diff --git a/pkg/config/dyn_config.go b/pkg/config/dyn_config.go
index 634fad4de..63e7c4daa 100644
--- a/pkg/config/dyn_config.go
+++ b/pkg/config/dyn_config.go
@@ -6,15 +6,21 @@ import (
 	traefiktls "github.com/containous/traefik/pkg/tls"
 )
 
+// +k8s:deepcopy-gen=true
+
 // Message holds configuration information exchanged between parts of traefik.
 type Message struct {
 	ProviderName  string
 	Configuration *Configuration
 }
 
+// +k8s:deepcopy-gen=true
+
 // Configurations is for currentConfigurations Map.
 type Configurations map[string]*Configuration
 
+// +k8s:deepcopy-gen=true
+
 // Configuration is the root of the dynamic configuration
 type Configuration struct {
 	HTTP *HTTPConfiguration `json:"http,omitempty" toml:"http,omitempty" yaml:"http,omitempty"`
@@ -22,6 +28,8 @@ type Configuration struct {
 	TLS  *TLSConfiguration  `json:"tls,omitempty" toml:"tls,omitempty" yaml:"tls,omitempty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // TLSConfiguration contains all the configuration parameters of a TLS connection.
 type TLSConfiguration struct {
 	Certificates []*traefiktls.CertAndStores   `json:"-"  toml:"certificates,omitempty" yaml:"certificates,omitempty" label:"-"`
@@ -29,6 +37,8 @@ type TLSConfiguration struct {
 	Stores       map[string]traefiktls.Store   `json:"stores,omitempty" toml:"stores,omitempty" yaml:"stores,omitempty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // HTTPConfiguration contains all the HTTP configuration parameters.
 type HTTPConfiguration struct {
 	Routers     map[string]*Router     `json:"routers,omitempty" toml:"routers,omitempty" yaml:"routers,omitempty"`
@@ -36,22 +46,30 @@ type HTTPConfiguration struct {
 	Services    map[string]*Service    `json:"services,omitempty" toml:"services,omitempty" yaml:"services,omitempty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // TCPConfiguration contains all the TCP configuration parameters.
 type TCPConfiguration struct {
 	Routers  map[string]*TCPRouter  `json:"routers,omitempty" toml:"routers,omitempty" yaml:"routers,omitempty"`
 	Services map[string]*TCPService `json:"services,omitempty" toml:"services,omitempty" yaml:"services,omitempty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // Service holds a service configuration (can only be of one type at the same time).
 type Service struct {
 	LoadBalancer *LoadBalancerService `json:"loadBalancer,omitempty" toml:"loadBalancer,omitempty" yaml:"loadBalancer,omitempty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // TCPService holds a tcp service configuration (can only be of one type at the same time).
 type TCPService struct {
 	LoadBalancer *TCPLoadBalancerService `json:"loadBalancer,omitempty" toml:"loadBalancer,omitempty" yaml:"loadBalancer,omitempty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // Router holds the router configuration.
 type Router struct {
 	EntryPoints []string         `json:"entryPoints,omitempty" toml:"entryPoints,omitempty" yaml:"entryPoints,omitempty"`
@@ -62,11 +80,15 @@ type Router struct {
 	TLS         *RouterTLSConfig `json:"tls,omitempty" toml:"tls,omitempty" yaml:"tls,omitempty" label:"allowEmpty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // RouterTLSConfig holds the TLS configuration for a router
 type RouterTLSConfig struct {
 	Options string `json:"options,omitempty" toml:"options,omitempty" yaml:"options,omitempty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // TCPRouter holds the router configuration.
 type TCPRouter struct {
 	EntryPoints []string            `json:"entryPoints,omitempty" toml:"entryPoints,omitempty" yaml:"entryPoints,omitempty"`
@@ -75,12 +97,16 @@ type TCPRouter struct {
 	TLS         *RouterTCPTLSConfig `json:"tls,omitempty" toml:"tls,omitempty" yaml:"tls,omitempty" label:"allowEmpty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // RouterTCPTLSConfig holds the TLS configuration for a router
 type RouterTCPTLSConfig struct {
 	Passthrough bool   `json:"passthrough" toml:"passthrough" yaml:"passthrough"`
 	Options     string `json:"options,omitempty" toml:"options,omitempty" yaml:"options,omitempty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // LoadBalancerService holds the LoadBalancerService configuration.
 type LoadBalancerService struct {
 	Stickiness         *Stickiness         `json:"stickiness,omitempty" toml:"stickiness,omitempty" yaml:"stickiness,omitempty" label:"allowEmpty"`
@@ -90,6 +116,8 @@ type LoadBalancerService struct {
 	ResponseForwarding *ResponseForwarding `json:"responseForwarding,omitempty" toml:"responseForwarding,omitempty" yaml:"responseForwarding,omitempty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // TCPLoadBalancerService holds the LoadBalancerService configuration.
 type TCPLoadBalancerService struct {
 	Servers []TCPServer `json:"servers,omitempty" toml:"servers,omitempty" yaml:"servers,omitempty" label-slice-as-struct:"server" label-slice-as-struct:"server"`
@@ -134,11 +162,15 @@ func (l *LoadBalancerService) SetDefaults() {
 	l.PassHostHeader = true
 }
 
+// +k8s:deepcopy-gen=true
+
 // ResponseForwarding holds configuration for the forward of the response.
 type ResponseForwarding struct {
 	FlushInterval string `json:"flushInterval,omitempty" toml:"flushInterval,omitempty" yaml:"flushInterval,omitempty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // Stickiness holds the stickiness configuration.
 type Stickiness struct {
 	CookieName     string `json:"cookieName,omitempty" toml:"cookieName,omitempty" yaml:"cookieName,omitempty"`
@@ -146,6 +178,8 @@ type Stickiness struct {
 	HTTPOnlyCookie bool   `json:"httpOnlyCookie,omitempty" toml:"httpOnlyCookie,omitempty" yaml:"httpOnlyCookie,omitempty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // Server holds the server configuration.
 type Server struct {
 	URL    string `json:"url,omitempty" toml:"url,omitempty" yaml:"url,omitempty" label:"-"`
@@ -153,6 +187,8 @@ type Server struct {
 	Port   string `toml:"-" json:"-" yaml:"-"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // TCPServer holds a TCP Server configuration
 type TCPServer struct {
 	Address string `json:"address,omitempty" toml:"address,omitempty" yaml:"address,omitempty" label:"-"`
@@ -164,6 +200,8 @@ func (s *Server) SetDefaults() {
 	s.Scheme = "http"
 }
 
+// +k8s:deepcopy-gen=true
+
 // HealthCheck holds the HealthCheck configuration.
 type HealthCheck struct {
 	Scheme string `json:"scheme,omitempty" toml:"scheme,omitempty" yaml:"scheme,omitempty"`
diff --git a/pkg/config/dyn_config_test.go b/pkg/config/dyn_config_test.go
new file mode 100644
index 000000000..ee0467141
--- /dev/null
+++ b/pkg/config/dyn_config_test.go
@@ -0,0 +1,37 @@
+package config
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/BurntSushi/toml"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDeepCopy(t *testing.T) {
+	cfg := &Configuration{}
+	_, err := toml.DecodeFile("./fixtures/sample.toml", &cfg)
+	require.NoError(t, err)
+
+	cfgCopy := cfg
+	assert.Equal(t, reflect.ValueOf(cfgCopy), reflect.ValueOf(cfg))
+	assert.Equal(t, reflect.ValueOf(cfgCopy), reflect.ValueOf(cfg))
+	assert.Equal(t, cfgCopy, cfg)
+
+	cfgDeepCopy := cfg.DeepCopy()
+	assert.NotEqual(t, reflect.ValueOf(cfgDeepCopy), reflect.ValueOf(cfg))
+	assert.Equal(t, reflect.TypeOf(cfgDeepCopy), reflect.TypeOf(cfg))
+	assert.Equal(t, cfgDeepCopy, cfg)
+
+	// Update cfg
+	cfg.HTTP.Routers["powpow"] = &Router{}
+
+	assert.Equal(t, reflect.ValueOf(cfgCopy), reflect.ValueOf(cfg))
+	assert.Equal(t, reflect.ValueOf(cfgCopy), reflect.ValueOf(cfg))
+	assert.Equal(t, cfgCopy, cfg)
+
+	assert.NotEqual(t, reflect.ValueOf(cfgDeepCopy), reflect.ValueOf(cfg))
+	assert.Equal(t, reflect.TypeOf(cfgDeepCopy), reflect.TypeOf(cfg))
+	assert.NotEqual(t, cfgDeepCopy, cfg)
+}
diff --git a/pkg/config/fixtures/sample.toml b/pkg/config/fixtures/sample.toml
new file mode 100644
index 000000000..0a288c010
--- /dev/null
+++ b/pkg/config/fixtures/sample.toml
@@ -0,0 +1,481 @@
+[global]
+  checkNewVersion = true
+  sendAnonymousUsage = true
+
+[serversTransport]
+  insecureSkipVerify = true
+  rootCAs = ["foobar", "foobar"]
+  maxIdleConnsPerHost = 42
+  [serversTransport.forwardingTimeouts]
+    dialTimeout = 42
+    responseHeaderTimeout = 42
+    idleConnTimeout = 42
+
+[entryPoints]
+  [entryPoints.EntryPoint0]
+    address = "foobar"
+    [entryPoints.EntryPoint0.transport]
+      [entryPoints.EntryPoint0.transport.lifeCycle]
+        requestAcceptGraceTimeout = 42
+        graceTimeOut = 42
+      [entryPoints.EntryPoint0.transport.respondingTimeouts]
+        readTimeout = 42
+        writeTimeout = 42
+        idleTimeout = 42
+    [entryPoints.EntryPoint0.proxyProtocol]
+      insecure = true
+      trustedIPs = ["foobar", "foobar"]
+    [entryPoints.EntryPoint0.forwardedHeaders]
+      insecure = true
+      trustedIPs = ["foobar", "foobar"]
+
+[providers]
+  providersThrottleDuration = 42
+  [providers.docker]
+    constraints = "foobar"
+    watch = true
+    endpoint = "foobar"
+    defaultRule = "foobar"
+    exposedByDefault = true
+    useBindPortIP = true
+    swarmMode = true
+    network = "foobar"
+    swarmModeRefreshSeconds = 42
+    [providers.docker.tls]
+      ca = "foobar"
+      caOptional = true
+      cert = "foobar"
+      key = "foobar"
+      insecureSkipVerify = true
+  [providers.file]
+    directory = "foobar"
+    watch = true
+    filename = "foobar"
+    debugLogGeneratedTemplate = true
+    traefikFile = "foobar"
+  [providers.marathon]
+    constraints = "foobar"
+    trace = true
+    watch = true
+    endpoint = "foobar"
+    defaultRule = "foobar"
+    exposedByDefault = true
+    dcosToken = "foobar"
+    dialerTimeout = 42
+    responseHeaderTimeout = 42
+    tlsHandshakeTimeout = 42
+    keepAlive = 42
+    forceTaskHostname = true
+    respectReadinessChecks = true
+    [providers.marathon.tls]
+      ca = "foobar"
+      caOptional = true
+      cert = "foobar"
+      key = "foobar"
+      insecureSkipVerify = true
+    [providers.marathon.basic]
+      httpBasicAuthUser = "foobar"
+      httpBasicPassword = "foobar"
+  [providers.kubernetesIngress]
+    endpoint = "foobar"
+    token = "foobar"
+    certAuthFilePath = "foobar"
+    disablePassHostHeaders = true
+    namespaces = ["foobar", "foobar"]
+    labelSelector = "foobar"
+    ingressClass = "foobar"
+    [providers.kubernetesIngress.ingressEndpoint]
+      ip = "foobar"
+      hostname = "foobar"
+      publishedService = "foobar"
+  [providers.kubernetesCRD]
+    endpoint = "foobar"
+    token = "foobar"
+    certAuthFilePath = "foobar"
+    disablePassHostHeaders = true
+    namespaces = ["foobar", "foobar"]
+    labelSelector = "foobar"
+    ingressClass = "foobar"
+  [providers.rest]
+    entryPoint = "foobar"
+  [providers.rancher]
+    constraints = "foobar"
+    watch = true
+    defaultRule = "foobar"
+    exposedByDefault = true
+    enableServiceHealthFilter = true
+    refreshSeconds = 42
+    intervalPoll = true
+    prefix = "foobar"
+
+[api]
+  entryPoint = "foobar"
+  dashboard = true
+  middlewares = ["foobar", "foobar"]
+  [api.statistics]
+    recentErrors = 42
+
+[metrics]
+  [metrics.prometheus]
+    buckets = [42.0, 42.0]
+    entryPoint = "foobar"
+    middlewares = ["foobar", "foobar"]
+  [metrics.dataDog]
+    address = "foobar"
+    pushInterval = "10s"
+  [metrics.statsD]
+    address = "foobar"
+    pushInterval = "10s"
+  [metrics.influxDB]
+    address = "foobar"
+    protocol = "foobar"
+    pushInterval = "10s"
+    database = "foobar"
+    retentionPolicy = "foobar"
+    username = "foobar"
+    password = "foobar"
+
+[ping]
+  entryPoint = "foobar"
+  middlewares = ["foobar", "foobar"]
+
+[log]
+  level = "foobar"
+  filePath = "foobar"
+  format = "foobar"
+
+[accessLog]
+  filePath = "foobar"
+  format = "foobar"
+  bufferingSize = 42
+  [accessLog.filters]
+    statusCodes = ["foobar", "foobar"]
+    retryAttempts = true
+    minDuration = 42
+  [accessLog.fields]
+    defaultMode = "foobar"
+    [accessLog.fields.names]
+      name0 = "foobar"
+      name1 = "foobar"
+    [accessLog.fields.headers]
+      defaultMode = "foobar"
+      [accessLog.fields.headers.names]
+        name0 = "foobar"
+        name1 = "foobar"
+
+[tracing]
+  serviceName = "foobar"
+  spanNameLimit = 42
+  [tracing.jaeger]
+    samplingServerURL = "foobar"
+    samplingType = "foobar"
+    samplingParam = 42.0
+    localAgentHostPort = "foobar"
+    gen128Bit = true
+    propagation = "foobar"
+    traceContextHeaderName = "foobar"
+  [tracing.zipkin]
+    httpEndpoint = "foobar"
+    sameSpan = true
+    id128Bit = true
+    debug = true
+    sampleRate = 42.0
+  [tracing.dataDog]
+    localAgentHostPort = "foobar"
+    globalTag = "foobar"
+    debug = true
+    prioritySampling = true
+    traceIDHeaderName = "foobar"
+    parentIDHeaderName = "foobar"
+    samplingPriorityHeaderName = "foobar"
+    bagagePrefixHeaderName = "foobar"
+  [tracing.instana]
+    localAgentHost = "foobar"
+    localAgentPort = 42
+    logLevel = "foobar"
+  [tracing.haystack]
+    localAgentHost = "foobar"
+    localAgentPort = 42
+    globalTag = "foobar"
+    traceIDHeaderName = "foobar"
+    parentIDHeaderName = "foobar"
+    spanIDHeaderName = "foobar"
+
+[hostResolver]
+  cnameFlattening = true
+  resolvConfig = "foobar"
+  resolvDepth = 42
+
+[acme]
+  email = "foobar"
+  acmeLogging = true
+  caServer = "foobar"
+  storage = "foobar"
+  entryPoint = "foobar"
+  keyType = "foobar"
+  onHostRule = true
+  [acme.dnsChallenge]
+    provider = "foobar"
+    delayBeforeCheck = 42
+    resolvers = ["foobar", "foobar"]
+    disablePropagationCheck = true
+  [acme.httpChallenge]
+    entryPoint = "foobar"
+  [acme.tlsChallenge]
+
+  [[acme.domains]]
+    main = "foobar"
+    sans = ["foobar", "foobar"]
+
+  [[acme.domains]]
+    main = "foobar"
+    sans = ["foobar", "foobar"]
+
+## Dynamic configuration
+
+[http]
+  [http.routers]
+    [http.routers.Router0]
+      entryPoints = ["foobar", "foobar"]
+      middlewares = ["foobar", "foobar"]
+      service = "foobar"
+      rule = "foobar"
+      priority = 42
+      [http.routers.Router0.tls]
+  [http.middlewares]
+    [http.middlewares.Middleware0]
+      [http.middlewares.Middleware0.addPrefix]
+        prefix = "foobar"
+    [http.middlewares.Middleware1]
+      [http.middlewares.Middleware1.stripPrefix]
+        prefixes = ["foobar", "foobar"]
+    [http.middlewares.Middleware10]
+      [http.middlewares.Middleware10.rateLimit]
+        extractorFunc = "foobar"
+        [http.middlewares.Middleware10.rateLimit.rateSet]
+          [http.middlewares.Middleware10.rateLimit.rateSet.Rate0]
+            period = 42000000000
+            average = 42
+            burst = 42
+          [http.middlewares.Middleware10.rateLimit.rateSet.Rate1]
+            period = 42000000000
+            average = 42
+            burst = 42
+    [http.middlewares.Middleware11]
+      [http.middlewares.Middleware11.redirectRegex]
+        regex = "foobar"
+        replacement = "foobar"
+        permanent = true
+    [http.middlewares.Middleware12]
+      [http.middlewares.Middleware12.redirectScheme]
+        scheme = "foobar"
+        port = "foobar"
+        permanent = true
+    [http.middlewares.Middleware13]
+      [http.middlewares.Middleware13.basicAuth]
+        users = ["foobar", "foobar"]
+        usersFile = "foobar"
+        realm = "foobar"
+        removeHeader = true
+        headerField = "foobar"
+    [http.middlewares.Middleware14]
+      [http.middlewares.Middleware14.digestAuth]
+        users = ["foobar", "foobar"]
+        usersFile = "foobar"
+        removeHeader = true
+        realm = "foobar"
+        headerField = "foobar"
+    [http.middlewares.Middleware15]
+      [http.middlewares.Middleware15.forwardAuth]
+        address = "foobar"
+        trustForwardHeader = true
+        authResponseHeaders = ["foobar", "foobar"]
+        [http.middlewares.Middleware15.forwardAuth.tls]
+          ca = "foobar"
+          caOptional = true
+          cert = "foobar"
+          key = "foobar"
+          insecureSkipVerify = true
+    [http.middlewares.Middleware16]
+      [http.middlewares.Middleware16.maxConn]
+        amount = 42
+        extractorFunc = "foobar"
+    [http.middlewares.Middleware17]
+      [http.middlewares.Middleware17.buffering]
+        maxRequestBodyBytes = 42
+        memRequestBodyBytes = 42
+        maxResponseBodyBytes = 42
+        memResponseBodyBytes = 42
+        retryExpression = "foobar"
+    [http.middlewares.Middleware18]
+      [http.middlewares.Middleware18.circuitBreaker]
+        expression = "foobar"
+    [http.middlewares.Middleware19]
+      [http.middlewares.Middleware19.compress]
+    [http.middlewares.Middleware2]
+      [http.middlewares.Middleware2.stripPrefixRegex]
+        regex = ["foobar", "foobar"]
+    [http.middlewares.Middleware20]
+      [http.middlewares.Middleware20.passTLSClientCert]
+        pem = true
+        [http.middlewares.Middleware20.passTLSClientCert.info]
+          notAfter = true
+          notBefore = true
+          sans = true
+          [http.middlewares.Middleware20.passTLSClientCert.info.subject]
+            country = true
+            province = true
+            locality = true
+            organization = true
+            commonName = true
+            serialNumber = true
+            domainComponent = true
+          [http.middlewares.Middleware20.passTLSClientCert.info.issuer]
+            country = true
+            province = true
+            locality = true
+            organization = true
+            commonName = true
+            serialNumber = true
+            domainComponent = true
+    [http.middlewares.Middleware21]
+      [http.middlewares.Middleware21.retry]
+        regex = 0
+    [http.middlewares.Middleware3]
+      [http.middlewares.Middleware3.replacePath]
+        path = "foobar"
+    [http.middlewares.Middleware4]
+      [http.middlewares.Middleware4.replacePathRegex]
+        regex = "foobar"
+        replacement = "foobar"
+    [http.middlewares.Middleware5]
+      [http.middlewares.Middleware5.chain]
+        middlewares = ["foobar", "foobar"]
+    [http.middlewares.Middleware6]
+      [http.middlewares.Middleware6.ipWhiteList]
+        sourceRange = ["foobar", "foobar"]
+    [http.middlewares.Middleware7]
+      [http.middlewares.Middleware7.ipWhiteList]
+        [http.middlewares.Middleware7.ipWhiteList.ipStrategy]
+          depth = 42
+          excludedIPs = ["foobar", "foobar"]
+    [http.middlewares.Middleware8]
+      [http.middlewares.Middleware8.headers]
+        accessControlAllowCredentials = true
+        accessControlAllowHeaders = ["foobar", "foobar"]
+        accessControlAllowMethods = ["foobar", "foobar"]
+        accessControlAllowOrigin = "foobar"
+        accessControlExposeHeaders = ["foobar", "foobar"]
+        accessControlMaxAge = 42
+        addVaryHeader = true
+        allowedHosts = ["foobar", "foobar"]
+        hostsProxyHeaders = ["foobar", "foobar"]
+        sslRedirect = true
+        sslTemporaryRedirect = true
+        sslHost = "foobar"
+        sslForceHost = true
+        stsSeconds = 42
+        stsIncludeSubdomains = true
+        stsPreload = true
+        forceSTSHeader = true
+        frameDeny = true
+        customFrameOptionsValue = "foobar"
+        contentTypeNosniff = true
+        browserXssFilter = true
+        customBrowserXSSValue = "foobar"
+        contentSecurityPolicy = "foobar"
+        publicKey = "foobar"
+        referrerPolicy = "foobar"
+        isDevelopment = true
+        [http.middlewares.Middleware8.headers.customRequestHeaders]
+          name0 = "foobar"
+          name1 = "foobar"
+        [http.middlewares.Middleware8.headers.customResponseHeaders]
+          name0 = "foobar"
+          name1 = "foobar"
+        [http.middlewares.Middleware8.headers.sslProxyHeaders]
+          name0 = "foobar"
+          name1 = "foobar"
+    [http.middlewares.Middleware9]
+      [http.middlewares.Middleware9.errors]
+        status = ["foobar", "foobar"]
+        service = "foobar"
+        query = "foobar"
+  [http.services]
+    [http.services.Service0]
+      [http.services.Service0.loadBalancer]
+        passHostHeader = true
+        [http.services.Service0.loadBalancer.stickiness]
+          cookieName = "foobar"
+
+        [[http.services.Service0.loadBalancer.servers]]
+          url = "foobar"
+
+        [[http.services.Service0.loadBalancer.servers]]
+          url = "foobar"
+        [http.services.Service0.loadBalancer.healthCheck]
+          scheme = "foobar"
+          path = "foobar"
+          port = 42
+          interval = "foobar"
+          timeout = "foobar"
+          hostname = "foobar"
+          [http.services.Service0.loadBalancer.healthCheck.headers]
+            name0 = "foobar"
+            name1 = "foobar"
+        [http.services.Service0.loadBalancer.responseForwarding]
+          flushInterval = "foobar"
+
+[tcp]
+  [tcp.routers]
+    [tcp.routers.TCPRouter0]
+      entryPoints = ["foobar", "foobar"]
+      service = "foobar"
+      rule = "foobar"
+      [tcp.routers.TCPRouter0.tls]
+        passthrough = true
+  [tcp.services]
+    [tcp.services.TCPService0]
+      [tcp.services.TCPService0.loadBalancer]
+
+        [[tcp.services.TCPService0.loadBalancer.servers]]
+          address = "foobar"
+
+        [[tcp.services.TCPService0.loadBalancer.servers]]
+          address = "foobar"
+
+[tls]
+
+  [[tls.Certificates]]
+    certFile = "foobar"
+    keyFile = "foobar"
+    stores = ["foobar", "foobar"]
+
+  [[tls.Certificates]]
+    certFile = "foobar"
+    keyFile = "foobar"
+    stores = ["foobar", "foobar"]
+  [tls.options]
+    [tls.options.TLS0]
+      minVersion = "foobar"
+      cipherSuites = ["foobar", "foobar"]
+      sniStrict = true
+      [tls.options.TLS0.clientCA]
+        files = ["foobar", "foobar"]
+        optional = true
+    [tls.options.TLS1]
+      minVersion = "foobar"
+      cipherSuites = ["foobar", "foobar"]
+      sniStrict = true
+      [tls.options.TLS1.clientCA]
+        files = ["foobar", "foobar"]
+        optional = true
+  [tls.stores]
+    [tls.stores.Store0]
+      [tls.stores.Store0.defaultCertificate]
+        certFile = "foobar"
+        keyFile = "foobar"
+    [tls.stores.Store1]
+      [tls.stores.Store1.defaultCertificate]
+        certFile = "foobar"
+        keyFile = "foobar"
\ No newline at end of file
diff --git a/pkg/config/zz_generated.deepcopy.go b/pkg/config/zz_generated.deepcopy.go
index 2cf48762f..2b037b221 100644
--- a/pkg/config/zz_generated.deepcopy.go
+++ b/pkg/config/zz_generated.deepcopy.go
@@ -28,6 +28,10 @@ THE SOFTWARE.
 
 package config
 
+import (
+	tls "github.com/containous/traefik/pkg/tls"
+)
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AddPrefix) DeepCopyInto(out *AddPrefix) {
 	*out = *in
@@ -181,6 +185,67 @@ func (in *Compress) DeepCopy() *Compress {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Configuration) DeepCopyInto(out *Configuration) {
+	*out = *in
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = new(HTTPConfiguration)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.TCP != nil {
+		in, out := &in.TCP, &out.TCP
+		*out = new(TCPConfiguration)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(TLSConfiguration)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Configuration.
+func (in *Configuration) DeepCopy() *Configuration {
+	if in == nil {
+		return nil
+	}
+	out := new(Configuration)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in Configurations) DeepCopyInto(out *Configurations) {
+	{
+		in := &in
+		*out = make(Configurations, len(*in))
+		for key, val := range *in {
+			var outVal *Configuration
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = new(Configuration)
+				(*in).DeepCopyInto(*out)
+			}
+			(*out)[key] = outVal
+		}
+		return
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Configurations.
+func (in Configurations) DeepCopy() Configurations {
+	if in == nil {
+		return nil
+	}
+	out := new(Configurations)
+	in.DeepCopyInto(out)
+	return *out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *DigestAuth) DeepCopyInto(out *DigestAuth) {
 	*out = *in
@@ -249,6 +314,67 @@ func (in *ForwardAuth) DeepCopy() *ForwardAuth {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPConfiguration) DeepCopyInto(out *HTTPConfiguration) {
+	*out = *in
+	if in.Routers != nil {
+		in, out := &in.Routers, &out.Routers
+		*out = make(map[string]*Router, len(*in))
+		for key, val := range *in {
+			var outVal *Router
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = new(Router)
+				(*in).DeepCopyInto(*out)
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.Middlewares != nil {
+		in, out := &in.Middlewares, &out.Middlewares
+		*out = make(map[string]*Middleware, len(*in))
+		for key, val := range *in {
+			var outVal *Middleware
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = new(Middleware)
+				(*in).DeepCopyInto(*out)
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.Services != nil {
+		in, out := &in.Services, &out.Services
+		*out = make(map[string]*Service, len(*in))
+		for key, val := range *in {
+			var outVal *Service
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = new(Service)
+				(*in).DeepCopyInto(*out)
+			}
+			(*out)[key] = outVal
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPConfiguration.
+func (in *HTTPConfiguration) DeepCopy() *HTTPConfiguration {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPConfiguration)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Headers) DeepCopyInto(out *Headers) {
 	*out = *in
@@ -311,6 +437,29 @@ func (in *Headers) DeepCopy() *Headers {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HealthCheck) DeepCopyInto(out *HealthCheck) {
+	*out = *in
+	if in.Headers != nil {
+		in, out := &in.Headers, &out.Headers
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HealthCheck.
+func (in *HealthCheck) DeepCopy() *HealthCheck {
+	if in == nil {
+		return nil
+	}
+	out := new(HealthCheck)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *IPStrategy) DeepCopyInto(out *IPStrategy) {
 	*out = *in
@@ -358,6 +507,42 @@ func (in *IPWhiteList) DeepCopy() *IPWhiteList {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LoadBalancerService) DeepCopyInto(out *LoadBalancerService) {
+	*out = *in
+	if in.Stickiness != nil {
+		in, out := &in.Stickiness, &out.Stickiness
+		*out = new(Stickiness)
+		**out = **in
+	}
+	if in.Servers != nil {
+		in, out := &in.Servers, &out.Servers
+		*out = make([]Server, len(*in))
+		copy(*out, *in)
+	}
+	if in.HealthCheck != nil {
+		in, out := &in.HealthCheck, &out.HealthCheck
+		*out = new(HealthCheck)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ResponseForwarding != nil {
+		in, out := &in.ResponseForwarding, &out.ResponseForwarding
+		*out = new(ResponseForwarding)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LoadBalancerService.
+func (in *LoadBalancerService) DeepCopy() *LoadBalancerService {
+	if in == nil {
+		return nil
+	}
+	out := new(LoadBalancerService)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *MaxConn) DeepCopyInto(out *MaxConn) {
 	*out = *in
@@ -374,6 +559,27 @@ func (in *MaxConn) DeepCopy() *MaxConn {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Message) DeepCopyInto(out *Message) {
+	*out = *in
+	if in.Configuration != nil {
+		in, out := &in.Configuration, &out.Configuration
+		*out = new(Configuration)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Message.
+func (in *Message) DeepCopy() *Message {
+	if in == nil {
+		return nil
+	}
+	out := new(Message)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Middleware) DeepCopyInto(out *Middleware) {
 	*out = *in
@@ -627,6 +833,22 @@ func (in *ReplacePathRegex) DeepCopy() *ReplacePathRegex {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ResponseForwarding) DeepCopyInto(out *ResponseForwarding) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResponseForwarding.
+func (in *ResponseForwarding) DeepCopy() *ResponseForwarding {
+	if in == nil {
+		return nil
+	}
+	out := new(ResponseForwarding)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Retry) DeepCopyInto(out *Retry) {
 	*out = *in
@@ -643,6 +865,122 @@ func (in *Retry) DeepCopy() *Retry {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Router) DeepCopyInto(out *Router) {
+	*out = *in
+	if in.EntryPoints != nil {
+		in, out := &in.EntryPoints, &out.EntryPoints
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Middlewares != nil {
+		in, out := &in.Middlewares, &out.Middlewares
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(RouterTLSConfig)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Router.
+func (in *Router) DeepCopy() *Router {
+	if in == nil {
+		return nil
+	}
+	out := new(Router)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RouterTCPTLSConfig) DeepCopyInto(out *RouterTCPTLSConfig) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RouterTCPTLSConfig.
+func (in *RouterTCPTLSConfig) DeepCopy() *RouterTCPTLSConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(RouterTCPTLSConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RouterTLSConfig) DeepCopyInto(out *RouterTLSConfig) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RouterTLSConfig.
+func (in *RouterTLSConfig) DeepCopy() *RouterTLSConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(RouterTLSConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Server) DeepCopyInto(out *Server) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Server.
+func (in *Server) DeepCopy() *Server {
+	if in == nil {
+		return nil
+	}
+	out := new(Server)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Service) DeepCopyInto(out *Service) {
+	*out = *in
+	if in.LoadBalancer != nil {
+		in, out := &in.LoadBalancer, &out.LoadBalancer
+		*out = new(LoadBalancerService)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Service.
+func (in *Service) DeepCopy() *Service {
+	if in == nil {
+		return nil
+	}
+	out := new(Service)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Stickiness) DeepCopyInto(out *Stickiness) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Stickiness.
+func (in *Stickiness) DeepCopy() *Stickiness {
+	if in == nil {
+		return nil
+	}
+	out := new(Stickiness)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *StripPrefix) DeepCopyInto(out *StripPrefix) {
 	*out = *in
@@ -685,6 +1023,136 @@ func (in *StripPrefixRegex) DeepCopy() *StripPrefixRegex {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPConfiguration) DeepCopyInto(out *TCPConfiguration) {
+	*out = *in
+	if in.Routers != nil {
+		in, out := &in.Routers, &out.Routers
+		*out = make(map[string]*TCPRouter, len(*in))
+		for key, val := range *in {
+			var outVal *TCPRouter
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = new(TCPRouter)
+				(*in).DeepCopyInto(*out)
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.Services != nil {
+		in, out := &in.Services, &out.Services
+		*out = make(map[string]*TCPService, len(*in))
+		for key, val := range *in {
+			var outVal *TCPService
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = new(TCPService)
+				(*in).DeepCopyInto(*out)
+			}
+			(*out)[key] = outVal
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPConfiguration.
+func (in *TCPConfiguration) DeepCopy() *TCPConfiguration {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPConfiguration)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPLoadBalancerService) DeepCopyInto(out *TCPLoadBalancerService) {
+	*out = *in
+	if in.Servers != nil {
+		in, out := &in.Servers, &out.Servers
+		*out = make([]TCPServer, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPLoadBalancerService.
+func (in *TCPLoadBalancerService) DeepCopy() *TCPLoadBalancerService {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPLoadBalancerService)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPRouter) DeepCopyInto(out *TCPRouter) {
+	*out = *in
+	if in.EntryPoints != nil {
+		in, out := &in.EntryPoints, &out.EntryPoints
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(RouterTCPTLSConfig)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPRouter.
+func (in *TCPRouter) DeepCopy() *TCPRouter {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPRouter)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPServer) DeepCopyInto(out *TCPServer) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPServer.
+func (in *TCPServer) DeepCopy() *TCPServer {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPServer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPService) DeepCopyInto(out *TCPService) {
+	*out = *in
+	if in.LoadBalancer != nil {
+		in, out := &in.LoadBalancer, &out.LoadBalancer
+		*out = new(TCPLoadBalancerService)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPService.
+func (in *TCPService) DeepCopy() *TCPService {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPService)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TLSCLientCertificateDNInfo) DeepCopyInto(out *TLSCLientCertificateDNInfo) {
 	*out = *in
@@ -727,6 +1195,47 @@ func (in *TLSClientCertificateInfo) DeepCopy() *TLSClientCertificateInfo {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSConfiguration) DeepCopyInto(out *TLSConfiguration) {
+	*out = *in
+	if in.Certificates != nil {
+		in, out := &in.Certificates, &out.Certificates
+		*out = make([]*tls.CertAndStores, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(tls.CertAndStores)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Options != nil {
+		in, out := &in.Options, &out.Options
+		*out = make(map[string]tls.Options, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	if in.Stores != nil {
+		in, out := &in.Stores, &out.Stores
+		*out = make(map[string]tls.Store, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSConfiguration.
+func (in *TLSConfiguration) DeepCopy() *TLSConfiguration {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSConfiguration)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in Users) DeepCopyInto(out *Users) {
 	{
diff --git a/pkg/server/server_configuration.go b/pkg/server/server_configuration.go
index dd397f82b..eb78e4023 100644
--- a/pkg/server/server_configuration.go
+++ b/pkg/server/server_configuration.go
@@ -30,10 +30,7 @@ func (s *Server) loadConfiguration(configMsg config.Message) {
 	currentConfigurations := s.currentConfigurations.Get().(config.Configurations)
 
 	// Copy configurations to new map so we don't change current if LoadConfig fails
-	newConfigurations := make(config.Configurations)
-	for k, v := range currentConfigurations {
-		newConfigurations[k] = v
-	}
+	newConfigurations := currentConfigurations.DeepCopy()
 	newConfigurations[configMsg.ProviderName] = configMsg.Configuration
 
 	s.metricsRegistry.ConfigReloadsCounter().Add(1)
diff --git a/pkg/tls/tls.go b/pkg/tls/tls.go
index 8b855fcba..7193a5220 100644
--- a/pkg/tls/tls.go
+++ b/pkg/tls/tls.go
@@ -2,6 +2,8 @@ package tls
 
 const certificateHeader = "-----BEGIN CERTIFICATE-----\n"
 
+// +k8s:deepcopy-gen=true
+
 // ClientCA defines traefik CA files for a entryPoint
 // and it indicates if they are mandatory or have just to be analyzed if provided.
 type ClientCA struct {
@@ -9,6 +11,8 @@ type ClientCA struct {
 	Optional bool            `json:"optional,omitempty" toml:"optional,omitempty" yaml:"optional,omitempty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // Options configures TLS for an entry point
 type Options struct {
 	MinVersion   string   `json:"minVersion,omitempty" toml:"minVersion,omitempty" yaml:"minVersion,omitempty" export:"true"`
@@ -17,11 +21,15 @@ type Options struct {
 	SniStrict    bool     `json:"sniStrict,omitempty" toml:"sniStrict,omitempty" yaml:"sniStrict,omitempty" export:"true"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // Store holds the options for a given Store
 type Store struct {
 	DefaultCertificate *Certificate `json:"defaultCertificate,omitempty" toml:"defaultCertificate,omitempty" yaml:"defaultCertificate,omitempty"`
 }
 
+// +k8s:deepcopy-gen=true
+
 // CertAndStores allows mapping a TLS certificate to a list of entry points.
 type CertAndStores struct {
 	Certificate `yaml:",inline"`
diff --git a/pkg/tls/zz_generated.deepcopy.go b/pkg/tls/zz_generated.deepcopy.go
new file mode 100644
index 000000000..9823a1354
--- /dev/null
+++ b/pkg/tls/zz_generated.deepcopy.go
@@ -0,0 +1,115 @@
+// +build !ignore_autogenerated
+
+/*
+The MIT License (MIT)
+
+Copyright (c) 2016-2019 Containous SAS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package tls
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CertAndStores) DeepCopyInto(out *CertAndStores) {
+	*out = *in
+	out.Certificate = in.Certificate
+	if in.Stores != nil {
+		in, out := &in.Stores, &out.Stores
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertAndStores.
+func (in *CertAndStores) DeepCopy() *CertAndStores {
+	if in == nil {
+		return nil
+	}
+	out := new(CertAndStores)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClientCA) DeepCopyInto(out *ClientCA) {
+	*out = *in
+	if in.Files != nil {
+		in, out := &in.Files, &out.Files
+		*out = make([]FileOrContent, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientCA.
+func (in *ClientCA) DeepCopy() *ClientCA {
+	if in == nil {
+		return nil
+	}
+	out := new(ClientCA)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Options) DeepCopyInto(out *Options) {
+	*out = *in
+	if in.CipherSuites != nil {
+		in, out := &in.CipherSuites, &out.CipherSuites
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	in.ClientCA.DeepCopyInto(&out.ClientCA)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Options.
+func (in *Options) DeepCopy() *Options {
+	if in == nil {
+		return nil
+	}
+	out := new(Options)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Store) DeepCopyInto(out *Store) {
+	*out = *in
+	if in.DefaultCertificate != nil {
+		in, out := &in.DefaultCertificate, &out.DefaultCertificate
+		*out = new(Certificate)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Store.
+func (in *Store) DeepCopy() *Store {
+	if in == nil {
+		return nil
+	}
+	out := new(Store)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/script/update-generated-crd-code.sh b/script/update-generated-crd-code.sh
index f6178477d..bbc02afdc 100755
--- a/script/update-generated-crd-code.sh
+++ b/script/update-generated-crd-code.sh
@@ -11,4 +11,4 @@ REPO_ROOT=${HACK_DIR}/..
   --go-header-file "${HACK_DIR}"/boilerplate.go.tmpl \
   "$@"
 
-deepcopy-gen  --input-dirs github.com/containous/traefik/pkg/config -O zz_generated.deepcopy --go-header-file "${HACK_DIR}"/boilerplate.go.tmpl
+deepcopy-gen  --input-dirs github.com/containous/traefik/pkg/config --input-dirs github.com/containous/traefik/pkg/tls -O zz_generated.deepcopy --go-header-file "${HACK_DIR}"/boilerplate.go.tmpl