diff --git a/.github/workflows/template-webui.yaml b/.github/workflows/template-webui.yaml index b841c90f5..16af7d1e4 100644 --- a/.github/workflows/template-webui.yaml +++ b/.github/workflows/template-webui.yaml @@ -1,6 +1,8 @@ name: Build Web UI on: workflow_call: {} +env: + SAFE_CHAIN_MINIMUM_PACKAGE_AGE_HOURS: 360 # 15 days jobs: build-webui: @@ -22,6 +24,12 @@ jobs: cache: yarn cache-dependency-path: webui/yarn.lock + - name: Setup safe-chain + working-directory: ./webui + run: | + npm i -g @aikidosec/safe-chain + safe-chain setup-ci + - name: Build webui working-directory: ./webui run: | diff --git a/.github/workflows/test-gateway-api-conformance.yaml b/.github/workflows/test-gateway-api-conformance.yaml index 724a45776..fbeae3d27 100644 --- a/.github/workflows/test-gateway-api-conformance.yaml +++ b/.github/workflows/test-gateway-api-conformance.yaml @@ -9,6 +9,7 @@ on: - 'pkg/provider/kubernetes/gateway/**' - 'integration/fixtures/gateway-api-conformance/**' - 'integration/gateway_api_conformance_test.go' + - 'integration/integration_test.go' env: GO_VERSION: '1.24' diff --git a/.github/workflows/test-knative-conformance.yaml b/.github/workflows/test-knative-conformance.yaml index 3fb680ec0..4e7b8be6a 100644 --- a/.github/workflows/test-knative-conformance.yaml +++ b/.github/workflows/test-knative-conformance.yaml @@ -9,6 +9,7 @@ on: - 'pkg/provider/kubernetes/knative/**' - 'integration/fixtures/knative/**' - 'integration/knative_conformance_test.go' + - 'integration/integration_test.go' env: GO_VERSION: '1.24' diff --git a/.github/workflows/test-unit.yaml b/.github/workflows/test-unit.yaml index d8d612a51..d60e359f0 100644 --- a/.github/workflows/test-unit.yaml +++ b/.github/workflows/test-unit.yaml @@ -79,6 +79,11 @@ jobs: cache: 'yarn' cache-dependency-path: webui/yarn.lock + - name: Setup safe-chain + run: | + npm i -g @aikidosec/safe-chain + safe-chain setup-ci + - name: UI unit tests working-directory: ./webui env: diff --git a/.golangci.yml b/.golangci.yml index 949f689dc..50afac812 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -239,6 +239,8 @@ linters: text: ' always receives ' linters: - unparam + - path: pkg/server/service/bufferpool.go + text: 'SA6002: argument should be pointer-like to avoid allocations' - path: pkg/server/middleware/middlewares.go text: Function 'buildConstructor' has too many statements linters: @@ -314,12 +316,8 @@ linters: text: 'the methods of "wasmMiddlewareBuilder" use pointer receiver and non-pointer receiver.' linters: - recvcheck - - path: pkg/server/service/bufferpool.go - text: 'SA6002: argument should be pointer-like to avoid allocations' - path: pkg/proxy/httputil/bufferpool.go text: 'SA6002: argument should be pointer-like to avoid allocations' - - path: pkg/udp/conn.go - text: 'SA6002: argument should be pointer-like to avoid allocations' - path: integration/integration_test.go text: 'var (gatewayAPIConformanceRunTest|traefikVersion) is unused' - path: pkg/server/router/router.go diff --git a/CHANGELOG.md b/CHANGELOG.md index 1cae75d22..85f0c9b62 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,29 @@ +## [v3.6.2](https://github.com/traefik/traefik/tree/v3.6.2) (2025-11-18) +[All Commits](https://github.com/traefik/traefik/compare/v3.6.1...v3.6.2) + +**Bug fixes:** +- **[k8s/ingress-nginx]** Deprecate Kubernetes Ingress NGINX provider experimental flag ([#12286](https://github.com/traefik/traefik/pull/12286) by [rtribotte](https://github.com/rtribotte)) + +## [v3.6.1](https://github.com/traefik/traefik/tree/v3.6.1) (2025-11-13) +[All Commits](https://github.com/traefik/traefik/compare/v3.6.0...v3.6.1) + +**Bug fixes:** +- **[docker]** Auto-negotiate Docker API Version ([#12256](https://github.com/traefik/traefik/pull/12256) by [felixbuenemann](https://github.com/felixbuenemann)) +- **[server]** Fix multi-layer routing with models ([#12258](https://github.com/traefik/traefik/pull/12258) by [juliens](https://github.com/juliens)) +- **[udp]** Revert "Avoid allocations in readLoop by using sync.Pool" ([#12267](https://github.com/traefik/traefik/pull/12267) by [kevinpollet](https://github.com/kevinpollet)) +- **[webui]** Fix blocked navigation on Safari ([#12231](https://github.com/traefik/traefik/pull/12231) by [gndz07](https://github.com/gndz07)) +- **[webui]** Restore remote Upgrade to Hub button web component ([#12219](https://github.com/traefik/traefik/pull/12219) by [gndz07](https://github.com/gndz07)) + +**Documentation:** +- **[k8s]** Fix Nginx provider documentation ([#12266](https://github.com/traefik/traefik/pull/12266) by [nmengin](https://github.com/nmengin)) +- **[k8s]** Fix Gateway API version and the list of features supported ([#12254](https://github.com/traefik/traefik/pull/12254) by [nmengin](https://github.com/nmengin)) + +## [v2.11.31](https://github.com/traefik/traefik/tree/v2.11.31) (2025-11-13) +[All Commits](https://github.com/traefik/traefik/compare/v2.11.30...v2.11.31) + +**Bug fixes:** +- **[docker,docker/swarm]** Auto-negotiate Docker API version ([#12262](https://github.com/traefik/traefik/pull/12262) by [kevinpollet](https://github.com/kevinpollet)) + ## [v3.6.0](https://github.com/traefik/traefik/tree/v3.6.0) (2025-11-07) [All Commits](https://github.com/traefik/traefik/compare/v3.5.0-rc1...v3.6.0) diff --git a/SECURITY.md b/SECURITY.md index c9a2670f6..240fba79b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,10 +1,5 @@ # Security Policy -You can join our security mailing list to be aware of the latest announcements from our security team. -You can subscribe by sending an email to security+subscribe@traefik.io or on [the online viewer](https://groups.google.com/a/traefik.io/forum/#!forum/security). - -Reported vulnerabilities can be found on [cve.mitre.org](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=traefik). - ## Supported Versions - We usually release 3/4 new versions (e.g. 1.1.0, 1.2.0, 1.3.0) per year. @@ -17,10 +12,10 @@ We use [Semantic Versioning](https://semver.org/). | Version | Supported | |-----------|--------------------| -| `2.2.x` | :white_check_mark: | -| `< 2.2.x` | :x: | -| `1.7.x` | :white_check_mark: | -| `< 1.7.x` | :x: | +| `3.6.x` | :white_check_mark: | +| `< 3.6.x` | :x: | +| `2.11.x` | :white_check_mark: | +| `< 2.11.x` | :x: | ## Reporting a Vulnerability @@ -28,3 +23,5 @@ We want to keep Traefik safe for everyone. If you've discovered a security vulnerability in Traefik, we appreciate your help in disclosing it to us in a responsible manner, by creating a [security advisory](https://github.com/traefik/traefik/security/advisories). + +Reported vulnerabilities can be found on [cve.mitre.org](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=traefik). diff --git a/cmd/traefik/traefik.go b/cmd/traefik/traefik.go index 8c2cab62c..32e88791e 100644 --- a/cmd/traefik/traefik.go +++ b/cmd/traefik/traefik.go @@ -114,9 +114,7 @@ func runCmd(staticConfiguration *static.Configuration) error { log.Debug().RawJSON("staticConfiguration", []byte(redactedStaticConfiguration)).Msg("Static configuration loaded [json]") } - if staticConfiguration.Global.CheckNewVersion { - checkNewVersion() - } + checkNewVersion(staticConfiguration) stats(staticConfiguration) @@ -614,13 +612,28 @@ func setupTracing(ctx context.Context, conf *static.Tracing) (*tracing.Tracer, i return tracer, closer } -func checkNewVersion() { - ticker := time.Tick(24 * time.Hour) - safe.Go(func() { - for time.Sleep(10 * time.Minute); ; <-ticker { - version.CheckNewVersion() - } - }) +func checkNewVersion(staticConfiguration *static.Configuration) { + logger := log.With().Logger() + + if staticConfiguration.Global.CheckNewVersion { + logger.Info().Msg(`Version check is enabled.`) + logger.Info().Msg(`Traefik checks for new releases to notify you if your version is out of date.`) + logger.Info().Msg(`It also collects usage data during this process.`) + logger.Info().Msg(`Check the documentation to get more info: https://doc.traefik.io/traefik/contributing/data-collection/`) + + ticker := time.Tick(24 * time.Hour) + safe.Go(func() { + for time.Sleep(10 * time.Minute); ; <-ticker { + version.CheckNewVersion() + } + }) + } else { + logger.Info().Msg(` +Version check is disabled. +You will not be notified if a new version is available. +More details: https://doc.traefik.io/traefik/contributing/data-collection/ +`) + } } func stats(staticConfiguration *static.Configuration) { diff --git a/docs/content/contributing/data-collection.md b/docs/content/contributing/data-collection.md index 645170b58..5153b038c 100644 --- a/docs/content/contributing/data-collection.md +++ b/docs/content/contributing/data-collection.md @@ -1,17 +1,72 @@ --- title: "Traefik Data Collection Documentation" -description: "To learn more about how Traefik is being used and improve it, we collect anonymous usage statistics from running instances. Read the technical documentation." +description: "Learn what data Traefik shares, how it is used, and how you can control it. This documentation explains both version check and anonymous usage statistics data. Read the technical documentation." --- # Data Collection -Understanding How Traefik is Being Used +Understanding the data Traefik shares and how it is used {: .subtitle } -## Configuration Example +## Introduction -Understanding how you use Traefik is very important to us: it helps us improve the solution in many different ways. -For this very reason, the sendAnonymousUsage option is mandatory: we want you to take time to consider whether or not you wish to share anonymous data with us, so we can benefit from your experience and use cases. +Protecting user privacy is essential to Traefik Labs, and we design every data-sharing mechanism with transparency and minimalism in mind. +This page describes the two types of data exchanged by Traefik and how to configure them. + +For more details on how your data is handled, please refer to our [Privacy and Cookie Policy](https://traefik.io/legal/privacy-and-cookie-policy). + +## Configuration Overview + +Traefik provides two independent mechanisms: + +- `checkNewVersion`, enabled by default. You may disable it at any time. +- `sendAnonymousUsage`, which requires explicit opt‑in. + +Examples below show how to activate or deactivate both of them. + +```yaml tab="YAML" +global: + checkNewVersion: true # set to false to disable + sendAnonymousUsage: false # set to true to enable +``` + +```toml tab="TOML" +[global] + checkNewVersion = true # set to false to disable + sendAnonymousUsage = false # set to true to enable +``` + +```bash tab="CLI" +--global.checkNewVersion=true # set to false to disable +--global.sendAnonymousUsage=false # set to true to enable +``` + +A log message at startup clearly indicates whether each of those options are enabled or disabled. + +## Version Check (`checkNewVersion`) – Opt-out + +Traefik periodically contacts `update.traefik.io` to determine whether a newer version is available. +When this request is made, Traefik shares the **running version** and the **public IP** of the instance. +The IP is used to build global usage statistics and does not influence the version comparison. + +This mechanism helps you stay informed about updates and provides TraefikLabs with a broad view of which versions are deployed in the wild. + +The collected IP addresses are also used for marketing purposes, specifically to detect companies running Traefik and offer them adapted support contracts, enterprise features, and tailored services. + +If you want to explore the implementation, you can read the version check source code: [version.go](https://github.com/traefik/traefik/blob/master/pkg/version/version.go) + +## Anonymous Usage Data (`sendAnonymousUsage`) – Opt‑in + +Traefik can also collect anonymous usage statistics once per day, starting 10 minutes after it starts running. +These statistics include: + +- the Traefik version, +- a hash of the configuration, +- an anonymized version of the static configuration (all sensitive fields removed: tokens, passwords, URLs, IP addresses, domains, emails, etc.). + +This feature comes from this [public proposal](https://github.com/traefik/traefik/issues/2369). + +This information helps TraefikLabs understand how Traefik is used in general and prioritize features and provider support accordingly. Dynamic configuration (routers and services) is never collected. !!! example "Enabling Data Collection" @@ -32,21 +87,6 @@ For this very reason, the sendAnonymousUsage option is mandatory: we want you to --global.sendAnonymousUsage ``` -## Collected Data - -This feature comes from this [public proposal](https://github.com/traefik/traefik/issues/2369). - -In order to help us learn more about how Traefik is being used and improve it, we collect anonymous usage statistics from running instances. -Those data help us prioritize our developments and focus on what's important for our users (for example, which provider is popular, and which is not). - -### What's collected / when ? - -Once a day (the first call begins 10 minutes after the start of Traefik), we collect: - -- the Traefik version number -- a hash of the configuration -- an **anonymized version** of the static configuration (token, username, password, URL, IP, domain, email, etc., are removed). - !!! info - We do not collect the dynamic configuration information (routers & services). @@ -93,8 +133,9 @@ providers: insecureSkipVerify: true ``` -## The Code for Data Collection +### The Code for Anonymous Usage Collection -If you want to dig into more details, here is the source code of the collecting system: [collector.go](https://github.com/traefik/traefik/blob/master/pkg/collector/collector.go) +If you want to explore the implementation, you can read the collector source code: +[collector.go](https://github.com/traefik/traefik/blob/master/pkg/collector/collector.go) -By default, we anonymize all configuration fields, except fields tagged with `export=true`. +Traefik anonymizes all configuration fields by default, except those explicitly marked with `export=true`. diff --git a/docs/content/migrate/v3.md b/docs/content/migrate/v3.md index 85e9fc185..1d13f463f 100644 --- a/docs/content/migrate/v3.md +++ b/docs/content/migrate/v3.md @@ -525,3 +525,32 @@ To use the new `leasttime` load-balancer algorithm with the Kubernetes CRD provi ```shell kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml ``` + +## v3.6.2 + +### Ingress NGINX Provider + +The KubernetesIngressNGINX Provider is no longer experimental in v3.6.2 and can be enabled without the `experimental.kubernetesIngressNGINX` option. + +**Deprecated Configuration:** + +??? example "Experimental kubernetesIngressNGINX option (deprecated)" + + ```yaml tab="File (YAML)" + experimental: + kubernetesIngressNGINX: true + ``` + + ```toml tab="File (TOML)" + [experimental] + kubernetesIngressNGINX=true + ``` + + ```bash tab="CLI" + --experimental.kubernetesIngressNGINX=true + ``` + +**Migration Steps:** + +1. Remove the `kubernetesIngressNGINX` option from the experimental section +2. Configure the provider using the [kubernetesIngressNGINX Provider documentation](../reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md) diff --git a/docs/content/providers/kubernetes-gateway.md b/docs/content/providers/kubernetes-gateway.md index fb659661a..a8615748a 100644 --- a/docs/content/providers/kubernetes-gateway.md +++ b/docs/content/providers/kubernetes-gateway.md @@ -21,7 +21,7 @@ For more details, check out the conformance [report](https://github.com/kubernet !!! info "Helm Chart" When using the Traefik [Helm Chart](../getting-started/install-traefik.md#use-the-helm-chart), the CRDs (Custom Resource Definitions) and RBAC (Role-Based Access Control) are automatically managed for you. - The only remaining task is to enable the `kubernetesGateway` in the chart [values](https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml#L130). + The only remaining task is to enable the `kubernetesGateway` in the chart [values](https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml#L323). 1. Install/update the Kubernetes Gateway API CRDs. diff --git a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-gateway.md b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-gateway.md index 4b4a0a534..52284f80f 100644 --- a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-gateway.md +++ b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-gateway.md @@ -10,14 +10,14 @@ specification from the Kubernetes Special Interest Groups (SIGs). This provider supports Standard version [v1.4.0](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.4.0) of the Gateway API specification. -It fully supports all HTTP core and some extended features, as well as the `TCPRoute` and `TLSRoute` resources from the [Experimental channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels). +It fully supports all `HTTPRoute` core and some extended features, like `BackendTLSPolicy`, and `GRPCRoute` resources from the [Standard channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels), as well as `TCPRoute`, and `TLSRoute` resources from the [Experimental channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels). For more details, check out the conformance [report](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports/v1.4.0/traefik-traefik). !!! info "Using The Helm Chart" When using the Traefik [Helm Chart](../../../../getting-started/install-traefik.md#use-the-helm-chart), the CRDs (Custom Resource Definitions) and RBAC (Role-Based Access Control) are automatically managed for you. - The only remaining task is to enable the `kubernetesGateway` in the chart [values](https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml#L130). + The only remaining task is to enable the `kubernetesGateway` in the chart [values](https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml#L323). ## Requirements diff --git a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md index 2d9e93c1e..b3c5de6db 100644 --- a/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md +++ b/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx.md @@ -3,67 +3,183 @@ title: "Traefik Kubernetes Ingress NGINX Documentation" description: "Understand the requirements, routing configuration, and how to set up the Kubernetes Ingress NGINX provider. Read the technical documentation." --- -# Traefik & Ingresses with NGINX Annotations +# Traefik & Ingresses with NGINX Annotations -The experimental Traefik Kubernetes Ingress NGINX provider is a Kubernetes Ingress controller; i.e, -it manages access to cluster services by supporting the [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) specification. -It also supports some of the [ingress-nginx](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/) annotations on ingresses to customize their behavior. +This provider is a Kubernetes Ingress controller that manages access to cluster services by supporting the [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) specification. +It also supports many of the [ingress-nginx](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/) annotations on Ingresses, enabling teams to migrate from NGINX Ingress Controller to Traefik with minimal configuration changes. -!!! warning "Ingress Discovery" +!!! warning "NGINX Ingress Controller Retirement" - The Kubernetes Ingress NGINX provider is discovering by default all Ingresses in the cluster, - which may lead to duplicated routers if you are also using the Kubernetes Ingress provider. - We recommend to use IngressClass for the Ingresses you want to be handled by this provider, - or to use the `watchNamespace` or `watchNamespaceSelector` options to limit the discovery of Ingresses to a specific namespace or set of namespaces. + The Kubernetes NGINX Ingress Controller project has announced its retirement in **March 2026** and will no longer receive updates or security patches. + Traefik provides a migration path by supporting NGINX annotations, allowing you to transition your workloads without rewriting all your Ingress configurations. + + For more information about the NGINX Ingress Controller retirement, see the [official Kubernetes blog announcement](https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement). + +## Ingress Discovery + +This provider discovers all Ingresses in the cluster by default, which may lead to duplicated routers if you are also using the standard Kubernetes Ingress provider. + +**Best Practices:** + +- Use IngressClass to specify which Ingresses should be handled by this provider +- Configure `watchNamespace` to limit discovery to specific namespaces +- Use `watchNamespaceSelector` to target Ingresses based on namespace labels ## Configuration Example -As this provider is an experimental feature, it needs to be enabled in the experimental and in the provider sections of the configuration. You can enable the Kubernetes Ingress NGINX provider as detailed below: ```yaml tab="File (YAML)" -experimental: - kubernetesIngressNGINX: true - providers: - kubernetesIngressNGINX: {} + kubernetesIngressNGINX: + endpoint: "https://kubernetes.default.svc" + token: "mytoken" + certAuthFilePath: "/path/to/ca.crt" + throttleDuration: "2s" + + # Namespace discovery + watchNamespace: "default" + # OR use namespace selector (mutually exclusive with watchNamespace) + # watchNamespaceSelector: "environment=production" + + # IngressClass configuration + ingressClass: "nginx" + controllerClass: "k8s.io/ingress-nginx" + watchIngressWithoutClass: false + ingressClassByName: false + + # Status updates + publishService: "kube-system/traefik" + publishStatusAddress: "203.0.113.42" + + # Default backend + defaultBackendService: "default/default-backend" + + # Security + disableSvcExternalName: false ``` ```toml tab="File (TOML)" -[experimental.kubernetesIngressNGINX] - [providers.kubernetesIngressNGINX] + endpoint = "https://kubernetes.default.svc" + token = "mytoken" + certAuthFilePath = "/path/to/ca.crt" + throttleDuration = "2s" + + # Namespace discovery + watchNamespace = "default" + # OR use namespace selector (mutually exclusive with watchNamespace) + # watchNamespaceSelector = "environment=production" + + # IngressClass configuration + ingressClass = "nginx" + controllerClass = "k8s.io/ingress-nginx" + watchIngressWithoutClass = false + ingressClassByName = false + + # Status updates + publishService = "kube-system/traefik" + publishStatusAddress = "203.0.113.42" + + # Default backend + defaultBackendService = "default/default-backend" + + # Security + disableSvcExternalName = false ``` ```bash tab="CLI" ---experimental.kubernetesingressnginx=true --providers.kubernetesingressnginx=true +--providers.kubernetesingressnginx.endpoint=https://kubernetes.default.svc +--providers.kubernetesingressnginx.token=mytoken +--providers.kubernetesingressnginx.certauthfilepath=/path/to/ca.crt +--providers.kubernetesingressnginx.throttleduration=2s +--providers.kubernetesingressnginx.watchnamespace=default +--providers.kubernetesingressnginx.ingressclass=nginx +--providers.kubernetesingressnginx.controllerclass=k8s.io/ingress-nginx +--providers.kubernetesingressnginx.watchingresswithoutclass=false +--providers.kubernetesingressnginx.ingressclassbyname=false +--providers.kubernetesingressnginx.publishservice=kube-system/traefik +--providers.kubernetesingressnginx.publishstatusaddress=203.0.113.42 +--providers.kubernetesingressnginx.defaultbackendservice=default/default-backend +--providers.kubernetesingressnginx.disablesvcexternalname=false ``` -The provider then watches for incoming ingresses events, such as the example below, -and derives the corresponding dynamic configuration from it, -which in turn creates the resulting routers, services, handlers, etc. +```yaml tab="Helm Chart Values" +providers: + kubernetesIngressNginx: + # -- Enable Kubernetes Ingress NGINX provider + enabled: true + + # -- Kubernetes server endpoint (required for external cluster client) + endpoint: "https://kubernetes.default.svc" + + # -- Kubernetes bearer token (not needed for in-cluster client) + token: "mytoken" + + # -- Kubernetes certificate authority file path (not needed for in-cluster client) + certAuthFilePath: "/path/to/ca.crt" + + # -- Ingress refresh throttle duration + throttleDuration: "2s" + + # Namespace discovery + # -- Namespace the controller watches for updates to Kubernetes objects + # When using rbac.namespaced, it will watch helm release namespace and namespaces listed in this array + namespaces: + - default + # OR use namespace selector (mutually exclusive with namespaces) + # namespaceSelector: "environment=production" + + # IngressClass configuration + # -- Name of the ingress class this controller satisfies + ingressClass: "nginx" + # -- Ingress Class Controller value this controller satisfies + controllerClass: "k8s.io/ingress-nginx" + # -- Define if Ingress Controller should also watch for Ingresses without an IngressClass or the annotation specified + watchIngressWithoutClass: false + # -- Define if Ingress Controller should watch for Ingress Class by Name together with Controller Class + ingressClassByName: false + + # Status updates + # -- Service fronting the Ingress controller + publishService: + enabled: true + pathOverride: "kube-system/traefik" + # -- Customized address (or addresses, separated by comma) to set as the load-balancer status of Ingress objects + publishStatusAddress: "203.0.113.42" + + # Default backend + # -- Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form 'namespace/name' + defaultBackendService: "default/default-backend" + + # Security + # -- Disable support for Services of type ExternalName + disableSvcExternalName: false +``` + +This provider watches for incoming Ingress events and automatically translates NGINX annotations into Traefik's dynamic configuration, creating the corresponding routers, services, middlewares, and other components needed to route traffic to your cluster services. ## Configuration Options -| Field | Description | Default | Required | -|:------------------------------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------| -| `providers.providersThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No | -| `providers.kubernetesIngressNGINX.endpoint` | Server endpoint URL.
More information [here](#endpoint). | "" | No | -| `providers.kubernetesIngressNGINX.token` | Bearer token used for the Kubernetes client configuration. | "" | No | -| `providers.kubernetesIngressNGINX.certAuthFilePath` | Path to the certificate authority file.
Used for the Kubernetes client configuration. | "" | No | -| `providers.kubernetesIngressNGINX.throttleDuration` | Minimum amount of time to wait between two Kubernetes events before producing a new configuration.
This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration.
If empty, every event is caught. | 0s | No | -| `providers.kubernetesIngressNGINX.watchNamespace` | Namespace the controller watches for updates to Kubernetes objects. All namespaces are watched if this parameter is left empty. | "" | No | -| `providers.kubernetesIngressNGINX.watchNamespaceSelector` | Selector selects namespaces the controller watches for updates to Kubernetes objects. | "" | No | -| `providers.kubernetesIngressNGINX.ingressClass` | Name of the ingress class this controller satisfies. | "" | No | -| `providers.kubernetesIngressNGINX.controllerClass` | Ingress Class Controller value this controller satisfies. | "" | No | -| `providers.kubernetesIngressNGINX.watchIngressWithoutClass` | Define if Ingress Controller should also watch for Ingresses without an IngressClass or the annotation specified. | false | No | -| `providers.kubernetesIngressNGINX.ingressClassByName` | Define if Ingress Controller should watch for Ingress Class by Name together with Controller Class. | false | No | -| `providers.kubernetesIngressNGINX.publishService` | Service fronting the Ingress controller. Takes the form namespace/name. | "" | No | -| `providers.kubernetesIngressNGINX.publishStatusAddress` | Customized address (or addresses, separated by comma) to set as the load-balancer status of Ingress objects this controller satisfies. | "" | No | -| `providers.kubernetesIngressNGINX.defaultBackendService` | Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form 'namespace/name'. | "" | No | -| `providers.kubernetesIngressNGINX.disableSvcExternalName` | Disable support for Services of type ExternalName. | false | No | +| Field | Description | Default | Required | +|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------|:--------|:---------| +| `providers.providers`
`ThrottleDuration` | Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event.
If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded.
**This option cannot be set per provider, but the throttling algorithm applies to each of them independently.** | 2s | No | +| `providers.`
`kubernetesIngressNGINX.`
`endpoint` | Server endpoint URL.
More information [here](#endpoint). | "" | No | +| `providers.`
`kubernetesIngressNGINX.`
`token` | Bearer token used for the Kubernetes client configuration. | "" | No | +| `providers.`
`kubernetesIngressNGINX.`
`certAuthFilePath` | Path to the certificate authority file.
Used for the Kubernetes client configuration. | "" | No | +| `providers.`
`kubernetesIngressNGINX.`
`throttleDuration` | Minimum amount of time to wait between two Kubernetes events before producing a new configuration.
This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration.
If empty, every event is caught. | 0s | No | +| `providers.`
`kubernetesIngressNGINX.`
`watchNamespace` | Namespace the controller watches for updates to Kubernetes objects. All namespaces are watched if this parameter is left empty. | "" | No | +| `providers.`
`kubernetesIngressNGINX.`
`watchNamespaceSelector` | Selector selects namespaces the controller watches for updates to Kubernetes objects. | "" | No | +| `providers.`
`kubernetesIngressNGINX.`
`ingressClass` | Name of the ingress class this controller satisfies. | "nginx" | No | +| `providers.`
`kubernetesIngressNGINX.`
`controllerClass` | Ingress Class Controller value this controller satisfies. | "" | No | +| `providers.`
`kubernetesIngressNGINX.`
`watchIngressWithoutClass` | Define if Ingress Controller should also watch for Ingresses without an IngressClass or the annotation specified. | false | No | +| `providers.`
`kubernetesIngressNGINX.`
`ingressClassByName` | Define if Ingress Controller should watch for Ingress Class by Name together with Controller Class. | false | No | +| `providers.`
`kubernetesIngressNGINX.`
`publishService` | Service fronting the Ingress controller. Takes the form `namespace/name`. | "" | No | +| `providers.`
`kubernetesIngressNGINX.`
`publishStatusAddress` | Customized address (or addresses, separated by comma) to set as the load-balancer status of Ingress objects this controller satisfies. | "" | No | +| `providers.`
`kubernetesIngressNGINX.`
`defaultBackendService` | Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form 'namespace/name'. | "" | No | +| `providers.`
`kubernetesIngressNGINX.`
`disableSvcExternalName` | Disable support for Services of type ExternalName. | false | No | diff --git a/docs/content/reference/routing-configuration/kubernetes/gateway-api.md b/docs/content/reference/routing-configuration/kubernetes/gateway-api.md index a25e147c4..8f5d27c40 100644 --- a/docs/content/reference/routing-configuration/kubernetes/gateway-api.md +++ b/docs/content/reference/routing-configuration/kubernetes/gateway-api.md @@ -8,11 +8,12 @@ description: "The Kubernetes Gateway API can be used as a provider for routing a When using the Kubernetes Gateway API provider, Traefik leverages the Gateway API Custom Resource Definitions (CRDs) to obtain its routing configuration. For detailed information on the Gateway API concepts and resources, refer to the official [documentation](https://gateway-api.sigs.k8s.io/). -The Kubernetes Gateway API provider supports version [v1.2.1](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.2.1) of the specification. +The Kubernetes Gateway API provider supports version [v1.4.0](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.4.0) of the specification. -It fully supports all `HTTPRoute` core and some extended features, like `GRPCRoute`, as well as the `TCPRoute` and `TLSRoute` resources from the [Experimental channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels). +It fully supports all `HTTPRoute` core and some extended features, like `BackendTLSPolicy`, and `GRPCRoute` resources from the [Standard channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels), as well as `TCPRoute`, and `TLSRoute` resources from the [Experimental channel](https://gateway-api.sigs.k8s.io/concepts/versioning/?h=#release-channels). + +For more details, check out the conformance [report](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports/v1.4.0/traefik-traefik). -For more details, check out the conformance [report](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports/v1.2.1/traefik-traefik). ## Deploying a Gateway diff --git a/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md b/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md index 8f0b34a7c..0e317c45a 100644 --- a/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md +++ b/docs/content/reference/routing-configuration/kubernetes/ingress-nginx.md @@ -5,21 +5,29 @@ description: "Understand the routing configuration for the Kubernetes Ingress NG # Traefik & Ingresses with NGINX Annotations -The experimental Kubernetes Controller for Ingresses with NGINX annotations. +Enable seamless migration from NGINX Ingress Controller to Traefik with NGINX annotation compatibility. {: .subtitle } -!!! warning "Ingress Discovery" +!!! warning "NGINX Ingress Controller Retirement" - The Kubernetes Ingress NGINX provider is discovering by default all Ingresses in the cluster, - which may lead to duplicated routers if you are also using the Kubernetes Ingress provider. - We recommend to use IngressClass for the Ingresses you want to be handled by this provider, - or to use the `watchNamespace` or `watchNamespaceSelector` options to limit the discovery of Ingresses to a specific namespace or set of namespaces. + The Kubernetes NGINX Ingress Controller project has announced its retirement in **March 2026** and will no longer receive updates or security patches. + Traefik provides a migration path by supporting NGINX annotations, allowing you to transition your workloads without rewriting all your Ingress configurations. + + For more information about the NGINX Ingress Controller retirement, see the [official Kubernetes blog announcement](https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement). + +## Ingress Discovery + +This provider discovers all Ingresses in the cluster by default, which may lead to duplicated routers if you are also using the standard Kubernetes Ingress provider. + +**Best Practices:** + +- Use IngressClass to specify which Ingresses should be handled by this provider +- Configure `watchNamespace` to limit discovery to specific namespaces +- Use `watchNamespaceSelector` to target Ingresses based on namespace labels ## Routing Configuration -The Kubernetes Ingress NGINX provider watches for incoming ingresses events, such as the example below, -and derives the corresponding dynamic configuration from it, -which in turn will create the resulting routers, services, handlers, etc. +This provider watches for incoming Ingress events and automatically translates NGINX annotations into Traefik's dynamic configuration, creating the corresponding routers, services, middlewares, and other components needed to handle your traffic. ## Configuration Example @@ -239,32 +247,13 @@ which in turn will create the resulting routers, services, handlers, etc. ## Annotations Support -This section lists all known NGINX Ingress annotations, split between those currently implemented (with limitations if any) and those not implemented. -Limitations or behavioral differences are indicated where relevant. +This section lists all known NGINX Ingress annotations. +The following annotations are organized by category for easier navigation. -!!! warning "Global configuration" - - Traefik does not expose all global configuration options to control default behaviors for ingresses. - - Some behaviors that are globally configurable in NGINX (such as default SSL redirect, rate limiting, or affinity) are currently not supported and cannot be overridden per-ingress as in NGINX. - -### Caveats and Key Behavioral Differences - -- **Authentication**: Forward auth behaves differently and session caching is not supported. NGINX supports sub-request based auth, while Traefik forwards the original request. -- **Session Affinity**: Only persistent mode is supported. -- **Leader Election**: Not supported; no cluster mode with leader election. -- **Default Backend**: Only `defaultBackend` in Ingress spec is supported; the annotation is ignored. -- **Load Balancing**: Only round_robin is supported; EWMA and IP hash are not supported. -- **CORS**: NGINX responds with all configured headers unconditionally; Traefik handles headers differently between pre-flight and regular requests. -- **TLS/Backend Protocols**: AUTO_HTTP, FCGI and some TLS options are not supported in Traefik. -- **Path Handling**: Traefik preserves trailing slashes by default; NGINX removes them unless configured otherwise. - -### Supported NGINX Annotations +### Authentication | Annotation | Limitations / Notes | |-------------------------------------------------------|--------------------------------------------------------------------------------------------| -| `nginx.ingress.kubernetes.io/affinity` | | -| `nginx.ingress.kubernetes.io/affinity-mode` | Only persistent mode supported; balanced/canary not supported. | | `nginx.ingress.kubernetes.io/auth-type` | | | `nginx.ingress.kubernetes.io/auth-secret` | | | `nginx.ingress.kubernetes.io/auth-secret-type` | | @@ -272,29 +261,69 @@ Limitations or behavioral differences are indicated where relevant. | `nginx.ingress.kubernetes.io/auth-url` | Only URL and response headers copy supported. Forward auth behaves differently than NGINX. | | `nginx.ingress.kubernetes.io/auth-method` | | | `nginx.ingress.kubernetes.io/auth-response-headers` | | + +### SSL/TLS + +| Annotation | Limitations / Notes | +|-------------------------------------------------------|--------------------------------------------------------------------------------------------| | `nginx.ingress.kubernetes.io/ssl-redirect` | Cannot opt-out per route if enabled globally. | | `nginx.ingress.kubernetes.io/force-ssl-redirect` | Cannot opt-out per route if enabled globally. | | `nginx.ingress.kubernetes.io/ssl-passthrough` | Some differences in SNI/default backend handling. | -| `nginx.ingress.kubernetes.io/use-regex` | | +| `nginx.ingress.kubernetes.io/proxy-ssl-server-name` | | +| `nginx.ingress.kubernetes.io/proxy-ssl-name` | | +| `nginx.ingress.kubernetes.io/proxy-ssl-verify` | | +| `nginx.ingress.kubernetes.io/proxy-ssl-secret` | | + +### Session Affinity + +| Annotation | Limitations / Notes | +|-------------------------------------------------------|--------------------------------------------------------------------------------------------| +| `nginx.ingress.kubernetes.io/affinity` | | +| `nginx.ingress.kubernetes.io/affinity-mode` | Only persistent mode supported; balanced/canary not supported. | | `nginx.ingress.kubernetes.io/session-cookie-name` | | | `nginx.ingress.kubernetes.io/session-cookie-path` | | | `nginx.ingress.kubernetes.io/session-cookie-domain` | | | `nginx.ingress.kubernetes.io/session-cookie-samesite` | | + +### Load Balancing & Backend + +| Annotation | Limitations / Notes | +|-------------------------------------------------------|--------------------------------------------------------------------------------------------| | `nginx.ingress.kubernetes.io/load-balance` | Only round_robin supported; ewma and IP hash not supported. | | `nginx.ingress.kubernetes.io/backend-protocol` | FCGI and AUTO_HTTP not supported. | +| `nginx.ingress.kubernetes.io/service-upstream` | | + +### CORS + +| Annotation | Limitations / Notes | +|-------------------------------------------------------|--------------------------------------------------------------------------------------------| | `nginx.ingress.kubernetes.io/enable-cors` | Partial support. | | `nginx.ingress.kubernetes.io/cors-allow-credentials` | | | `nginx.ingress.kubernetes.io/cors-allow-headers` | | | `nginx.ingress.kubernetes.io/cors-allow-methods` | | | `nginx.ingress.kubernetes.io/cors-allow-origin` | | | `nginx.ingress.kubernetes.io/cors-max-age` | | -| `nginx.ingress.kubernetes.io/proxy-ssl-server-name` | | -| `nginx.ingress.kubernetes.io/proxy-ssl-name` | | -| `nginx.ingress.kubernetes.io/proxy-ssl-verify` | | -| `nginx.ingress.kubernetes.io/proxy-ssl-secret` | | -| `nginx.ingress.kubernetes.io/service-upstream` | | -### Unsupported NGINX Annotations +### Routing + +| Annotation | Limitations / Notes | +|-------------------------------------------------------|--------------------------------------------------------------------------------------------| +| `nginx.ingress.kubernetes.io/use-regex` | | + +## Limitations + +### Caveats and Key Behavioral Differences + +- **Authentication**: Forward auth behaves differently and session caching is not supported. NGINX supports sub-request based auth, while Traefik forwards the original request. +- **Session Affinity**: Only persistent mode is supported. +- **Leader Election**: Not supported; no cluster mode with leader election. +- **Default Backend**: Only defaultBackend in Ingress spec is supported; the annotation is ignored. +- **Load Balancing**: Only round_robin is supported; EWMA and IP hash are not supported. +- **CORS**: NGINX responds with all configured headers unconditionally; Traefik handles headers differently between pre-flight and regular requests. +- **TLS/Backend Protocols**: AUTO_HTTP, FCGI and some TLS options are not supported in Traefik. +- **Path Handling**: Traefik preserves trailing slashes by default; NGINX removes them unless configured otherwise + +### Unsupported Annotations !!! question "Want to Add Support for More Annotations?" @@ -305,98 +334,103 @@ Limitations or behavioral differences are indicated where relevant. All contributions and suggestions are welcome — let's build this together! - | Annotation | Notes | |-----------------------------------------------------------------------------|------------------------------------------------------| -| `nginx.ingress.kubernetes.io/app-root` | Not supported yet. | -| `nginx.ingress.kubernetes.io/affinity-canary-behavior` | Not supported yet. | -| `nginx.ingress.kubernetes.io/auth-tls-secret` | Not supported yet. | -| `nginx.ingress.kubernetes.io/auth-tls-verify-depth` | Not supported yet. | -| `nginx.ingress.kubernetes.io/auth-tls-verify-client` | Not supported yet. | -| `nginx.ingress.kubernetes.io/auth-tls-error-page` | Not supported yet. | -| `nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream` | Not supported yet. | -| `nginx.ingress.kubernetes.io/auth-tls-match-cn` | Not supported yet. | -| `nginx.ingress.kubernetes.io/auth-cache-key` | Not supported yet. | -| `nginx.ingress.kubernetes.io/auth-cache-duration` | Not supported yet. | -| `nginx.ingress.kubernetes.io/auth-keepalive` | Not supported yet. | -| `nginx.ingress.kubernetes.io/auth-keepalive-share-vars` | Not supported yet. | -| `nginx.ingress.kubernetes.io/auth-keepalive-requests` | Not supported yet. | -| `nginx.ingress.kubernetes.io/auth-keepalive-timeout` | Not supported yet. | -| `nginx.ingress.kubernetes.io/auth-proxy-set-headers` | Not supported yet. | -| `nginx.ingress.kubernetes.io/auth-snippet` | Not supported yet. | -| `nginx.ingress.kubernetes.io/enable-global-auth` | Not supported yet. | -| `nginx.ingress.kubernetes.io/canary` | Not supported yet. | -| `nginx.ingress.kubernetes.io/canary-by-header` | Not supported yet. | -| `nginx.ingress.kubernetes.io/canary-by-header-value` | Not supported yet. | -| `nginx.ingress.kubernetes.io/canary-by-header-pattern` | Not supported yet. | -| `nginx.ingress.kubernetes.io/canary-by-cookie` | Not supported yet. | -| `nginx.ingress.kubernetes.io/canary-weight` | Not supported yet. | -| `nginx.ingress.kubernetes.io/canary-weight-total` | Not supported yet. | -| `nginx.ingress.kubernetes.io/client-body-buffer-size` | Not supported yet. | -| `nginx.ingress.kubernetes.io/configuration-snippet` | Not supported yet. | -| `nginx.ingress.kubernetes.io/custom-http-errors` | Not supported yet. | -| `nginx.ingress.kubernetes.io/disable-proxy-intercept-errors` | Not supported yet. | -| `nginx.ingress.kubernetes.io/default-backend` | Not supported yet; use `defaultBackend` in Ingress spec. | -| `nginx.ingress.kubernetes.io/limit-rate-after` | Not supported yet. | -| `nginx.ingress.kubernetes.io/limit-rate` | Not supported yet. | -| `nginx.ingress.kubernetes.io/limit-whitelist` | Not supported yet. | -| `nginx.ingress.kubernetes.io/limit-rps` | Not supported yet. | -| `nginx.ingress.kubernetes.io/limit-rpm` | Not supported yet. | -| `nginx.ingress.kubernetes.io/limit-burst-multiplier` | Not supported yet. | -| `nginx.ingress.kubernetes.io/limit-connections` | Not supported yet. | -| `nginx.ingress.kubernetes.io/global-rate-limit` | Not supported yet. | -| `nginx.ingress.kubernetes.io/global-rate-limit-window` | Not supported yet. | -| `nginx.ingress.kubernetes.io/global-rate-limit-key` | Not supported yet. | -| `nginx.ingress.kubernetes.io/global-rate-limit-ignored-cidrs` | Not supported yet. | -| `nginx.ingress.kubernetes.io/permanent-redirect` | Not supported yet. | -| `nginx.ingress.kubernetes.io/permanent-redirect-code` | Not supported yet. | -| `nginx.ingress.kubernetes.io/temporal-redirect` | Not supported yet. | -| `nginx.ingress.kubernetes.io/preserve-trailing-slash` | Not supported yet; Traefik preserves by default. | -| `nginx.ingress.kubernetes.io/proxy-cookie-domain` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-cookie-path` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-connect-timeout` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-send-timeout` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-read-timeout` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-next-upstream` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-next-upstream-timeout` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-next-upstream-tries` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-request-buffering` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-redirect-from` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-redirect-to` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-http-version` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-ssl-ciphers` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-ssl-verify-depth` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-ssl-protocols` | Not supported yet. | -| `nginx.ingress.kubernetes.io/enable-rewrite-log` | Not supported yet. | -| `nginx.ingress.kubernetes.io/rewrite-target` | Not supported yet. | -| `nginx.ingress.kubernetes.io/satisfy` | Not supported yet. | -| `nginx.ingress.kubernetes.io/server-alias` | Not supported yet. | -| `nginx.ingress.kubernetes.io/server-snippet` | Not supported yet. | -| `nginx.ingress.kubernetes.io/session-cookie-conditional-samesite-none` | Not supported yet. | -| `nginx.ingress.kubernetes.io/session-cookie-expires` | Not supported yet. | -| `nginx.ingress.kubernetes.io/session-cookie-change-on-failure` | Not supported yet. | -| `nginx.ingress.kubernetes.io/ssl-ciphers` | Not supported yet. | -| `nginx.ingress.kubernetes.io/ssl-prefer-server-ciphers` | Not supported yet. | -| `nginx.ingress.kubernetes.io/connection-proxy-header` | Not supported yet. | -| `nginx.ingress.kubernetes.io/enable-access-log` | Not supported yet. | -| `nginx.ingress.kubernetes.io/enable-opentracing` | Not supported yet. | -| `nginx.ingress.kubernetes.io/opentracing-trust-incoming-span` | Not supported yet. | -| `nginx.ingress.kubernetes.io/enable-opentelemetry` | Not supported yet. | -| `nginx.ingress.kubernetes.io/opentelemetry-trust-incoming-span` | Not supported yet. | -| `nginx.ingress.kubernetes.io/enable-modsecurity` | Not supported yet. | -| `nginx.ingress.kubernetes.io/enable-owasp-core-rules` | Not supported yet. | -| `nginx.ingress.kubernetes.io/modsecurity-transaction-id` | Not supported yet. | -| `nginx.ingress.kubernetes.io/modsecurity-snippet` | Not supported yet. | -| `nginx.ingress.kubernetes.io/mirror-request-body` | Not supported yet. | -| `nginx.ingress.kubernetes.io/mirror-target` | Not supported yet. | -| `nginx.ingress.kubernetes.io/mirror-host` | Not supported yet. | -| `nginx.ingress.kubernetes.io/x-forwarded-prefix` | Not supported yet. | -| `nginx.ingress.kubernetes.io/upstream-hash-by` | Not supported yet. | -| `nginx.ingress.kubernetes.io/upstream-vhost` | Not supported yet. | -| `nginx.ingress.kubernetes.io/denylist-source-range` | Not supported yet. | -| `nginx.ingress.kubernetes.io/whitelist-source-range` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-buffering` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-buffers-number` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-buffer-size` | Not supported yet. | -| `nginx.ingress.kubernetes.io/proxy-max-temp-file-size` | Not supported yet. | -| `nginx.ingress.kubernetes.io/stream-snippet` | Not supported yet. | +| `nginx.ingress.kubernetes.io/app-root` | | +| `nginx.ingress.kubernetes.io/affinity-canary-behavior` | | +| `nginx.ingress.kubernetes.io/auth-tls-secret` | | +| `nginx.ingress.kubernetes.io/auth-tls-verify-depth` | | +| `nginx.ingress.kubernetes.io/auth-tls-verify-client` | | +| `nginx.ingress.kubernetes.io/auth-tls-error-page` | | +| `nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream` | | +| `nginx.ingress.kubernetes.io/auth-tls-match-cn` | | +| `nginx.ingress.kubernetes.io/auth-cache-key` | | +| `nginx.ingress.kubernetes.io/auth-cache-duration` | | +| `nginx.ingress.kubernetes.io/auth-keepalive` | | +| `nginx.ingress.kubernetes.io/auth-keepalive-share-vars` | | +| `nginx.ingress.kubernetes.io/auth-keepalive-requests` | | +| `nginx.ingress.kubernetes.io/auth-keepalive-timeout` | | +| `nginx.ingress.kubernetes.io/auth-proxy-set-headers` | | +| `nginx.ingress.kubernetes.io/auth-snippet` | | +| `nginx.ingress.kubernetes.io/enable-global-auth` | | +| `nginx.ingress.kubernetes.io/canary` | | +| `nginx.ingress.kubernetes.io/canary-by-header` | | +| `nginx.ingress.kubernetes.io/canary-by-header-value` | | +| `nginx.ingress.kubernetes.io/canary-by-header-pattern` | | +| `nginx.ingress.kubernetes.io/canary-by-cookie` | | +| `nginx.ingress.kubernetes.io/canary-weight` | | +| `nginx.ingress.kubernetes.io/canary-weight-total` | | +| `nginx.ingress.kubernetes.io/client-body-buffer-size` | | +| `nginx.ingress.kubernetes.io/configuration-snippet` | | +| `nginx.ingress.kubernetes.io/custom-http-errors` | | +| `nginx.ingress.kubernetes.io/disable-proxy-intercept-errors` | | +| `nginx.ingress.kubernetes.io/default-backend` | Use `defaultBackend` in Ingress spec. | +| `nginx.ingress.kubernetes.io/limit-rate-after` | | +| `nginx.ingress.kubernetes.io/limit-rate` | | +| `nginx.ingress.kubernetes.io/limit-whitelist` | | +| `nginx.ingress.kubernetes.io/limit-rps` | | +| `nginx.ingress.kubernetes.io/limit-rpm` | | +| `nginx.ingress.kubernetes.io/limit-burst-multiplier` | | +| `nginx.ingress.kubernetes.io/limit-connections` | | +| `nginx.ingress.kubernetes.io/global-rate-limit` | | +| `nginx.ingress.kubernetes.io/global-rate-limit-window` | | +| `nginx.ingress.kubernetes.io/global-rate-limit-key` | | +| `nginx.ingress.kubernetes.io/global-rate-limit-ignored-cidrs` | | +| `nginx.ingress.kubernetes.io/permanent-redirect` | | +| `nginx.ingress.kubernetes.io/permanent-redirect-code` | | +| `nginx.ingress.kubernetes.io/temporal-redirect` | | +| `nginx.ingress.kubernetes.io/preserve-trailing-slash` | Traefik preserves trailing slash by default. | +| `nginx.ingress.kubernetes.io/proxy-cookie-domain` | | +| `nginx.ingress.kubernetes.io/proxy-cookie-path` | | +| `nginx.ingress.kubernetes.io/proxy-connect-timeout` | | +| `nginx.ingress.kubernetes.io/proxy-send-timeout` | | +| `nginx.ingress.kubernetes.io/proxy-read-timeout` | | +| `nginx.ingress.kubernetes.io/proxy-next-upstream` | | +| `nginx.ingress.kubernetes.io/proxy-next-upstream-timeout` | | +| `nginx.ingress.kubernetes.io/proxy-next-upstream-tries` | | +| `nginx.ingress.kubernetes.io/proxy-request-buffering` | | +| `nginx.ingress.kubernetes.io/proxy-redirect-from` | | +| `nginx.ingress.kubernetes.io/proxy-redirect-to` | | +| `nginx.ingress.kubernetes.io/proxy-http-version` | | +| `nginx.ingress.kubernetes.io/proxy-ssl-ciphers` | | +| `nginx.ingress.kubernetes.io/proxy-ssl-verify-depth` | | +| `nginx.ingress.kubernetes.io/proxy-ssl-protocols` | | +| `nginx.ingress.kubernetes.io/enable-rewrite-log` | | +| `nginx.ingress.kubernetes.io/rewrite-target` | | +| `nginx.ingress.kubernetes.io/satisfy` | | +| `nginx.ingress.kubernetes.io/server-alias` | | +| `nginx.ingress.kubernetes.io/server-snippet` | | +| `nginx.ingress.kubernetes.io/session-cookie-conditional-samesite-none` | | +| `nginx.ingress.kubernetes.io/session-cookie-expires` | | +| `nginx.ingress.kubernetes.io/session-cookie-change-on-failure` | | +| `nginx.ingress.kubernetes.io/ssl-ciphers` | | +| `nginx.ingress.kubernetes.io/ssl-prefer-server-ciphers` | | +| `nginx.ingress.kubernetes.io/connection-proxy-header` | | +| `nginx.ingress.kubernetes.io/enable-access-log` | | +| `nginx.ingress.kubernetes.io/enable-opentracing` | | +| `nginx.ingress.kubernetes.io/opentracing-trust-incoming-span` | | +| `nginx.ingress.kubernetes.io/enable-opentelemetry` | | +| `nginx.ingress.kubernetes.io/opentelemetry-trust-incoming-span` | | +| `nginx.ingress.kubernetes.io/enable-modsecurity` | | +| `nginx.ingress.kubernetes.io/enable-owasp-core-rules` | | +| `nginx.ingress.kubernetes.io/modsecurity-transaction-id` | | +| `nginx.ingress.kubernetes.io/modsecurity-snippet` | | +| `nginx.ingress.kubernetes.io/mirror-request-body` | | +| `nginx.ingress.kubernetes.io/mirror-target` | | +| `nginx.ingress.kubernetes.io/mirror-host` | | +| `nginx.ingress.kubernetes.io/x-forwarded-prefix` | | +| `nginx.ingress.kubernetes.io/upstream-hash-by` | | +| `nginx.ingress.kubernetes.io/upstream-vhost` | | +| `nginx.ingress.kubernetes.io/denylist-source-range` | | +| `nginx.ingress.kubernetes.io/whitelist-source-range` | | +| `nginx.ingress.kubernetes.io/proxy-buffering` | | +| `nginx.ingress.kubernetes.io/proxy-buffers-number` | | +| `nginx.ingress.kubernetes.io/proxy-buffer-size` | | +| `nginx.ingress.kubernetes.io/proxy-max-temp-file-size` | | +| `nginx.ingress.kubernetes.io/stream-snippet` | | + +### Global Configuration + +Traefik does not expose all global configuration options to control default behaviors for Ingresses in the same way NGINX does. + +Some behaviors that are globally configurable in NGINX (such as default SSL redirect, rate limiting, or affinity) are currently not supported and cannot be overridden per-Ingress as in NGINX. These limitations are noted in the annotation tables below where applicable. diff --git a/docs/content/reference/routing-configuration/other-providers/docker.md b/docs/content/reference/routing-configuration/other-providers/docker.md index a17ae2a09..4cc633bd1 100644 --- a/docs/content/reference/routing-configuration/other-providers/docker.md +++ b/docs/content/reference/routing-configuration/other-providers/docker.md @@ -285,6 +285,15 @@ you'd add the label `traefik.http.services..loadbalancer.pa "traefik.http.services.myservice.loadbalancer.server.scheme=http" ``` +??? info "`traefik.http.services..loadbalancer.server.url`" + + Defines the service URL. + This option cannot be used in combination with `port` or `scheme` definition. + + ```yaml + traefik.http.services..loadbalancer.server.url=http://foobar:8080 + ``` + ??? info "`traefik.http.services..loadbalancer.serverstransport`" Allows to reference a ServersTransport resource that is defined either with the File provider or the Kubernetes CRD one. diff --git a/docs/content/reference/routing-configuration/other-providers/swarm.md b/docs/content/reference/routing-configuration/other-providers/swarm.md index 427484d8d..2885b1e48 100644 --- a/docs/content/reference/routing-configuration/other-providers/swarm.md +++ b/docs/content/reference/routing-configuration/other-providers/swarm.md @@ -301,6 +301,15 @@ you'd add the label `traefik.http.services..loadbalancer.pa - "traefik.http.services.myservice.loadbalancer.server.scheme=http" ``` +??? info "`traefik.http.services..loadbalancer.server.url`" + + Defines the service URL. + This option cannot be used in combination with `port` or `scheme` definition. + + ```yaml + traefik.http.services..loadbalancer.server.url=http://foobar:8080 + ``` + ??? info "`traefik.http.services..loadbalancer.server.weight`" Overrides the default weight. diff --git a/docs/content/routing/services/index.md b/docs/content/routing/services/index.md index 3b0574d15..0c736b1b1 100644 --- a/docs/content/routing/services/index.md +++ b/docs/content/routing/services/index.md @@ -255,7 +255,7 @@ HighestRandomWeight, also called RendezVous hashing allows to loadbalance client services: my-service: loadBalancer: - type: hrw + strategy: hrw servers: - url: "http://private-ip-server-1/" - url: "http://private-ip-server-2/" @@ -1306,13 +1306,13 @@ http: appv1: loadBalancer: - type: hrw + strategy: hrw servers: - url: "http://private-ip-server-1/" appv2: loadBalancer: - type: hrw + strategy: hrw servers: - url: "http://private-ip-server-2/" ``` @@ -1330,13 +1330,13 @@ http: [http.services.appv1] [http.services.appv1.loadBalancer] - type = "hrw" + strategy = "hrw" [[http.services.appv1.loadBalancer.servers]] url = "http://private-ip-server-1/" [http.services.appv2] [http.services.appv2.loadBalancer] - type = "hrw" + strategy = "hrw" [[http.services.appv2.loadBalancer.servers]] url = "http://private-ip-server-2/" ``` @@ -1371,7 +1371,7 @@ http: appv1: loadBalancer: - type: hrw + strategy: hrw healthCheck: path: /status interval: 10s @@ -1381,7 +1381,7 @@ http: appv2: loadBalancer: - type: hrw + strategy: hrw healthCheck: path: /status interval: 10s @@ -1404,7 +1404,7 @@ http: [http.services.appv1] [http.services.appv1.loadBalancer] - type="hrw" + strategy="hrw" [http.services.appv1.loadBalancer.healthCheck] path = "/health" interval = "10s" @@ -1414,7 +1414,7 @@ http: [http.services.appv2] [http.services.appv2.loadBalancer] - type="hrw" + strategy="hrw" [http.services.appv2.loadBalancer.healthCheck] path = "/health" interval = "10s" diff --git a/docs/content/user-guides/crd-acme/k3s.yml b/docs/content/user-guides/crd-acme/k3s.yml index ecdd5d60d..8701d7305 100644 --- a/docs/content/user-guides/crd-acme/k3s.yml +++ b/docs/content/user-guides/crd-acme/k3s.yml @@ -1,5 +1,5 @@ server: - image: rancher/k3s:v1.17.2-k3s1 + image: rancher/k3s:v1.34.2-k3s1 command: server --disable-agent --no-deploy traefik environment: - K3S_CLUSTER_SECRET=somethingtotallyrandom @@ -17,7 +17,7 @@ server: - 6443:6443 node: - image: rancher/k3s:v1.17.2-k3s1 + image: rancher/k3s:v1.34.2-k3s1 privileged: true links: - server diff --git a/go.mod b/go.mod index d6b7ffc04..d54d99a1e 100644 --- a/go.mod +++ b/go.mod @@ -55,7 +55,7 @@ require ( github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // No tag on the repo. github.com/prometheus/client_golang v1.23.0 github.com/prometheus/client_model v0.6.2 - github.com/quic-go/quic-go v0.55.0 + github.com/quic-go/quic-go v0.57.0 github.com/redis/go-redis/v9 v9.8.0 github.com/rs/zerolog v1.33.0 github.com/sirupsen/logrus v1.9.3 @@ -95,14 +95,14 @@ require ( go.opentelemetry.io/otel/sdk/log v0.14.0 go.opentelemetry.io/otel/sdk/metric v1.38.0 go.opentelemetry.io/otel/trace v1.38.0 - golang.org/x/crypto v0.43.0 - golang.org/x/mod v0.28.0 - golang.org/x/net v0.46.0 - golang.org/x/sync v0.17.0 - golang.org/x/sys v0.37.0 - golang.org/x/text v0.30.0 + golang.org/x/crypto v0.45.0 + golang.org/x/mod v0.29.0 + golang.org/x/net v0.47.0 + golang.org/x/sync v0.18.0 + golang.org/x/sys v0.38.0 + golang.org/x/text v0.31.0 golang.org/x/time v0.14.0 - golang.org/x/tools v0.37.0 + golang.org/x/tools v0.38.0 google.golang.org/grpc v1.76.0 gopkg.in/natefinch/lumberjack.v2 v2.2.1 gopkg.in/yaml.v3 v3.0.1 @@ -322,7 +322,7 @@ require ( github.com/pquerna/otp v1.5.0 // indirect github.com/prometheus/common v0.65.0 // indirect github.com/prometheus/procfs v0.17.0 // indirect - github.com/quic-go/qpack v0.5.1 // indirect + github.com/quic-go/qpack v0.6.0 // indirect github.com/regfish/regfish-dnsapi-go v0.1.1 // indirect github.com/rs/cors v1.7.0 // indirect github.com/rs/dnscache v0.0.0-20230804202142-fc85eb664529 // indirect @@ -388,9 +388,9 @@ require ( go.yaml.in/yaml/v2 v2.4.2 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/arch v0.4.0 // indirect - golang.org/x/exp v0.0.0-20241210194714-1829a127f884 // indirect + golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect golang.org/x/oauth2 v0.32.0 // indirect - golang.org/x/term v0.36.0 // indirect + golang.org/x/term v0.37.0 // indirect gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect google.golang.org/api v0.254.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 // indirect diff --git a/go.sum b/go.sum index 49d7644ca..cc62fdc14 100644 --- a/go.sum +++ b/go.sum @@ -1112,10 +1112,10 @@ github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUO github.com/prometheus/statsd_exporter v0.22.7 h1:7Pji/i2GuhK6Lu7DHrtTkFmNBCudCPT1pX2CziuyQR0= github.com/prometheus/statsd_exporter v0.22.7/go.mod h1:N/TevpjkIh9ccs6nuzY3jQn9dFqnUakOjnEuMPJJJnI= github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU= -github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI= -github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg= -github.com/quic-go/quic-go v0.55.0 h1:zccPQIqYCXDt5NmcEabyYvOnomjs8Tlwl7tISjJh9Mk= -github.com/quic-go/quic-go v0.55.0/go.mod h1:DR51ilwU1uE164KuWXhinFcKWGlEjzys2l8zUl5Ss1U= +github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8= +github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII= +github.com/quic-go/quic-go v0.57.0 h1:AsSSrrMs4qI/hLrKlTH/TGQeTMY0ib1pAOX7vA3AdqE= +github.com/quic-go/quic-go v0.57.0/go.mod h1:ly4QBAjHA2VhdnxhojRsCUOeJwKYg+taDlos92xb1+s= github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4= github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4= github.com/redis/go-redis/v9 v9.8.0 h1:q3nRvjrlge/6UD7eTu/DSg2uYiU2mCL0G/uzBWqhicI= @@ -1507,8 +1507,8 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs= golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM= -golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04= -golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0= +golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= +golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= @@ -1522,8 +1522,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4= golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM= golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU= -golang.org/x/exp v0.0.0-20241210194714-1829a127f884 h1:Y/Mj/94zIQQGHVSv1tTtQBDaQaJe62U9bkDZKKyhPCU= -golang.org/x/exp v0.0.0-20241210194714-1829a127f884/go.mod h1:qj5a5QZpwLU2NLQudwIN5koi3beDhSAlJwa67PuM98c= +golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM= +golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8= golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs= golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js= golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= @@ -1553,8 +1553,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= -golang.org/x/mod v0.28.0 h1:gQBtGhjxykdjY9YhZpSlZIsbnaE2+PgjfLWUQTnoZ1U= -golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI= +golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA= +golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -1617,8 +1617,8 @@ golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE= -golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4= -golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210= +golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY= +golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -1644,8 +1644,8 @@ golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= -golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug= -golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= +golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I= +golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -1743,8 +1743,8 @@ golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ= -golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc= +golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= @@ -1761,8 +1761,8 @@ golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58= golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY= golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0= -golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q= -golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss= +golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU= +golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -1781,8 +1781,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI= -golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k= -golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM= +golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM= +golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -1852,8 +1852,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= -golang.org/x/tools v0.37.0 h1:DVSRzp7FwePZW356yEAChSdNcQo6Nsp+fex1SUW09lE= -golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w= +golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ= +golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= diff --git a/integration/integration_test.go b/integration/integration_test.go index 815463498..9ef4f8782 100644 --- a/integration/integration_test.go +++ b/integration/integration_test.go @@ -42,7 +42,7 @@ var ( ) const ( - k3sImage = "docker.io/rancher/k3s:v1.32.9-k3s1" + k3sImage = "docker.io/rancher/k3s:v1.34.2-k3s1" traefikImage = "traefik/traefik:latest" traefikDeployment = "deployments/traefik" traefikNamespace = "traefik" diff --git a/integration/resources/compose/k8s.yml b/integration/resources/compose/k8s.yml index 51e46b0be..81c098d98 100644 --- a/integration/resources/compose/k8s.yml +++ b/integration/resources/compose/k8s.yml @@ -1,6 +1,6 @@ services: server: - image: rancher/k3s:v1.21.14-k3s1 + image: rancher/k3s:v1.34.2-k3s1 privileged: true command: - server @@ -25,7 +25,7 @@ services: - ./fixtures/k8s:/var/lib/rancher/k3s/server/manifests node: - image: rancher/k3s:v1.21.14-k3s1 + image: rancher/k3s:v1.34.2-k3s1 privileged: true environment: K3S_TOKEN: somethingtotallyrandom diff --git a/pkg/cli/deprecation.go b/pkg/cli/deprecation.go index 7f526b503..1277e52c6 100644 --- a/pkg/cli/deprecation.go +++ b/pkg/cli/deprecation.go @@ -568,8 +568,9 @@ func (i *ingress) deprecationNotice(logger zerolog.Logger) { } type experimental struct { - HTTP3 *bool `json:"http3,omitempty" toml:"http3,omitempty" yaml:"http3,omitempty"` - KubernetesGateway *bool `json:"kubernetesGateway,omitempty" toml:"kubernetesGateway,omitempty" yaml:"kubernetesGateway,omitempty"` + HTTP3 *bool `json:"http3,omitempty" toml:"http3,omitempty" yaml:"http3,omitempty"` + KubernetesGateway *bool `json:"kubernetesGateway,omitempty" toml:"kubernetesGateway,omitempty" yaml:"kubernetesGateway,omitempty"` + KubernetesIngressNGINX *bool `json:"kubernetesIngressNGINX,omitempty" toml:"kubernetesIngressNGINX,omitempty" yaml:"kubernetesIngressNGINX,omitempty"` } func (e *experimental) deprecationNotice(logger zerolog.Logger) bool { @@ -591,6 +592,12 @@ func (e *experimental) deprecationNotice(logger zerolog.Logger) bool { " For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v3/#gateway-api-kubernetesgateway-provider") } + if e.KubernetesIngressNGINX != nil { + logger.Error().Msg("KubernetesIngressNGINX provider is not an experimental feature starting with v3.6.2." + + " Please remove its usage from the install configuration." + + " For more information please read the migration guide: https://doc.traefik.io/traefik/v3.6/migration/v3/#ingress-nginx-provider") + } + return false } diff --git a/pkg/config/static/experimental.go b/pkg/config/static/experimental.go index e0db0589c..32f131c14 100644 --- a/pkg/config/static/experimental.go +++ b/pkg/config/static/experimental.go @@ -4,14 +4,15 @@ import "github.com/traefik/traefik/v3/pkg/plugins" // Experimental experimental Traefik features. type Experimental struct { - Plugins map[string]plugins.Descriptor `description:"Plugins configuration." json:"plugins,omitempty" toml:"plugins,omitempty" yaml:"plugins,omitempty" export:"true"` - LocalPlugins map[string]plugins.LocalDescriptor `description:"Local plugins configuration." json:"localPlugins,omitempty" toml:"localPlugins,omitempty" yaml:"localPlugins,omitempty" export:"true"` - AbortOnPluginFailure bool `description:"Defines whether all plugins must be loaded successfully for Traefik to start." json:"abortOnPluginFailure,omitempty" toml:"abortOnPluginFailure,omitempty" yaml:"abortOnPluginFailure,omitempty" export:"true"` - FastProxy *FastProxyConfig `description:"Enables the FastProxy implementation." json:"fastProxy,omitempty" toml:"fastProxy,omitempty" yaml:"fastProxy,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` - OTLPLogs bool `description:"Enables the OpenTelemetry logs integration." json:"otlplogs,omitempty" toml:"otlplogs,omitempty" yaml:"otlplogs,omitempty" export:"true"` - Knative bool `description:"Allow the Knative provider usage." json:"knative,omitempty" toml:"knative,omitempty" yaml:"knative,omitempty" export:"true"` - KubernetesIngressNGINX bool `description:"Allow the Kubernetes Ingress NGINX provider usage." json:"kubernetesIngressNGINX,omitempty" toml:"kubernetesIngressNGINX,omitempty" yaml:"kubernetesIngressNGINX,omitempty" export:"true"` + Plugins map[string]plugins.Descriptor `description:"Plugins configuration." json:"plugins,omitempty" toml:"plugins,omitempty" yaml:"plugins,omitempty" export:"true"` + LocalPlugins map[string]plugins.LocalDescriptor `description:"Local plugins configuration." json:"localPlugins,omitempty" toml:"localPlugins,omitempty" yaml:"localPlugins,omitempty" export:"true"` + AbortOnPluginFailure bool `description:"Defines whether all plugins must be loaded successfully for Traefik to start." json:"abortOnPluginFailure,omitempty" toml:"abortOnPluginFailure,omitempty" yaml:"abortOnPluginFailure,omitempty" export:"true"` + FastProxy *FastProxyConfig `description:"Enables the FastProxy implementation." json:"fastProxy,omitempty" toml:"fastProxy,omitempty" yaml:"fastProxy,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` + OTLPLogs bool `description:"Enables the OpenTelemetry logs integration." json:"otlplogs,omitempty" toml:"otlplogs,omitempty" yaml:"otlplogs,omitempty" export:"true"` + Knative bool `description:"Allow the Knative provider usage." json:"knative,omitempty" toml:"knative,omitempty" yaml:"knative,omitempty" export:"true"` + // Deprecated: KubernetesIngressNGINX provider is not an experimental feature starting with v3.6.2. Please remove its usage from the static configuration. + KubernetesIngressNGINX bool `description:"Allow the Kubernetes Ingress NGINX provider usage." json:"kubernetesIngressNGINX,omitempty" toml:"kubernetesIngressNGINX,omitempty" yaml:"kubernetesIngressNGINX,omitempty" export:"true"` // Deprecated: KubernetesGateway provider is not an experimental feature starting with v3.1. Please remove its usage from the static configuration. KubernetesGateway bool `description:"(Deprecated) Allow the Kubernetes gateway api provider usage." json:"kubernetesGateway,omitempty" toml:"kubernetesGateway,omitempty" yaml:"kubernetesGateway,omitempty" export:"true"` } diff --git a/pkg/config/static/static_config.go b/pkg/config/static/static_config.go index bdbefdbe9..8b1aac36d 100644 --- a/pkg/config/static/static_config.go +++ b/pkg/config/static/static_config.go @@ -424,10 +424,6 @@ func (c *Configuration) ValidateConfiguration() error { } if c.Providers != nil && c.Providers.KubernetesIngressNGINX != nil { - if c.Experimental == nil || !c.Experimental.KubernetesIngressNGINX { - return errors.New("the experimental KubernetesIngressNGINX feature must be enabled to use the KubernetesIngressNGINX provider") - } - if c.Providers.KubernetesIngressNGINX.WatchNamespace != "" && c.Providers.KubernetesIngressNGINX.WatchNamespaceSelector != "" { return errors.New("watchNamespace and watchNamespaceSelector options are mutually exclusive") } diff --git a/pkg/plugins/plugins.go b/pkg/plugins/plugins.go index f7d543154..8157a04c7 100644 --- a/pkg/plugins/plugins.go +++ b/pkg/plugins/plugins.go @@ -8,6 +8,7 @@ import ( "github.com/hashicorp/go-multierror" "github.com/rs/zerolog/log" + "golang.org/x/mod/module" ) const localGoPath = "./plugins-local/" @@ -53,24 +54,18 @@ func checkRemotePluginsConfiguration(plugins map[string]Descriptor) error { var errs []string for pAlias, descriptor := range plugins { - if descriptor.ModuleName == "" { - errs = append(errs, fmt.Sprintf("%s: plugin name is missing", pAlias)) + if err := module.CheckPath(descriptor.ModuleName); err != nil { + errs = append(errs, fmt.Sprintf("%s: malformed plugin module name is missing: %s", pAlias, err)) } if descriptor.Version == "" { errs = append(errs, fmt.Sprintf("%s: plugin version is missing", pAlias)) } - if strings.HasPrefix(descriptor.ModuleName, "/") || strings.HasSuffix(descriptor.ModuleName, "/") { - errs = append(errs, fmt.Sprintf("%s: plugin name should not start or end with a /", pAlias)) - continue - } - if _, ok := uniq[descriptor.ModuleName]; ok { errs = append(errs, fmt.Sprintf("only one version of a plugin is allowed, there is a duplicate of %s", descriptor.ModuleName)) continue } - uniq[descriptor.ModuleName] = struct{}{} } diff --git a/pkg/plugins/plugins_test.go b/pkg/plugins/plugins_test.go new file mode 100644 index 000000000..0fff67915 --- /dev/null +++ b/pkg/plugins/plugins_test.go @@ -0,0 +1,85 @@ +package plugins + +import ( + "testing" + + "github.com/stretchr/testify/assert" +) + +func Test_checkRemotePluginsConfiguration(t *testing.T) { + testCases := []struct { + name string + plugins map[string]Descriptor + wantErr bool + }{ + { + name: "nil plugins configuration returns no error", + plugins: nil, + wantErr: false, + }, + { + name: "malformed module name returns error", + plugins: map[string]Descriptor{ + "plugin1": {ModuleName: "invalid/module/name", Version: "v1.0.0"}, + }, + wantErr: true, + }, + { + name: "malformed module name with path traversal returns error", + plugins: map[string]Descriptor{ + "plugin1": {ModuleName: "github.com/module/../name", Version: "v1.0.0"}, + }, + wantErr: true, + }, + { + name: "malformed module name with encoded path traversal returns error", + plugins: map[string]Descriptor{ + "plugin1": {ModuleName: "github.com/module%2F%2E%2E%2Fname", Version: "v1.0.0"}, + }, + wantErr: true, + }, + { + name: "malformed module name returns error", + plugins: map[string]Descriptor{ + "plugin1": {ModuleName: "invalid/module/name", Version: "v1.0.0"}, + }, + wantErr: true, + }, + { + name: "missing plugin version returns error", + plugins: map[string]Descriptor{ + "plugin1": {ModuleName: "github.com/module/name", Version: ""}, + }, + wantErr: true, + }, + { + name: "duplicate plugin module name returns error", + plugins: map[string]Descriptor{ + "plugin1": {ModuleName: "github.com/module/name", Version: "v1.0.0"}, + "plugin2": {ModuleName: "github.com/module/name", Version: "v1.1.0"}, + }, + wantErr: true, + }, + { + name: "valid plugins configuration returns no error", + plugins: map[string]Descriptor{ + "plugin1": {ModuleName: "github.com/module/name1", Version: "v1.0.0"}, + "plugin2": {ModuleName: "github.com/module/name2", Version: "v1.1.0"}, + }, + wantErr: false, + }, + } + + for _, test := range testCases { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + + err := checkRemotePluginsConfiguration(test.plugins) + if test.wantErr { + assert.Error(t, err) + } else { + assert.NoError(t, err) + } + }) + } +} diff --git a/pkg/provider/docker/pdocker.go b/pkg/provider/docker/pdocker.go index 0ed6e53aa..684e97c11 100644 --- a/pkg/provider/docker/pdocker.go +++ b/pkg/provider/docker/pdocker.go @@ -21,9 +21,6 @@ import ( "github.com/traefik/traefik/v3/pkg/safe" ) -// DockerAPIVersion is a constant holding the version of the Provider API traefik will use. -const DockerAPIVersion = "1.24" - const dockerName = "docker" var _ provider.Provider = (*Provider)(nil) @@ -54,7 +51,6 @@ func (p *Provider) Init() error { } func (p *Provider) createClient(ctx context.Context) (*client.Client, error) { - p.ClientConfig.apiVersion = DockerAPIVersion return createClient(ctx, p.ClientConfig) } diff --git a/pkg/provider/docker/pswarm.go b/pkg/provider/docker/pswarm.go index bcb7ded48..f596b9e67 100644 --- a/pkg/provider/docker/pswarm.go +++ b/pkg/provider/docker/pswarm.go @@ -22,9 +22,6 @@ import ( "github.com/traefik/traefik/v3/pkg/safe" ) -// SwarmAPIVersion is a constant holding the version of the Provider API traefik will use. -const SwarmAPIVersion = "1.24" - const swarmName = "swarm" var _ provider.Provider = (*SwarmProvider)(nil) @@ -58,7 +55,6 @@ func (p *SwarmProvider) Init() error { } func (p *SwarmProvider) createClient(ctx context.Context) (*client.Client, error) { - p.ClientConfig.apiVersion = SwarmAPIVersion return createClient(ctx, p.ClientConfig) } diff --git a/pkg/provider/docker/shared.go b/pkg/provider/docker/shared.go index 01eb92e19..d62990305 100644 --- a/pkg/provider/docker/shared.go +++ b/pkg/provider/docker/shared.go @@ -100,8 +100,6 @@ func parseContainer(container containertypes.InspectResponse) dockerData { } type ClientConfig struct { - apiVersion string - Username string `description:"Username for Basic HTTP authentication." json:"username,omitempty" toml:"username,omitempty" yaml:"username,omitempty"` Password string `description:"Password for Basic HTTP authentication." json:"password,omitempty" toml:"password,omitempty" yaml:"password,omitempty"` Endpoint string `description:"Docker server endpoint. Can be a TCP or a Unix socket endpoint." json:"endpoint,omitempty" toml:"endpoint,omitempty" yaml:"endpoint,omitempty"` @@ -123,8 +121,9 @@ func createClient(ctx context.Context, cfg ClientConfig) (*client.Client, error) } opts = append(opts, - client.WithHTTPHeaders(httpHeaders), - client.WithVersion(cfg.apiVersion)) + client.FromEnv, + client.WithAPIVersionNegotiation(), + client.WithHTTPHeaders(httpHeaders)) return client.NewClientWithOpts(opts...) } diff --git a/pkg/server/aggregator.go b/pkg/server/aggregator.go index 49f311a84..dc342ad3a 100644 --- a/pkg/server/aggregator.go +++ b/pkg/server/aggregator.go @@ -175,9 +175,11 @@ func applyModel(cfg dynamic.Configuration) dynamic.Configuration { if cfg.HTTP != nil && len(cfg.HTTP.Models) > 0 { rts := make(map[string]*dynamic.Router) + modelRouterNames := make(map[string][]string) for name, rt := range cfg.HTTP.Routers { // Only root routers can have models applied. if rt.ParentRefs != nil { + rts[name] = rt continue } @@ -233,7 +235,9 @@ func applyModel(cfg dynamic.Configuration) dynamic.Configuration { rtName := name if len(eps) > 1 { rtName = epName + "-" + name + modelRouterNames[name] = append(modelRouterNames[name], rtName) } + rts[rtName] = cp } else { router.EntryPoints = append(router.EntryPoints, epName) @@ -243,6 +247,26 @@ func applyModel(cfg dynamic.Configuration) dynamic.Configuration { } } + for _, rt := range rts { + if rt.ParentRefs == nil { + continue + } + + var parentRefs []string + for _, ref := range rt.ParentRefs { + // Only add the initial parent ref if it still exists. + if _, ok := rts[ref]; ok { + parentRefs = append(parentRefs, ref) + } + + if names, ok := modelRouterNames[ref]; ok { + parentRefs = append(parentRefs, names...) + } + } + + rt.ParentRefs = parentRefs + } + cfg.HTTP.Routers = rts } diff --git a/pkg/server/aggregator_test.go b/pkg/server/aggregator_test.go index e33ef7ae1..8d78447d2 100644 --- a/pkg/server/aggregator_test.go +++ b/pkg/server/aggregator_test.go @@ -810,6 +810,414 @@ func Test_applyModel(t *testing.T) { }, }, }, + { + desc: "child router with parentRefs, parent not split", + input: dynamic.Configuration{ + HTTP: &dynamic.HTTPConfiguration{ + Routers: map[string]*dynamic.Router{ + "parent": { + EntryPoints: []string{"web"}, + }, + "child": { + ParentRefs: []string{"parent"}, + }, + }, + Middlewares: make(map[string]*dynamic.Middleware), + Services: make(map[string]*dynamic.Service), + Models: make(map[string]*dynamic.Model), + }, + }, + expected: dynamic.Configuration{ + HTTP: &dynamic.HTTPConfiguration{ + Routers: map[string]*dynamic.Router{ + "parent": { + EntryPoints: []string{"web"}, + Observability: &dynamic.RouterObservabilityConfig{ + AccessLogs: pointer(true), + Metrics: pointer(true), + Tracing: pointer(true), + TraceVerbosity: otypes.MinimalVerbosity, + }, + }, + "child": { + ParentRefs: []string{"parent"}, + }, + }, + Middlewares: make(map[string]*dynamic.Middleware), + Services: make(map[string]*dynamic.Service), + Models: make(map[string]*dynamic.Model), + }, + }, + }, + { + desc: "child router with parentRefs, parent split by model", + input: dynamic.Configuration{ + HTTP: &dynamic.HTTPConfiguration{ + Routers: map[string]*dynamic.Router{ + "parent": { + EntryPoints: []string{"websecure", "web"}, + }, + "child": { + ParentRefs: []string{"parent"}, + }, + }, + Middlewares: make(map[string]*dynamic.Middleware), + Services: make(map[string]*dynamic.Service), + Models: map[string]*dynamic.Model{ + "websecure@internal": { + Middlewares: []string{"test"}, + TLS: &dynamic.RouterTLSConfig{}, + }, + }, + }, + }, + expected: dynamic.Configuration{ + HTTP: &dynamic.HTTPConfiguration{ + Routers: map[string]*dynamic.Router{ + "parent": { + EntryPoints: []string{"web"}, + Observability: &dynamic.RouterObservabilityConfig{ + AccessLogs: pointer(true), + Metrics: pointer(true), + Tracing: pointer(true), + TraceVerbosity: otypes.MinimalVerbosity, + }, + }, + "websecure-parent": { + EntryPoints: []string{"websecure"}, + Middlewares: []string{"test"}, + TLS: &dynamic.RouterTLSConfig{}, + Observability: &dynamic.RouterObservabilityConfig{ + AccessLogs: pointer(true), + Metrics: pointer(true), + Tracing: pointer(true), + TraceVerbosity: otypes.MinimalVerbosity, + }, + }, + "child": { + ParentRefs: []string{"parent", "websecure-parent"}, + }, + }, + Middlewares: make(map[string]*dynamic.Middleware), + Services: make(map[string]*dynamic.Service), + Models: map[string]*dynamic.Model{ + "websecure@internal": { + Middlewares: []string{"test"}, + TLS: &dynamic.RouterTLSConfig{}, + }, + }, + }, + }, + }, + { + desc: "multiple child routers with parentRefs, parent split by model", + input: dynamic.Configuration{ + HTTP: &dynamic.HTTPConfiguration{ + Routers: map[string]*dynamic.Router{ + "parent": { + EntryPoints: []string{"websecure", "web"}, + }, + "child1": { + ParentRefs: []string{"parent"}, + }, + "child2": { + ParentRefs: []string{"parent"}, + }, + }, + Middlewares: make(map[string]*dynamic.Middleware), + Services: make(map[string]*dynamic.Service), + Models: map[string]*dynamic.Model{ + "websecure@internal": { + Middlewares: []string{"auth"}, + }, + }, + }, + }, + expected: dynamic.Configuration{ + HTTP: &dynamic.HTTPConfiguration{ + Routers: map[string]*dynamic.Router{ + "parent": { + EntryPoints: []string{"web"}, + Observability: &dynamic.RouterObservabilityConfig{ + AccessLogs: pointer(true), + Metrics: pointer(true), + Tracing: pointer(true), + TraceVerbosity: otypes.MinimalVerbosity, + }, + }, + "websecure-parent": { + EntryPoints: []string{"websecure"}, + Middlewares: []string{"auth"}, + Observability: &dynamic.RouterObservabilityConfig{ + AccessLogs: pointer(true), + Metrics: pointer(true), + Tracing: pointer(true), + TraceVerbosity: otypes.MinimalVerbosity, + }, + }, + "child1": { + ParentRefs: []string{"parent", "websecure-parent"}, + }, + "child2": { + ParentRefs: []string{"parent", "websecure-parent"}, + }, + }, + Middlewares: make(map[string]*dynamic.Middleware), + Services: make(map[string]*dynamic.Service), + Models: map[string]*dynamic.Model{ + "websecure@internal": { + Middlewares: []string{"auth"}, + }, + }, + }, + }, + }, + { + desc: "child router with parentRefs to non-existing parent", + input: dynamic.Configuration{ + HTTP: &dynamic.HTTPConfiguration{ + Routers: map[string]*dynamic.Router{ + "child": { + ParentRefs: []string{"nonexistent"}, + }, + }, + Middlewares: make(map[string]*dynamic.Middleware), + Services: make(map[string]*dynamic.Service), + Models: make(map[string]*dynamic.Model), + }, + }, + expected: dynamic.Configuration{ + HTTP: &dynamic.HTTPConfiguration{ + Routers: map[string]*dynamic.Router{ + "child": { + ParentRefs: []string{"nonexistent"}, + }, + }, + Middlewares: make(map[string]*dynamic.Middleware), + Services: make(map[string]*dynamic.Service), + Models: make(map[string]*dynamic.Model), + }, + }, + }, + { + desc: "child router with multiple parentRefs, some split", + input: dynamic.Configuration{ + HTTP: &dynamic.HTTPConfiguration{ + Routers: map[string]*dynamic.Router{ + "parent1": { + EntryPoints: []string{"websecure", "web"}, + }, + "parent2": { + EntryPoints: []string{"web"}, + }, + "child": { + ParentRefs: []string{"parent1", "parent2"}, + }, + }, + Middlewares: make(map[string]*dynamic.Middleware), + Services: make(map[string]*dynamic.Service), + Models: map[string]*dynamic.Model{ + "websecure@internal": { + TLS: &dynamic.RouterTLSConfig{}, + }, + }, + }, + }, + expected: dynamic.Configuration{ + HTTP: &dynamic.HTTPConfiguration{ + Routers: map[string]*dynamic.Router{ + "parent1": { + EntryPoints: []string{"web"}, + Observability: &dynamic.RouterObservabilityConfig{ + AccessLogs: pointer(true), + Metrics: pointer(true), + Tracing: pointer(true), + TraceVerbosity: otypes.MinimalVerbosity, + }, + }, + "websecure-parent1": { + EntryPoints: []string{"websecure"}, + TLS: &dynamic.RouterTLSConfig{}, + Observability: &dynamic.RouterObservabilityConfig{ + AccessLogs: pointer(true), + Metrics: pointer(true), + Tracing: pointer(true), + TraceVerbosity: otypes.MinimalVerbosity, + }, + }, + "parent2": { + EntryPoints: []string{"web"}, + Observability: &dynamic.RouterObservabilityConfig{ + AccessLogs: pointer(true), + Metrics: pointer(true), + Tracing: pointer(true), + TraceVerbosity: otypes.MinimalVerbosity, + }, + }, + "child": { + ParentRefs: []string{"parent1", "websecure-parent1", "parent2"}, + }, + }, + Middlewares: make(map[string]*dynamic.Middleware), + Services: make(map[string]*dynamic.Service), + Models: map[string]*dynamic.Model{ + "websecure@internal": { + TLS: &dynamic.RouterTLSConfig{}, + }, + }, + }, + }, + }, + { + desc: "child router with multiple parentRefs, all split", + input: dynamic.Configuration{ + HTTP: &dynamic.HTTPConfiguration{ + Routers: map[string]*dynamic.Router{ + "parent1": { + EntryPoints: []string{"websecure", "web"}, + }, + "parent2": { + EntryPoints: []string{"web"}, + }, + "child": { + ParentRefs: []string{"parent1", "parent2"}, + }, + }, + Middlewares: make(map[string]*dynamic.Middleware), + Services: make(map[string]*dynamic.Service), + Models: map[string]*dynamic.Model{ + "web@internal": { + TLS: &dynamic.RouterTLSConfig{}, + }, + "websecure@internal": { + TLS: &dynamic.RouterTLSConfig{}, + }, + }, + }, + }, + expected: dynamic.Configuration{ + HTTP: &dynamic.HTTPConfiguration{ + Routers: map[string]*dynamic.Router{ + "web-parent1": { + EntryPoints: []string{"web"}, + TLS: &dynamic.RouterTLSConfig{}, + Observability: &dynamic.RouterObservabilityConfig{ + AccessLogs: pointer(true), + Metrics: pointer(true), + Tracing: pointer(true), + TraceVerbosity: otypes.MinimalVerbosity, + }, + }, + "websecure-parent1": { + EntryPoints: []string{"websecure"}, + TLS: &dynamic.RouterTLSConfig{}, + Observability: &dynamic.RouterObservabilityConfig{ + AccessLogs: pointer(true), + Metrics: pointer(true), + Tracing: pointer(true), + TraceVerbosity: otypes.MinimalVerbosity, + }, + }, + "parent2": { + EntryPoints: []string{"web"}, + TLS: &dynamic.RouterTLSConfig{}, + Observability: &dynamic.RouterObservabilityConfig{ + AccessLogs: pointer(true), + Metrics: pointer(true), + Tracing: pointer(true), + TraceVerbosity: otypes.MinimalVerbosity, + }, + }, + "child": { + ParentRefs: []string{"websecure-parent1", "web-parent1", "parent2"}, + }, + }, + Middlewares: make(map[string]*dynamic.Middleware), + Services: make(map[string]*dynamic.Service), + Models: map[string]*dynamic.Model{ + "web@internal": { + TLS: &dynamic.RouterTLSConfig{}, + }, + "websecure@internal": { + TLS: &dynamic.RouterTLSConfig{}, + }, + }, + }, + }, + }, + { + desc: "child router with parentRefs, parent split into three routers", + input: dynamic.Configuration{ + HTTP: &dynamic.HTTPConfiguration{ + Routers: map[string]*dynamic.Router{ + "parent": { + EntryPoints: []string{"websecure", "web", "admin"}, + }, + "child": { + ParentRefs: []string{"parent"}, + }, + }, + Middlewares: make(map[string]*dynamic.Middleware), + Services: make(map[string]*dynamic.Service), + Models: map[string]*dynamic.Model{ + "websecure@internal": { + TLS: &dynamic.RouterTLSConfig{}, + }, + "admin@internal": { + Middlewares: []string{"admin-auth"}, + }, + }, + }, + }, + expected: dynamic.Configuration{ + HTTP: &dynamic.HTTPConfiguration{ + Routers: map[string]*dynamic.Router{ + "parent": { + EntryPoints: []string{"web"}, + Observability: &dynamic.RouterObservabilityConfig{ + AccessLogs: pointer(true), + Metrics: pointer(true), + Tracing: pointer(true), + TraceVerbosity: otypes.MinimalVerbosity, + }, + }, + "websecure-parent": { + EntryPoints: []string{"websecure"}, + TLS: &dynamic.RouterTLSConfig{}, + Observability: &dynamic.RouterObservabilityConfig{ + AccessLogs: pointer(true), + Metrics: pointer(true), + Tracing: pointer(true), + TraceVerbosity: otypes.MinimalVerbosity, + }, + }, + "admin-parent": { + EntryPoints: []string{"admin"}, + Middlewares: []string{"admin-auth"}, + Observability: &dynamic.RouterObservabilityConfig{ + AccessLogs: pointer(true), + Metrics: pointer(true), + Tracing: pointer(true), + TraceVerbosity: otypes.MinimalVerbosity, + }, + }, + "child": { + ParentRefs: []string{"parent", "websecure-parent", "admin-parent"}, + }, + }, + Middlewares: make(map[string]*dynamic.Middleware), + Services: make(map[string]*dynamic.Service), + Models: map[string]*dynamic.Model{ + "websecure@internal": { + TLS: &dynamic.RouterTLSConfig{}, + }, + "admin@internal": { + Middlewares: []string{"admin-auth"}, + }, + }, + }, + }, + }, } for _, test := range testCases { diff --git a/pkg/udp/conn.go b/pkg/udp/conn.go index 2a53b0a6b..36778f648 100644 --- a/pkg/udp/conn.go +++ b/pkg/udp/conn.go @@ -32,9 +32,6 @@ type Listener struct { // timeout defines how long to wait on an idle session, // before releasing its related resources. timeout time.Duration - - // readBufferPool is a pool of byte slices for UDP packet reading. - readBufferPool sync.Pool } // ListenPacketConn creates a new listener from PacketConn. @@ -54,11 +51,6 @@ func ListenPacketConn(packetConn net.PacketConn, timeout time.Duration) (*Listen conns: make(map[string]*Conn), accepting: true, timeout: timeout, - readBufferPool: sync.Pool{ - New: func() interface{} { - return make([]byte, maxDatagramSize) - }, - }, } go l.readLoop() @@ -160,26 +152,21 @@ func (l *Listener) readLoop() { for { // Allocating a new buffer for every read avoids // overwriting data in c.msgs in case the next packet is received - // before c.msgs is emptied via Read(). - // Reuses buffers via the readBufferPool sync.Pool. - buf := l.readBufferPool.Get().([]byte) + // before c.msgs is emptied via Read() + buf := make([]byte, maxDatagramSize) n, raddr, err := l.pConn.ReadFrom(buf) if err != nil { - l.readBufferPool.Put(buf) return } conn, err := l.getConn(raddr) if err != nil { - l.readBufferPool.Put(buf) continue } select { - // Receiver must call releaseReadBuffer() when done reading the data. case conn.receiveCh <- buf[:n]: case <-conn.doneCh: - l.readBufferPool.Put(buf) continue } } @@ -224,15 +211,15 @@ type Conn struct { listener *Listener rAddr net.Addr - receiveCh chan []byte // to receive the data from the listener's readLoop. - readCh chan []byte // to receive the buffer into which we should Read. - sizeCh chan int // to synchronize with the end of a Read. - msgs [][]byte // to store data from listener, to be consumed by Reads. + receiveCh chan []byte // to receive the data from the listener's readLoop + readCh chan []byte // to receive the buffer into which we should Read + sizeCh chan int // to synchronize with the end of a Read + msgs [][]byte // to store data from listener, to be consumed by Reads muActivity sync.RWMutex - lastActivity time.Time // the last time the session saw either read or write activity. + lastActivity time.Time // the last time the session saw either read or write activity - timeout time.Duration // for timeouts. + timeout time.Duration // for timeouts doneOnce sync.Once doneCh chan struct{} } @@ -267,8 +254,6 @@ func (c *Conn) readLoop() { msg := c.msgs[0] c.msgs = c.msgs[1:] n := copy(cBuf, msg) - // Return buffer to sync.Pool once done reading from it. - c.listener.readBufferPool.Put(msg) c.sizeCh <- n case msg := <-c.receiveCh: c.msgs = append(c.msgs, msg) @@ -314,11 +299,6 @@ func (c *Conn) Write(p []byte) (n int, err error) { func (c *Conn) close() { c.doneOnce.Do(func() { - // Release any buffered data before closing. - for _, msg := range c.msgs { - c.listener.readBufferPool.Put(msg) - } - c.msgs = nil close(c.doneCh) }) } diff --git a/script/gcg/traefik-bugfix.toml b/script/gcg/traefik-bugfix.toml index 1039a5cde..91d3f1ee5 100644 --- a/script/gcg/traefik-bugfix.toml +++ b/script/gcg/traefik-bugfix.toml @@ -4,11 +4,11 @@ RepositoryName = "traefik" OutputType = "file" FileName = "traefik_changelog.md" -# example new bugfix v3.5.6 -CurrentRef = "v3.5" -PreviousRef = "v3.5.5" -BaseBranch = "v3.5" -FutureCurrentRefName = "v3.5.6" +# example new bugfix v3.6.2 +CurrentRef = "v3.6" +PreviousRef = "v3.6.1" +BaseBranch = "v3.6" +FutureCurrentRefName = "v3.6.2" ThresholdPreviousRef = 10 ThresholdCurrentRef = 10 diff --git a/webui/.yarnrc.yml b/webui/.yarnrc.yml index 3186f3f07..94f5c254e 100644 --- a/webui/.yarnrc.yml +++ b/webui/.yarnrc.yml @@ -1 +1,2 @@ nodeLinker: node-modules +enableScripts: false diff --git a/webui/public/traefiklabs-hub-button-app/main-v1.js b/webui/public/traefiklabs-hub-button-app/main-v1.js deleted file mode 100644 index e140dab34..000000000 --- a/webui/public/traefiklabs-hub-button-app/main-v1.js +++ /dev/null @@ -1,23 +0,0 @@ -/* eslint-disable */ -(()=>{var e={110:(e,t,n)=>{"use strict";var r=n(309),a={childContextTypes:!0,contextType:!0,contextTypes:!0,defaultProps:!0,displayName:!0,getDefaultProps:!0,getDerivedStateFromError:!0,getDerivedStateFromProps:!0,mixins:!0,propTypes:!0,type:!0},l={name:!0,length:!0,prototype:!0,caller:!0,callee:!0,arguments:!0,arity:!0},o={$$typeof:!0,compare:!0,defaultProps:!0,displayName:!0,propTypes:!0,type:!0},i={};function u(e){return r.isMemo(e)?o:i[e.$$typeof]||a}i[r.ForwardRef]={$$typeof:!0,render:!0,defaultProps:!0,displayName:!0,propTypes:!0},i[r.Memo]=o;var s=Object.defineProperty,c=Object.getOwnPropertyNames,f=Object.getOwnPropertySymbols,d=Object.getOwnPropertyDescriptor,p=Object.getPrototypeOf,h=Object.prototype;e.exports=function e(t,n,r){if("string"!==typeof n){if(h){var a=p(n);a&&a!==h&&e(t,a,r)}var o=c(n);f&&(o=o.concat(f(n)));for(var i=u(t),m=u(n),g=0;g{"use strict";var n="function"===typeof Symbol&&Symbol.for,r=n?Symbol.for("react.element"):60103,a=n?Symbol.for("react.portal"):60106,l=n?Symbol.for("react.fragment"):60107,o=n?Symbol.for("react.strict_mode"):60108,i=n?Symbol.for("react.profiler"):60114,u=n?Symbol.for("react.provider"):60109,s=n?Symbol.for("react.context"):60110,c=n?Symbol.for("react.async_mode"):60111,f=n?Symbol.for("react.concurrent_mode"):60111,d=n?Symbol.for("react.forward_ref"):60112,p=n?Symbol.for("react.suspense"):60113,h=n?Symbol.for("react.suspense_list"):60120,m=n?Symbol.for("react.memo"):60115,g=n?Symbol.for("react.lazy"):60116,v=n?Symbol.for("react.block"):60121,y=n?Symbol.for("react.fundamental"):60117,b=n?Symbol.for("react.responder"):60118,S=n?Symbol.for("react.scope"):60119;function k(e){if("object"===typeof e&&null!==e){var t=e.$$typeof;switch(t){case r:switch(e=e.type){case c:case f:case l:case i:case o:case p:return e;default:switch(e=e&&e.$$typeof){case s:case d:case g:case m:case u:return e;default:return t}}case a:return t}}}function w(e){return k(e)===f}t.AsyncMode=c,t.ConcurrentMode=f,t.ContextConsumer=s,t.ContextProvider=u,t.Element=r,t.ForwardRef=d,t.Fragment=l,t.Lazy=g,t.Memo=m,t.Portal=a,t.Profiler=i,t.StrictMode=o,t.Suspense=p,t.isAsyncMode=function(e){return w(e)||k(e)===c},t.isConcurrentMode=w,t.isContextConsumer=function(e){return k(e)===s},t.isContextProvider=function(e){return k(e)===u},t.isElement=function(e){return"object"===typeof e&&null!==e&&e.$$typeof===r},t.isForwardRef=function(e){return k(e)===d},t.isFragment=function(e){return k(e)===l},t.isLazy=function(e){return k(e)===g},t.isMemo=function(e){return k(e)===m},t.isPortal=function(e){return k(e)===a},t.isProfiler=function(e){return k(e)===i},t.isStrictMode=function(e){return k(e)===o},t.isSuspense=function(e){return k(e)===p},t.isValidElementType=function(e){return"string"===typeof e||"function"===typeof e||e===l||e===f||e===i||e===o||e===p||e===h||"object"===typeof e&&null!==e&&(e.$$typeof===g||e.$$typeof===m||e.$$typeof===u||e.$$typeof===s||e.$$typeof===d||e.$$typeof===y||e.$$typeof===b||e.$$typeof===S||e.$$typeof===v)},t.typeOf=k},309:(e,t,n)=>{"use strict";e.exports=n(746)},463:(e,t,n)=>{"use strict";var r=n(791),a=n(296);function l(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n