
           containers:
             - name: traefik
-              image: traefik:v2.4
+              image: traefik:v2.5
               args:
                 - --entrypoints.websecure.address=:443
                 - --providers.kubernetesingress
@@ -732,6 +822,31 @@ For more options, please refer to the available [annotations](#on-ingress).
       tls:
       - secretName: supersecret
     ```
+
+    ```yaml tab="Ingress Kubernetes v1.19+"
+    kind: Ingress
+    apiVersion: networking.k8s.io/v1
+    metadata:
+      name: foo
+      namespace: production
+    
+    spec:
+      rules:
+      - host: example.net
+        http:
+          paths:
+          - path: /bar
+            backend:
+              service:
+                name:  service1
+                port:
+                  number: 80
+      # Only selects which certificate(s) should be loaded from the secret, in order to terminate TLS.
+      # Doesn't enable TLS for that ingress (hence for the underlying router).
+      # Please see the TLS annotations on ingress made for that purpose.
+      tls:
+      - secretName: supersecret
+    ```
       
     ```yaml tab="Secret"
     apiVersion: v1
@@ -777,16 +892,30 @@ and will connect via TLS automatically.
 
 Ingresses can be created that look like the following:
 
-```yaml
+```yaml tab="Ingress"
 apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
  name: cheese
 
 spec:
- backend:
-   serviceName: stilton
-   servicePort: 80
+  defaultBackend:
+    serviceName: stilton
+    serverPort: 80
+```
+
+```yaml tab="Ingress Kubernetes v1.19+"
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+ name: cheese
+
+spec:
+  defaultBackend:
+    service:
+      name: stilton
+      port:
+        number: 80
 ```
 
 This ingress follows the Global Default Backend property of ingresses.

docs/content/routing/providers/marathon.md

@@ -293,7 +293,7 @@ For example, to change the passHostHeader behavior, you'd add the label `"traefi
 
 You can declare pieces of middleware using labels starting with `traefik.http.middlewares.{middleware-name-of-your-choice}.`, followed by the middleware type/options.
 
-For example, to declare a middleware [`redirectscheme`](../../middlewares/redirectscheme.md) named `my-redirect`, you'd write `"traefik.http.middlewares.my-redirect.redirectscheme.scheme": "https"`.
+For example, to declare a middleware [`redirectscheme`](../../middlewares/http/redirectscheme.md) named `my-redirect`, you'd write `"traefik.http.middlewares.my-redirect.redirectscheme.scheme": "https"`.
 
 More information about available middlewares in the dedicated [middlewares section](../../middlewares/overview.md).
 

docs/content/routing/providers/rancher.md

@@ -299,7 +299,7 @@ you'd add the label `traefik.http.services.{name-of-your-choice}.loadbalancer.pa
 
 You can declare pieces of middleware using labels starting with `traefik.http.middlewares.{name-of-your-choice}.`, followed by the middleware type/options.
 
-For example, to declare a middleware [`redirectscheme`](../../middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
+For example, to declare a middleware [`redirectscheme`](../../middlewares/http/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
 
 More information about available middlewares in the dedicated [middlewares section](../../middlewares/overview.md).
 

docs/content/routing/routers/index.md

@@ -239,6 +239,7 @@ The table below lists all the available matchers:
 | ```Path(`/path`, `/articles/{cat:[a-z]+}/{id:[0-9]+}`, ...)```         | Match exact request path. It accepts a sequence of literal and regular expression paths.                       |
 | ```PathPrefix(`/products/`, `/articles/{cat:[a-z]+}/{id:[0-9]+}`)```   | Match request prefix path. It accepts a sequence of literal and regular expression prefix paths.               |
 | ```Query(`foo=bar`, `bar=baz`)```                                      | Match Query String parameters. It accepts a sequence of key=value pairs.                                       |
+| ```ClientIP(`10.0.0.0/16`, `::1`)```                                   | Match if the request client IP is one of the given IP/CIDR. It accepts IPv4, IPv6 and CIDR formats.            |
 
 !!! important "Non-ASCII Domain Names"
 
@@ -256,6 +257,10 @@ The table below lists all the available matchers:
 
     You can combine multiple matchers using the AND (`&&`) and OR (`||`) operators. You can also use parenthesis.
 
+!!! info "Invert a matcher"
+
+    You can invert a matcher by using the `!` operator.
+
 !!! important "Rule, Middleware, and Services"
 
     The rule is evaluated "before" any middleware has the opportunity to work, and "before" the request is forwarded to the service.
@@ -268,6 +273,10 @@ The table below lists all the available matchers:
     For instance, `PathPrefix: /products` would match `/products` but also `/products/shoes` and `/products/shirts`.
     Since the path is forwarded as-is, your service is expected to listen on `/products`.
 
+!!! info "ClientIP matcher"
+
+    The `ClientIP` matcher will only match the request client IP and does not use the `X-Forwarded-For` header for matching.
+
 ### Priority
 
 To avoid path overlap, routes are sorted, by default, in descending order using rules length. The priority is directly equal to the length of the rule, and so the longest length has the highest priority.
@@ -799,6 +808,41 @@ If you want to limit the router scope to a set of entry points, set the entry po
     Hence, only TLS routers will be able to specify a domain name with that rule.
     However, non-TLS routers will have to explicitly use that rule with `*` (every domain) to state that every non-TLS request will be handled by the router.
 
+### Middlewares
+
+You can attach a list of [middlewares](../../middlewares/overview.md) to each TCP router.
+The middlewares will take effect only if the rule matches, and before connecting to the service.
+
+!!! warning "The character `@` is not allowed to be used in the middleware name."
+
+!!! tip "Middlewares order"
+
+    Middlewares are applied in the same order as their declaration in **router**.
+
+??? example "With a [middleware](../../middlewares/tcp/overview.md) -- using the [File Provider](../../providers/file.md)"
+
+    ```toml tab="TOML"
+    ## Dynamic configuration
+    [tcp.routers]
+      [tcp.routers.my-router]
+        rule = "HostSNI(`*`)"
+        # declared elsewhere
+        middlewares = ["ipwhitelist"]
+        service = "service-foo"
+    ```
+
+    ```yaml tab="YAML"
+    ## Dynamic configuration
+    tcp:
+      routers:
+        my-router:
+          rule: "HostSNI(`*`)"
+          # declared elsewhere
+          middlewares:
+          - ipwhitelist
+          service: service-foo
+    ```
+
 ### Services
 
 You must attach a TCP [service](../services/index.md) per TCP router.
@@ -993,8 +1037,9 @@ So UDP "routers" at this time are pretty much only load-balancers in one form or
 	It basically means that some state is kept about an ongoing communication between a client and a backend,
 	notably so that the proxy knows where to forward a response packet from a backend.
 	As expected, a `timeout` is associated to each of these sessions,
-	so that they get cleaned out if they go through a period of inactivity longer than a given duration (that is hardcoded to 3 seconds for now).
-	Making this timeout configurable will be considered later if we get more usage feedback on this matter.
+	so that they get cleaned out if they go through a period of inactivity longer than a given duration. 
+	Timeout can be configured using the `entryPoints.name.udp.timeout` option as described 
+	under [entry points](../entrypoints/#udp-options).
 
 ### EntryPoints
 

docs/content/routing/services/index.md

@@ -116,7 +116,7 @@ The `url` option point to a specific instance.
 !!! info ""
     Paths in the servers' `url` have no effect.
     If you want the requests to be sent to a specific path on your servers,
-    configure your [`routers`](../routers/index.md) to use a corresponding [middleware](../../middlewares/overview.md) (e.g. the [AddPrefix](../../middlewares/addprefix.md) or [ReplacePath](../../middlewares/replacepath.md)) middlewares.
+    configure your [`routers`](../routers/index.md) to use a corresponding [middleware](../../middlewares/overview.md) (e.g. the [AddPrefix](../../middlewares/http/addprefix.md) or [ReplacePath](../../middlewares/http/replacepath.md)) middlewares.
 
 ??? example "A Service with One Server -- Using the [File Provider](../../providers/file.md)"
 
@@ -167,8 +167,8 @@ For now, only round robin load balancing is supported:
 
 #### Sticky sessions
 
-When sticky sessions are enabled, a cookie is set on the initial request and response to let the client know which server handles the first response.
-On subsequent requests, to keep the session alive with the same server, the client should resend the same cookie.
+When sticky sessions are enabled, a `Set-Cookie` header is set on the initial response to let the client know which server handles the first response.
+On subsequent requests, to keep the session alive with the same server, the client should send the cookie with the value set.
 
 !!! info "Stickiness on multiple levels"
 
@@ -313,6 +313,8 @@ On subsequent requests, to keep the session alive with the same server, the clie
 Configure health check to remove unhealthy servers from the load balancing rotation.
 Traefik will consider your servers healthy as long as they return status codes between `2XX` and `3XX` to the health check requests (carried out every `interval`).
 
+To propagate status changes (e.g. all servers of this service are down) upwards, HealthCheck must also be enabled on the parent(s) of this service.
+
 Below are the available options for the health check mechanism:
 
 - `path` is appended to the server URL to set the health check endpoint.
@@ -705,6 +707,68 @@ spec:
     maxIdleConnsPerHost: 7
 ```
 
+#### `disableHTTP2`
+
+_Optional, Default=false_
+
+`disableHTTP2` disables HTTP/2 for connections with backend servers.
+
+```toml tab="File (TOML)"
+## Dynamic configuration
+[http.serversTransports.mytransport]
+  disableHTTP2 = true
+```
+
+```yaml tab="File (YAML)"
+## Dynamic configuration
+http:
+  serversTransports:
+    mytransport:
+      disableHTTP2: true
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: ServersTransport
+metadata:
+  name: mytransport
+  namespace: default
+
+spec:
+    disableHTTP2: true
+```
+
+#### `peerCertURI`
+
+_Optional, Default=false_
+
+`peerCertURI` defines the URI used to match against SAN URI during the peer certificate verification.
+
+```toml tab="File (TOML)"
+## Dynamic configuration
+[http.serversTransports.mytransport]
+  peerCertURI = "foobar"
+```
+
+```yaml tab="File (YAML)"
+## Dynamic configuration
+http:
+  serversTransports:
+    mytransport:
+      peerCertURI: foobar
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: ServersTransport
+metadata:
+  name: mytransport
+  namespace: default
+
+spec:
+    peerCertURI: foobar
+```
+
 #### `forwardingTimeouts`
 
 `forwardingTimeouts` is about a number of timeouts relevant to when forwarding requests to the backend servers.
@@ -869,6 +933,84 @@ http:
         url = "http://private-ip-server-2/"
 ```
 
+#### Health Check
+
+HealthCheck enables automatic self-healthcheck for this service, i.e. whenever
+one of its children is reported as down, this service becomes aware of it, and
+takes it into account (i.e. it ignores the down child) when running the
+load-balancing algorithm. In addition, if the parent of this service also has
+HealthCheck enabled, this service reports to its parent any status change.
+
+!!! info "All or nothing"
+
+    If HealthCheck is enabled for a given service, but any of its descendants does
+    not have it enabled, the creation of the service will fail.
+
+    HealthCheck on Weighted services can be defined currently only with the [File](../../providers/file.md) provider.
+
+```yaml tab="YAML"
+## Dynamic configuration
+http:
+  services:
+    app:
+      weighted:
+        healthCheck: {}
+        services:
+        - name: appv1
+          weight: 3
+        - name: appv2
+          weight: 1
+
+    appv1:
+      loadBalancer:
+        healthCheck:
+          path: /status
+          interval: 10s
+          timeout: 3s
+        servers:
+        - url: "http://private-ip-server-1/"
+
+    appv2:
+      loadBalancer:
+        healthCheck:
+          path: /status
+          interval: 10s
+          timeout: 3s
+        servers:
+        - url: "http://private-ip-server-2/"
+```
+
+```toml tab="TOML"
+## Dynamic configuration
+[http.services]
+  [http.services.app]
+    [http.services.app.weighted.healthCheck]
+    [[http.services.app.weighted.services]]
+      name = "appv1"
+      weight = 3
+    [[http.services.app.weighted.services]]
+      name = "appv2"
+      weight = 1
+
+  [http.services.appv1]
+    [http.services.appv1.loadBalancer]
+      [http.services.appv1.loadBalancer.healthCheck]
+        path = "/health"
+        interval = "10s"
+        timeout = "3s"
+      [[http.services.appv1.loadBalancer.servers]]
+        url = "http://private-ip-server-1/"
+
+  [http.services.appv2]
+    [http.services.appv2.loadBalancer]
+      [http.services.appv2.loadBalancer.healthCheck]
+        path = "/health"
+        interval = "10s"
+        timeout = "3s"
+      [[http.services.appv2.loadBalancer.servers]]
+        url = "http://private-ip-server-2/"
+```
+
 ### Mirroring (service)
 
 The mirroring is able to mirror requests sent to a service to other services.
@@ -930,6 +1072,76 @@ http:
         url = "http://private-ip-server-2/"
 ```
 
+#### Health Check
+
+HealthCheck enables automatic self-healthcheck for this service, i.e. if the
+main handler of the service becomes unreachable, the information is propagated
+upwards to its parent.
+
+!!! info "All or nothing"
+
+    If HealthCheck is enabled for a given service, but any of its descendants does
+    not have it enabled, the creation of the service will fail.
+
+    HealthCheck on Mirroring services can be defined currently only with the [File](../../providers/file.md) provider.
+
+```yaml tab="YAML"
+## Dynamic configuration
+http:
+  services:
+    mirrored-api:
+      mirroring:
+        healthCheck: {}
+        service: appv1
+        mirrors:
+        - name: appv2
+          percent: 10
+
+    appv1:
+      loadBalancer:
+        healthCheck:
+          path: /status
+          interval: 10s
+          timeout: 3s
+        servers:
+        - url: "http://private-ip-server-1/"
+
+    appv2:
+      loadBalancer:
+        servers:
+        - url: "http://private-ip-server-2/"
+```
+
+```toml tab="TOML"
+## Dynamic configuration
+[http.services]
+  [http.services.mirrored-api]
+    [http.services.mirrored-api.mirroring]
+      [http.services.mirrored-api.mirroring.healthCheck]
+      service = "appv1"
+    [[http.services.mirrored-api.mirroring.mirrors]]
+      name = "appv2"
+      percent = 10
+
+  [http.services.appv1]
+    [http.services.appv1.loadBalancer]
+      [http.services.appv1.loadBalancer.healthCheck]
+        path = "/health"
+        interval = "10s"
+        timeout = "3s"
+      [[http.services.appv1.loadBalancer.servers]]
+        url = "http://private-ip-server-1/"
+
+  [http.services.appv2]
+    [http.services.appv2.loadBalancer]
+      [http.services.appv1.loadBalancer.healthCheck]
+        path = "/health"
+        interval = "10s"
+        timeout = "3s"
+      [[http.services.appv2.loadBalancer.servers]]
+        url = "http://private-ip-server-2/"
+```
+
 ## Configuring TCP Services
 
 ### General

docs/content/user-guides/crd-acme/03-deployments.yml

@@ -26,7 +26,7 @@ spec:
       serviceAccountName: traefik-ingress-controller
       containers:
         - name: traefik
-          image: traefik:v2.4
+          image: traefik:v2.5
           args:
             - --api.insecure
             - --accesslog

docs/content/user-guides/crd-acme/index.md

@@ -43,7 +43,7 @@ First, the definition of the `IngressRoute` and the `Middleware` kinds.
 Also note the RBAC authorization resources; they'll be referenced through the `serviceAccountName` of the deployment, later on.
 
 ```yaml
---8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition.yml"
+--8<-- "content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml"
 
 ---
 --8<-- "content/reference/dynamic-configuration/kubernetes-crd-rbac.yml"