traefik/docs/configuration/backends/kubernetes.md

# Kubernetes Ingress Backend

Træfik can be configured to use Kubernetes Ingress as a backend configuration.

See also [Kubernetes user guide](/user-guide/kubernetes).

## Configuration

```toml
################################################################
# Kubernetes Ingress configuration backend
################################################################

# Enable Kubernetes Ingress configuration backend.
[kubernetes]

# Kubernetes server endpoint.
#
# Optional for in-cluster configuration, required otherwise.
# Default: empty
#
# endpoint = "http://localhost:8080"

# Bearer token used for the Kubernetes client configuration.
#
# Optional
# Default: empty
#
# token = "my token"

# Path to the certificate authority file.
# Used for the Kubernetes client configuration.
#
# Optional
# Default: empty
#
# certAuthFilePath = "/my/ca.crt"

# Array of namespaces to watch.
#
# Optional
# Default: all namespaces (empty array).
#
# namespaces = ["default", "production"]

# Ingress label selector to filter Ingress objects that should be processed.
#
# Optional
# Default: empty (process all Ingresses)
#
# labelselector = "A and not B"

# Value of `kubernetes.io/ingress.class` annotation that identifies Ingress objects to be processed.
# If the parameter is non-empty, only Ingresses containing an annotation with the same value are processed.
# Otherwise, Ingresses missing the annotation, having an empty value, or the value `traefik` are processed.
#
# Note : `ingressClass` option must begin with the "traefik" prefix.
#
# Optional
# Default: empty
#
# ingressClass = "traefik-internal"

# Disable PassHost Headers.
#
# Optional
# Default: false
#
# disablePassHostHeaders = true

# Enable PassTLSCert Headers.
#
# Optional
# Default: false
#
# enablePassTLSCert = true

# Override default configuration template.
#
# Optional
# Default: <built-in template>
#
# filename = "kubernetes.tmpl"
```

### `endpoint`

The Kubernetes server endpoint as URL.

When deployed into Kubernetes, Traefik will read the environment variables `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` to construct the endpoint.

The access token will be looked up in `/var/run/secrets/kubernetes.io/serviceaccount/token` and the SSL CA certificate in `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`.
Both are provided mounted automatically when deployed inside Kubernetes.

The endpoint may be specified to override the environment variable values inside a cluster.

When the environment variables are not found, Traefik will try to connect to the Kubernetes API server with an external-cluster client.
In this case, the endpoint is required.
Specifically, it may be set to the URL used by `kubectl proxy` to connect to a Kubernetes cluster using the granted autentication and authorization of the associated kubeconfig.

### `labelselector`

By default, Traefik processes all Ingress objects in the configured namespaces.
A label selector can be defined to filter on specific Ingress objects only.

See [label-selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) for details.

## Annotations

### General annotations

The following general annotations are applicable on the Ingress object:

| Annotation                                                                      | Description                                                                                                                                     |
|---------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|
| `traefik.ingress.kubernetes.io/buffering: <YML>`                                | (3) See [buffering](/configuration/commons/#buffering) section.                                                                                 |
| `traefik.ingress.kubernetes.io/error-pages: <YML>`                              | (1) See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                               |
| `traefik.ingress.kubernetes.io/frontend-entry-points: http,https`               | Override the default frontend endpoints.                                                                                                        |
| `traefik.ingress.kubernetes.io/pass-tls-cert: "true"`                           | Override the default frontend PassTLSCert value. Default: `false`.                                                                              |
| `traefik.ingress.kubernetes.io/preserve-host: "true"`                           | Forward client `Host` header to the backend.                                                                                                    |
| `traefik.ingress.kubernetes.io/priority: "3"`                                   | Override the default frontend rule priority.                                                                                                    |
| `traefik.ingress.kubernetes.io/rate-limit: <YML>`                               | (2) See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                         |
| `traefik.ingress.kubernetes.io/redirect-entry-point: https`                     | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS).                                                                          |
| `traefik.ingress.kubernetes.io/redirect-permanent: "true"`                      | Return 301 instead of 302.                                                                                                                      |
| `traefik.ingress.kubernetes.io/redirect-regex: ^http://localhost/(.*)`          | Redirect to another URL for that frontend. Must be set with `traefik.ingress.kubernetes.io/redirect-replacement`.                               |
| `traefik.ingress.kubernetes.io/redirect-replacement: http://mydomain/$1`        | Redirect to another URL for that frontend. Must be set with `traefik.ingress.kubernetes.io/redirect-regex`.                                     |
| `traefik.ingress.kubernetes.io/rewrite-target: /users`                          | Replaces each matched Ingress path with the specified one, and adds the old path to the `X-Replaced-Path` header.                               |
| `traefik.ingress.kubernetes.io/rule-type: PathPrefixStrip`                      | Override the default frontend rule type. Default: `PathPrefix`.                                                                                 |
| `traefik.ingress.kubernetes.io/whitelist-source-range: "1.2.3.0/24, fe80::/16"` | A comma-separated list of IP ranges permitted for access. all source IPs are permitted if the list is empty or a single range is ill-formatted. |

<1> `traefik.ingress.kubernetes.io/error-pages` example:

```yaml
foo:
  status:
  - "404"
  backend: bar
  query: /bar
fii:
  status:
  - "503"
  - "500"
  backend: bar
  query: /bir
```

<2> `traefik.ingress.kubernetes.io/rate-limit` example:

```yaml
extractorfunc: client.ip
rateset:
  bar:
    period: 3s
    average: 6
    burst: 9
  foo:
    period: 6s
    average: 12
    burst: 18
```

<3> `traefik.ingress.kubernetes.io/buffering` example:

```yaml
maxrequestbodybytes: 10485760
memrequestbodybytes: 2097153
maxresponsebodybytes: 10485761
memresponsebodybytes: 2097152
retryexpression: IsNetworkError() && Attempts() <= 2
```

!!! note
    Please note that `traefik.ingress.kubernetes.io/redirect-regex` and `traefik.ingress.kubernetes.io/redirect-replacement` do not have to be set if `traefik.ingress.kubernetes.io/redirect-entry-point` is defined for the redirection (they will not be used in this case).

The following annotations are applicable on the Service object associated with a particular Ingress object:

| Annotation                                                               | Description                                                                                                                                                                           |
|--------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `traefik.backend.loadbalancer.sticky: "true"`                            | Enable backend sticky sessions (DEPRECATED).                                                                                                                                          |
| `traefik.ingress.kubernetes.io/affinity: "true"`                         | Enable backend sticky sessions.                                                                                                                                                       |
| `traefik.ingress.kubernetes.io/circuit-breaker-expression: <expression>` | Set the circuit breaker expression for the backend.                                                                                                                                   |
| `traefik.ingress.kubernetes.io/load-balancer-method: drr`                | Override the default `wrr` load balancer algorithm.                                                                                                                                   |
| `traefik.ingress.kubernetes.io/max-conn-amount: 10`                      | Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                               |
| `traefik.ingress.kubernetes.io/max-conn-extractor-func: client.ip`       | Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect. |
| `traefik.ingress.kubernetes.io/session-cookie-name: <NAME>`              | Manually set the cookie name for sticky sessions.                                                                                                                                     |

!!! note
    `traefik.ingress.kubernetes.io/` and `ingress.kubernetes.io/` are supported prefixes.

### Security annotations

The following security annotations are applicable on the Ingress object:

|                        Annotation                        |                                                                                             Description                                                                                             |
| --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ingress.kubernetes.io/allowed-hosts: EXPR`               | Provides a list of allowed hosts that requests will be processed. Format: `Host1,Host2`                                                                                                             |
| `ingress.kubernetes.io/custom-request-headers: EXPR`      | Provides the container with custom request headers that will be appended to each request forwarded to the container. Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>                    |
| `ingress.kubernetes.io/custom-response-headers: EXPR`     | Appends the headers to each response returned by the container, before forwarding the response to the client. Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>                           |
| `ingress.kubernetes.io/proxy-headers: EXPR`               | Provides a list of headers that the proxied hostname may be stored. Format:  `HEADER1,HEADER2`                                                                                                      |
| `ingress.kubernetes.io/ssl-redirect: "true"`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
| `ingress.kubernetes.io/ssl-temporary-redirect: "true"`    | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
| `ingress.kubernetes.io/ssl-host: HOST`                    | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
| `ingress.kubernetes.io/ssl-proxy-headers: EXPR`           | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`). Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                          |
| `ingress.kubernetes.io/hsts-max-age: "315360000"`         | Sets the max-age of the HSTS header.                                                                                                                                                                |
| `ingress.kubernetes.io/hsts-include-subdomains: "true"`   | Adds the IncludeSubdomains section of the STS  header.                                                                                                                                              |
| `ingress.kubernetes.io/hsts-preload: "true"`              | Adds the preload flag to the HSTS  header.                                                                                                                                                          |
| `ingress.kubernetes.io/force-hsts: "false"`               | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
| `ingress.kubernetes.io/frame-deny: "false"`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
| `ingress.kubernetes.io/custom-frame-options-value: VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
| `ingress.kubernetes.io/content-type-nosniff: "true"`      | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
| `ingress.kubernetes.io/browser-xss-filter: "true"`        | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
| `ingress.kubernetes.io/content-security-policy: VALUE`    | Adds CSP Header with the custom value.                                                                                                                                                              |
| `ingress.kubernetes.io/public-key: VALUE`                 | Adds pinned HTST public key header.                                                                                                                                                                 |
| `ingress.kubernetes.io/referrer-policy: VALUE`            | Adds referrer policy  header.                                                                                                                                                                       |
| `ingress.kubernetes.io/is-development: "false"`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |

### Authentication

Is possible to add additional authentication annotations to the Ingress object.
The source of the authentication is a Secret object that contains the credentials.

| Annotation                                    | Description                                                                                |
|---------------------------------------------- | --------------------------------------------------------------------------------------------|
| `ingress.kubernetes.io/auth-type: basic`      | Contains the authentication type. The only permitted type is `basic`.                      |
| `ingress.kubernetes.io/auth-secret: mysecret` | Name of Secret containing the username and password with access to the paths defined in the Ingress object. |

The secret must be created in the same namespace as the Ingress object.

The following limitations hold:

- The realm is not configurable; the only supported (and default) value is `traefik`.
- The Secret must contain a single file only.
doc: structural review - user-guide review. - add DataDog and StatD configuration. - sync sample.toml and doc. - split entry points doc. - Deprecated. 2017-08-26 10:12:44 +00:00			`# Kubernetes Ingress Backend`
Refactor doc pages 2017-08-25 19:32:33 +00:00
Enhance documentation readability. 2017-09-11 17:10:04 +00:00			`Træfik can be configured to use Kubernetes Ingress as a backend configuration.`

Kubernetes security header annotations 2017-11-28 12:36:03 +00:00			`See also [Kubernetes user guide](/user-guide/kubernetes).`
Enhance documentation readability. 2017-09-11 17:10:04 +00:00
			`## Configuration`
Refactor doc pages 2017-08-25 19:32:33 +00:00
			```toml
			`################################################################`
			`# Kubernetes Ingress configuration backend`
			`################################################################`
Enhance documentation readability. 2017-09-11 17:10:04 +00:00
			`# Enable Kubernetes Ingress configuration backend.`
Refactor doc pages 2017-08-25 19:32:33 +00:00			`[kubernetes]`

Enhance documentation readability. 2017-09-11 17:10:04 +00:00			`# Kubernetes server endpoint.`
Refactor doc pages 2017-08-25 19:32:33 +00:00			`#`
Enhance documentation readability. 2017-09-11 17:10:04 +00:00			`# Optional for in-cluster configuration, required otherwise.`
Refactor doc pages 2017-08-25 19:32:33 +00:00			`# Default: empty`
			`#`
			`# endpoint = "http://localhost:8080"`

			`# Bearer token used for the Kubernetes client configuration.`
			`#`
			`# Optional`
			`# Default: empty`
			`#`
			`# token = "my token"`

Enhance documentation readability. 2017-09-11 17:10:04 +00:00			`# Path to the certificate authority file.`
			`# Used for the Kubernetes client configuration.`
Refactor doc pages 2017-08-25 19:32:33 +00:00			`#`
			`# Optional`
			`# Default: empty`
			`#`
			`# certAuthFilePath = "/my/ca.crt"`

			`# Array of namespaces to watch.`
			`#`
			`# Optional`
			`# Default: all namespaces (empty array).`
			`#`
			`# namespaces = ["default", "production"]`

Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			`# Ingress label selector to filter Ingress objects that should be processed.`
Refactor doc pages 2017-08-25 19:32:33 +00:00			`#`
			`# Optional`
			`# Default: empty (process all Ingresses)`
			`#`
			`# labelselector = "A and not B"`
Enhance documentation readability. 2017-09-11 17:10:04 +00:00
Allow custom value for kubernetes.io/ingress.class annotation 2018-02-01 18:04:04 +00:00			# Value of `kubernetes.io/ingress.class` annotation that identifies Ingress objects to be processed.
			`# If the parameter is non-empty, only Ingresses containing an annotation with the same value are processed.`
			# Otherwise, Ingresses missing the annotation, having an empty value, or the value `traefik` are processed.
			`#`
			# Note : `ingressClass` option must begin with the "traefik" prefix.
			`#`
			`# Optional`
			`# Default: empty`
			`#`
			`# ingressClass = "traefik-internal"`

Enhance documentation readability. 2017-09-11 17:10:04 +00:00			`# Disable PassHost Headers.`
			`#`
			`# Optional`
			`# Default: false`
			`#`
			`# disablePassHostHeaders = true`
Add labels for `traefik.frontend.entryPoints` & `PassTLSCert` to Kubernetes 2017-11-20 01:12:03 +00:00
			`# Enable PassTLSCert Headers.`
			`#`
			`# Optional`
			`# Default: false`
			`#`
			`# enablePassTLSCert = true`
Document filename parameter for Kubernetes. 2017-11-26 00:02:03 +00:00
			`# Override default configuration template.`
			`#`
			`# Optional`
			`# Default: <built-in template>`
			`#`
			`# filename = "kubernetes.tmpl"`
Refactor doc pages 2017-08-25 19:32:33 +00:00			```

Enhance documentation readability. 2017-09-11 17:10:04 +00:00			### `endpoint`

Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			`The Kubernetes server endpoint as URL.`
Enhance documentation readability. 2017-09-11 17:10:04 +00:00
Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			When deployed into Kubernetes, Traefik will read the environment variables `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` to construct the endpoint.
Enhance documentation readability. 2017-09-11 17:10:04 +00:00
Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			The access token will be looked up in `/var/run/secrets/kubernetes.io/serviceaccount/token` and the SSL CA certificate in `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`.
			`Both are provided mounted automatically when deployed inside Kubernetes.`
Enhance documentation readability. 2017-09-11 17:10:04 +00:00
Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			`The endpoint may be specified to override the environment variable values inside a cluster.`
Enhance documentation readability. 2017-09-11 17:10:04 +00:00
			`When the environment variables are not found, Traefik will try to connect to the Kubernetes API server with an external-cluster client.`
			`In this case, the endpoint is required.`
Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			Specifically, it may be set to the URL used by `kubectl proxy` to connect to a Kubernetes cluster using the granted autentication and authorization of the associated kubeconfig.
Enhance documentation readability. 2017-09-11 17:10:04 +00:00
			### `labelselector`

Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			`By default, Traefik processes all Ingress objects in the configured namespaces.`
			`A label selector can be defined to filter on specific Ingress objects only.`
Enhance documentation readability. 2017-09-11 17:10:04 +00:00
			`See [label-selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) for details.`

			`## Annotations`

Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			`### General annotations`

			`The following general annotations are applicable on the Ingress object:`
Refactor doc pages 2017-08-25 19:32:33 +00:00
doc(k8s): add documentation. 2018-01-26 12:34:14 +00:00			`\| Annotation \| Description \|`
			`\|---------------------------------------------------------------------------------\|-------------------------------------------------------------------------------------------------------------------------------------------------\|`
			\| `traefik.ingress.kubernetes.io/buffering: <YML>` \| (3) See [buffering](/configuration/commons/#buffering) section. \|
			\| `traefik.ingress.kubernetes.io/error-pages: <YML>` \| (1) See [custom error pages](/configuration/commons/#custom-error-pages) section. \|
			\| `traefik.ingress.kubernetes.io/frontend-entry-points: http,https` \| Override the default frontend endpoints. \|
Change boolean annotation values to string 2018-02-16 11:20:04 +00:00			\| `traefik.ingress.kubernetes.io/pass-tls-cert: "true"` \| Override the default frontend PassTLSCert value. Default: `false`. \|
			\| `traefik.ingress.kubernetes.io/preserve-host: "true"` \| Forward client `Host` header to the backend. \|
doc(k8s): add documentation. 2018-01-26 12:34:14 +00:00			\| `traefik.ingress.kubernetes.io/priority: "3"` \| Override the default frontend rule priority. \|
Fix typo in doc for rate limit label 2018-02-01 07:04:03 +00:00			\| `traefik.ingress.kubernetes.io/rate-limit: <YML>` \| (2) See [rate limiting](/configuration/commons/#rate-limiting) section. \|
doc(k8s): add documentation. 2018-01-26 12:34:14 +00:00			\| `traefik.ingress.kubernetes.io/redirect-entry-point: https` \| Enables Redirect to another entryPoint for that frontend (e.g. HTTPS). \|
Change boolean annotation values to string 2018-02-16 11:20:04 +00:00			\| `traefik.ingress.kubernetes.io/redirect-permanent: "true"` \| Return 301 instead of 302. \|
doc(k8s): add documentation. 2018-01-26 12:34:14 +00:00			\| `traefik.ingress.kubernetes.io/redirect-regex: ^http://localhost/(.*)` \| Redirect to another URL for that frontend. Must be set with `traefik.ingress.kubernetes.io/redirect-replacement`. \|
			\| `traefik.ingress.kubernetes.io/redirect-replacement: http://mydomain/$1` \| Redirect to another URL for that frontend. Must be set with `traefik.ingress.kubernetes.io/redirect-regex`. \|
			\| `traefik.ingress.kubernetes.io/rewrite-target: /users` \| Replaces each matched Ingress path with the specified one, and adds the old path to the `X-Replaced-Path` header. \|
			\| `traefik.ingress.kubernetes.io/rule-type: PathPrefixStrip` \| Override the default frontend rule type. Default: `PathPrefix`. \|
			\| `traefik.ingress.kubernetes.io/whitelist-source-range: "1.2.3.0/24, fe80::/16"` \| A comma-separated list of IP ranges permitted for access. all source IPs are permitted if the list is empty or a single range is ill-formatted. \|

			<1> `traefik.ingress.kubernetes.io/error-pages` example:

			```yaml
			`foo:`
			`status:`
			`- "404"`
			`backend: bar`
			`query: /bar`
			`fii:`
			`status:`
			`- "503"`
			`- "500"`
			`backend: bar`
			`query: /bir`
			```

			<2> `traefik.ingress.kubernetes.io/rate-limit` example:

			```yaml
			`extractorfunc: client.ip`
			`rateset:`
			`bar:`
			`period: 3s`
			`average: 6`
			`burst: 9`
			`foo:`
			`period: 6s`
			`average: 12`
			`burst: 18`
			```

			<3> `traefik.ingress.kubernetes.io/buffering` example:

			```yaml
			`maxrequestbodybytes: 10485760`
			`memrequestbodybytes: 2097153`
			`maxresponsebodybytes: 10485761`
			`memresponsebodybytes: 2097152`
			`retryexpression: IsNetworkError() && Attempts() <= 2`
			```
Refactor doc pages 2017-08-25 19:32:33 +00:00
Support regex redirect by frontend 2017-12-15 10:48:03 +00:00			`!!! note`
doc(k8s): add documentation. 2018-01-26 12:34:14 +00:00			Please note that `traefik.ingress.kubernetes.io/redirect-regex` and `traefik.ingress.kubernetes.io/redirect-replacement` do not have to be set if `traefik.ingress.kubernetes.io/redirect-entry-point` is defined for the redirection (they will not be used in this case).
Support regex redirect by frontend 2017-12-15 10:48:03 +00:00
Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			`The following annotations are applicable on the Service object associated with a particular Ingress object:`
Support regex redirect by frontend 2017-12-15 10:48:03 +00:00
doc(k8s): add documentation. 2018-01-26 12:34:14 +00:00			`\| Annotation \| Description \|`
			`\|--------------------------------------------------------------------------\|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\|`
Change boolean annotation values to string 2018-02-16 11:20:04 +00:00			\| `traefik.backend.loadbalancer.sticky: "true"` \| Enable backend sticky sessions (DEPRECATED). \|
			\| `traefik.ingress.kubernetes.io/affinity: "true"` \| Enable backend sticky sessions. \|
doc(k8s): add documentation. 2018-01-26 12:34:14 +00:00			\| `traefik.ingress.kubernetes.io/circuit-breaker-expression: <expression>` \| Set the circuit breaker expression for the backend. \|
			\| `traefik.ingress.kubernetes.io/load-balancer-method: drr` \| Override the default `wrr` load balancer algorithm. \|
			\| `traefik.ingress.kubernetes.io/max-conn-amount: 10` \| Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect. \|
			\| `traefik.ingress.kubernetes.io/max-conn-extractor-func: client.ip` \| Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect. \|
			\| `traefik.ingress.kubernetes.io/session-cookie-name: <NAME>` \| Manually set the cookie name for sticky sessions. \|

			`!!! note`
			`traefik.ingress.kubernetes.io/` and `ingress.kubernetes.io/` are supported prefixes.
Refactor doc pages 2017-08-25 19:32:33 +00:00
Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			`### Security annotations`
Kubernetes security header annotations 2017-11-28 12:36:03 +00:00
Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			`The following security annotations are applicable on the Ingress object:`
Kubernetes security header annotations 2017-11-28 12:36:03 +00:00
Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			`\| Annotation \| Description \|`
Change boolean annotation values to string 2018-02-16 11:20:04 +00:00			`\| --------------------------------------------------------- \| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- \|`
			\| `ingress.kubernetes.io/allowed-hosts: EXPR` \| Provides a list of allowed hosts that requests will be processed. Format: `Host1,Host2` \|
			\| `ingress.kubernetes.io/custom-request-headers: EXPR` \| Provides the container with custom request headers that will be appended to each request forwarded to the container. Format: <code>HEADER:value\|\|HEADER2:value2</code> \|
			\| `ingress.kubernetes.io/custom-response-headers: EXPR` \| Appends the headers to each response returned by the container, before forwarding the response to the client. Format: <code>HEADER:value\|\|HEADER2:value2</code> \|
			\| `ingress.kubernetes.io/proxy-headers: EXPR` \| Provides a list of headers that the proxied hostname may be stored. Format: `HEADER1,HEADER2` \|
			\| `ingress.kubernetes.io/ssl-redirect: "true"` \| Forces the frontend to redirect to SSL if a non-SSL request is sent. \|
			\| `ingress.kubernetes.io/ssl-temporary-redirect: "true"` \| Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301. \|
			\| `ingress.kubernetes.io/ssl-host: HOST` \| This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request. \|
			\| `ingress.kubernetes.io/ssl-proxy-headers: EXPR` \| Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`). Format: <code>HEADER:value\|\|HEADER2:value2</code> \|
			\| `ingress.kubernetes.io/hsts-max-age: "315360000"` \| Sets the max-age of the HSTS header. \|
			\| `ingress.kubernetes.io/hsts-include-subdomains: "true"` \| Adds the IncludeSubdomains section of the STS header. \|
			\| `ingress.kubernetes.io/hsts-preload: "true"` \| Adds the preload flag to the HSTS header. \|
			\| `ingress.kubernetes.io/force-hsts: "false"` \| Adds the STS header to non-SSL requests. \|
			\| `ingress.kubernetes.io/frame-deny: "false"` \| Adds the `X-Frame-Options` header with the value of `DENY`. \|
			\| `ingress.kubernetes.io/custom-frame-options-value: VALUE` \| Overrides the `X-Frame-Options` header with the custom value. \|
			\| `ingress.kubernetes.io/content-type-nosniff: "true"` \| Adds the `X-Content-Type-Options` header with the value `nosniff`. \|
			\| `ingress.kubernetes.io/browser-xss-filter: "true"` \| Adds the X-XSS-Protection header with the value `1; mode=block`. \|
			\| `ingress.kubernetes.io/content-security-policy: VALUE` \| Adds CSP Header with the custom value. \|
			\| `ingress.kubernetes.io/public-key: VALUE` \| Adds pinned HTST public key header. \|
			\| `ingress.kubernetes.io/referrer-policy: VALUE` \| Adds referrer policy header. \|
			\| `ingress.kubernetes.io/is-development: "false"` \| This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. \|
Refactor doc pages 2017-08-25 19:32:33 +00:00
			`### Authentication`

Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			`Is possible to add additional authentication annotations to the Ingress object.`
			`The source of the authentication is a Secret object that contains the credentials.`
Refactor doc pages 2017-08-25 19:32:33 +00:00
Change boolean annotation values to string 2018-02-16 11:20:04 +00:00			`\| Annotation \| Description \|`
			`\|---------------------------------------------- \| --------------------------------------------------------------------------------------------\|`
			\| `ingress.kubernetes.io/auth-type: basic` \| Contains the authentication type. The only permitted type is `basic`. \|
			\| `ingress.kubernetes.io/auth-secret: mysecret` \| Name of Secret containing the username and password with access to the paths defined in the Ingress object. \|
Refactor doc pages 2017-08-25 19:32:33 +00:00
Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			`The secret must be created in the same namespace as the Ingress object.`
Refactor doc pages 2017-08-25 19:32:33 +00:00
Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			`The following limitations hold:`
Refactor doc pages 2017-08-25 19:32:33 +00:00
Apply various contentual and stylish improvements to the k8s docs. 2018-01-15 08:40:05 +00:00			- The realm is not configurable; the only supported (and default) value is `traefik`.
			`- The Secret must contain a single file only.`