Merge branch 'v3.0' of github.com:traefik/traefik

Signed-off-by: baalajimaestro <me@baalajimaestro.me>
2024-04-05 10:37:08 +05:30 · 2024-04-05 10:37:08 +05:30 · e467a8093b
commit e467a8093b
parent 74b333fd94 ac1753a614
179 changed files with 3978 additions and 470 deletions
--- a/.golangci.yml
+++ b/.golangci.yml
@ -1,8 +1,5 @@
 run:
  timeout: 10m
-  skip-files: []
-  skip-dirs:
-    - pkg/provider/kubernetes/crd/generated/

 linters-settings:
  govet:
@ -209,11 +206,16 @@ linters:
    - maintidx # kind of duplicate of gocyclo
    - nonamedreturns # Too strict
    - gosmopolitan  # not relevant
+    - exportloopref # Useless with go1.22
+    - musttag
+    - intrange # bug (fixed in golangci-lint v1.58)

 issues:
  exclude-use-default: false
  max-issues-per-linter: 0
  max-same-issues: 0
+  exclude-dirs:
+    - pkg/provider/kubernetes/crd/generated/
  exclude:
    - 'Error return value of .((os\.)?std(out|err)\..*|.*Close|.*Flush|os\.Remove(All)?|.*printf?|os\.(Un)?Setenv). is not checked'
    - "should have a package comment, unless it's in another file for this package"
--- a/.semaphore/semaphore.yml
+++ b/.semaphore/semaphore.yml
@ -25,7 +25,7 @@ global_job_config:
      - export "PATH=${GOPATH}/bin:${PATH}"
      - mkdir -vp "${SEMAPHORE_GIT_DIR}" "${GOPATH}/bin"
      - export GOPROXY=https://proxy.golang.org,direct
-      - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b "${GOPATH}/bin" v1.56.2
+      - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b "${GOPATH}/bin" v1.57.0
      - curl -sSfL https://gist.githubusercontent.com/traefiker/6d7ac019c11d011e4f131bb2cca8900e/raw/goreleaser.sh | bash -s -- -b "${GOPATH}/bin"
      - checkout
      - cache restore traefik-$(checksum go.sum)
--- a/cmd/traefik/traefik_test.go
+++ b/cmd/traefik/traefik_test.go
@ -95,7 +95,6 @@ func TestAppendCertMetric(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/docs/content/contributing/maintainers.md
+++ b/docs/content/contributing/maintainers.md
@ -21,6 +21,8 @@ description: "Traefik Proxy is an open source software with a thriving community
 * Harold Ozouf [@jspdown](https://github.com/jspdown)
 * Tom Moulard [@tommoulard](https://github.com/tommoulard)
 * Landry Benguigui [@lbenguigui](https://github.com/lbenguigui)
+* Simon Delicata [@sdelicata](https://github.com/sdelicata)
+* Baptiste Mayelle [@youkoulayley](https://github.com/youkoulayley)

 ## Past Maintainers

--- a/docs/content/migration/v2-to-v3.md
+++ b/docs/content/migration/v2-to-v3.md
@ -92,6 +92,34 @@ Docker provider `tls.CAOptional` option has been removed in v3, as TLS client au

 The `tls.caOptional` option should be removed from the Docker provider static configuration.

+### Kubernetes Gateway API
+
+#### Experimental Channel Resources (TLSRoute and TCPRoute)
+
+In v3, the Kubernetes Gateway API provider does not enable support for the experimental channel API resources by default.
+
+##### Remediation
+
+The `experimentalChannel` option should be used to enable the support for the experimental channel API resources.
+
+??? example "An example usage of the Kubernetes Gateway API provider with experimental channel support enabled"
+
+    ```yaml tab="File (YAML)"
+    providers:
+      kubernetesGateway:
+        experimentalChannel: true
+    ```
+    
+    ```toml tab="File (TOML)"
+    [providers.kubernetesGateway]
+        experimentalChannel = true
+      # ...
+    ```
+    
+    ```bash tab="CLI"
+    --providers.kubernetesgateway.experimentalchannel=true
+    ```
+
 ### Experimental Configuration

 #### HTTP3
@ -696,7 +724,7 @@ Here are two possible transition strategies:

 Please check the [OpenTelemetry Tracing provider documention](../observability/tracing/opentelemetry.md) for more information.

-#### Internal Resources Observability (AccessLogs, Metrics and Tracing)
+#### Internal Resources Observability

 In v3, observability for internal routers or services (e.g.: `ping@internal`) is disabled by default.
 To enable it one should use the new `addInternals` option for AccessLogs, Metrics or Tracing.
@ -704,4 +732,4 @@ Please take a look at the observability documentation for more information:

 - [AccessLogs](../observability/access-logs.md#addinternals)
 - [Metrics](../observability/metrics/overview.md#addinternals)
- [AccessLogs](../observability/tracing/overview.md#addinternals)
+- [Tracing](../observability/tracing/overview.md#addinternals)
--- a/docs/content/migration/v2.md
+++ b/docs/content/migration/v2.md
@ -563,3 +563,20 @@ To enable these ciphers, please set the option `CipherSuites` in your [TLS confi
 > (https://go.dev/doc/go1.22#crypto/tls)

 To enable TLS 1.0, please set the option `MinVersion` to `VersionTLS10` in your [TLS configuration](https://doc.traefik.io/traefik/https/tls/#cipher-suites) or set the environment variable `GODEBUG=tls10server=1`.
+
+## v2.11.1
+
+### Maximum Router Priority Value
+
+Before v2.11.1, the maximum user-defined router priority value is:
+
+- `MaxInt32` for 32-bit platforms,
+- `MaxInt64` for 64-bit platforms.
+
+Please check out the [go documentation](https://pkg.go.dev/math#pkg-constants) for more information.
+
+In v2.11.1, Traefik reserves a range of priorities for its internal routers and now, 
+the maximum user-defined router priority value is:
+
+- `(MaxInt32 - 1000)` for 32-bit platforms,
+- `(MaxInt64 - 1000)` for 64-bit platforms.
--- a/docs/content/observability/access-logs.md
+++ b/docs/content/observability/access-logs.md
@ -30,7 +30,7 @@ accessLog: {}

 _Optional, Default="false"_

-Enables accessLogs for internal resources.
+Enables accessLogs for internal resources (e.g.: `ping@internal`).

 ```yaml tab="File (YAML)"
 accesslog:
--- a/docs/content/observability/metrics/overview.md
+++ b/docs/content/observability/metrics/overview.md
@ -21,7 +21,7 @@ and [Kubernetes](https://grafana.com/grafana/dashboards/17347) deployments.

 _Optional, Default="false"_

-Enables metrics for internal resources.
+Enables metrics for internal resources (e.g.: `ping@internals`).

 ```yaml tab="File (YAML)"
 metrics:
--- a/docs/content/observability/tracing/overview.md
+++ b/docs/content/observability/tracing/overview.md
@ -36,7 +36,7 @@ tracing: {}

 _Optional, Default="false"_

-Enables tracing for internal resources.
+Enables tracing for internal resources (e.g.: `ping@internal`).

 ```yaml tab="File (YAML)"
 tracing:
--- a/docs/content/providers/kubernetes-gateway.md
+++ b/docs/content/providers/kubernetes-gateway.md
@ -212,6 +212,29 @@ providers:
 --providers.kubernetesgateway.namespaces=default,production
 ```

+### `experimentalChannel`
+
+_Optional, Default: false_
+
+Toggles support for the Experimental Channel resources ([Gateway API release channels documentation](https://gateway-api.sigs.k8s.io/concepts/versioning/#release-channels)).
+This option currently enables support for `TCPRoute` and `TLSRoute`.
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesGateway:
+    experimentalChannel: true
+```
+
+```toml tab="File (TOML)"
+[providers.kubernetesGateway]
+    experimentalChannel = true
+  # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetesgateway.experimentalchannel=true
+```
+
 ### `labelselector`

 _Optional, Default: ""_
--- a/docs/content/providers/nomad.md
+++ b/docs/content/providers/nomad.md
@ -511,3 +511,27 @@ providers:
 --providers.nomad.namespaces=ns1,ns2
 # ...
 ```
+
+### `allowEmptyServices`
+
+_Optional, Default: false_
+
+If the parameter is set to `true`,
+it allows the creation of an empty [servers load balancer](../routing/services/index.md#servers-load-balancer) if the targeted Nomad service has no endpoints available. This results in a `503` HTTP response instead of a `404`.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    allowEmptyServices: true
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.nomad]
+  allowEmptyServices = true
+  # ...
+```
+
+```bash tab="CLI"
+--providers.nomad.allowEmptyServices=true
+```
--- a/docs/content/reference/static-configuration/cli-ref.md
+++ b/docs/content/reference/static-configuration/cli-ref.md
@ -729,6 +729,9 @@ Kubernetes certificate authority file path (not needed for in-cluster client).
 `--providers.kubernetesgateway.endpoint`:  
 Kubernetes server endpoint (required for external cluster client).

+`--providers.kubernetesgateway.experimentalchannel`:  
+Toggles Experimental Channel resources support (TCPRoute, TLSRoute...). (Default: ```false```)
+
 `--providers.kubernetesgateway.labelselector`:  
 Kubernetes label selector to select specific GatewayClasses.

@ -786,6 +789,9 @@ Kubernetes bearer token (not needed for in-cluster client). It accepts either a
 `--providers.nomad`:  
 Enable Nomad backend with default settings. (Default: ```false```)

+`--providers.nomad.allowemptyservices`:  
+Allow the creation of services without endpoints. (Default: ```false```)
+
 `--providers.nomad.constraints`:  
 Constraints is an expression that Traefik matches against the Nomad service's tags to determine whether to create route(s) for that service.

--- a/docs/content/reference/static-configuration/env-ref.md
+++ b/docs/content/reference/static-configuration/env-ref.md
@ -729,6 +729,9 @@ Kubernetes certificate authority file path (not needed for in-cluster client).
 `TRAEFIK_PROVIDERS_KUBERNETESGATEWAY_ENDPOINT`:  
 Kubernetes server endpoint (required for external cluster client).

+`TRAEFIK_PROVIDERS_KUBERNETESGATEWAY_EXPERIMENTALCHANNEL`:  
+Toggles Experimental Channel resources support (TCPRoute, TLSRoute...). (Default: ```false```)
+
 `TRAEFIK_PROVIDERS_KUBERNETESGATEWAY_LABELSELECTOR`:  
 Kubernetes label selector to select specific GatewayClasses.

@ -786,6 +789,9 @@ Kubernetes bearer token (not needed for in-cluster client). It accepts either a
 `TRAEFIK_PROVIDERS_NOMAD`:  
 Enable Nomad backend with default settings. (Default: ```false```)

+`TRAEFIK_PROVIDERS_NOMAD_ALLOWEMPTYSERVICES`:  
+Allow the creation of services without endpoints. (Default: ```false```)
+
 `TRAEFIK_PROVIDERS_NOMAD_CONSTRAINTS`:  
 Constraints is an expression that Traefik matches against the Nomad service's tags to determine whether to create route(s) for that service.

--- a/docs/content/reference/static-configuration/file.toml
+++ b/docs/content/reference/static-configuration/file.toml
@ -146,6 +146,7 @@
    namespaces = ["foobar", "foobar"]
    labelSelector = "foobar"
    throttleDuration = "42s"
+    experimentalChannel = true
  [providers.rest]
    insecure = true
  [providers.consulCatalog]
@ -184,6 +185,7 @@
    stale = true
    exposedByDefault = true
    refreshInterval = "42s"
+    allowEmptyServices = true
    namespaces = ["foobar", "foobar"]
    [providers.nomad.endpoint]
      address = "foobar"
--- a/docs/content/reference/static-configuration/file.yaml
+++ b/docs/content/reference/static-configuration/file.yaml
@ -163,6 +163,7 @@ providers:
      - foobar
    labelSelector: foobar
    throttleDuration: 42s
+    experimentalChannel: true
  rest:
    insecure: true
  consulCatalog:
@ -215,6 +216,7 @@ providers:
    stale: true
    exposedByDefault: true
    refreshInterval: 42s
+    allowEmptyServices: true
    namespaces:
      - foobar
      - foobar
--- a/docs/content/routing/providers/kubernetes-crd.md
+++ b/docs/content/routing/providers/kubernetes-crd.md
@ -374,7 +374,7 @@ Register the `IngressRoute` [kind](../../reference/dynamic-configuration/kuberne
 | [4]  | `routes[n].priority`           | Defines the [priority](../routers/index.md#priority) to disambiguate rules of the same length, for route matching                                                                                                                                                                            |
 | [5]  | `routes[n].middlewares`        | List of reference to [Middleware](#kind-middleware)                                                                                                                                                                                                                                          |
 | [6]  | `middlewares[n].name`          | Defines the [Middleware](#kind-middleware) name                                                                                                                                                                                                                                              |
-| [7]  | `middlewares[n].namespace`     | Defines the [Middleware](#kind-middleware) namespace                                                                                                                                                                                                                                         |
+| [7]  | `middlewares[n].namespace`     | Defines the [Middleware](#kind-middleware) namespace. It can be omitted when the Middleware is in the IngressRoute namespace.                                                                                                                                                                    |
 | [8]  | `routes[n].services`           | List of any combination of [TraefikService](#kind-traefikservice) and reference to a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) (See below for `ExternalName Service` setup)                                                                     |
 | [9]  | `services[n].port`             | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). This can be a reference to a named port.                                                                                                                                       |
 | [10] | `services[n].serversTransport` | Defines the reference to a [ServersTransport](#kind-serverstransport). The ServersTransport namespace is assumed to be the [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) namespace (see [ServersTransport reference](#serverstransport-reference)). |
--- a/docs/content/routing/routers/index.md
+++ b/docs/content/routing/routers/index.md
@ -442,6 +442,14 @@ The priority is directly equal to the length of the rule, and so the longest len

 A value of `0` for the priority is ignored: `priority = 0` means that the default rules length sorting is used.

+??? warning "Maximum Value"
+  
+    Traefik reserves a range of priorities for its internal routers,
+    the maximum user-defined router priority value is:
+
+      - `(MaxInt32 - 1000)` for 32-bit platforms,
+      - `(MaxInt64 - 1000)` for 64-bit platforms.
+
 ??? info "How default priorities are computed"

    ```yaml tab="File (YAML)"
@ -1148,6 +1156,14 @@ The priority is directly equal to the length of the rule, and so the longest len

 A value of `0` for the priority is ignored: `priority = 0` means that the default rules length sorting is used.

+??? warning "Maximum Value"
+
+    Traefik reserves a range of priorities for its internal routers,
+    the maximum user-defined router priority value is:
+
+      - `(MaxInt32 - 1000)` for 32-bit platforms,
+      - `(MaxInt64 - 1000)` for 64-bit platforms.
+
 ??? info "How default priorities are computed"

    ```yaml tab="File (YAML)"
--- a/go.mod
+++ b/go.mod
@ -61,7 +61,7 @@ require (
 	github.com/tidwall/gjson v1.17.0
 	github.com/traefik/grpc-web v0.16.0
 	github.com/traefik/paerser v0.2.0
-	github.com/traefik/yaegi v0.15.1
+	github.com/traefik/yaegi v0.16.1
 	github.com/unrolled/render v1.0.2
 	github.com/unrolled/secure v1.0.9
 	github.com/vulcand/oxy/v2 v2.0.0-20230427132221-be5cf38f3c1c
--- a/go.sum
+++ b/go.sum
@ -1097,8 +1097,8 @@ github.com/traefik/grpc-web v0.16.0 h1:eeUWZaFg6ZU0I9dWOYE2D5qkNzRBmXzzuRlxdltas
 github.com/traefik/grpc-web v0.16.0/go.mod h1:2ttniSv7pTgBWIU2HZLokxRfFX3SA60c/DTmQQgVml4=
 github.com/traefik/paerser v0.2.0 h1:zqCLGSXoNlcBd+mzqSCLjon/I6phqIjeJL2xFB2ysgQ=
 github.com/traefik/paerser v0.2.0/go.mod h1:afzaVcgF8A+MpTnPG4wBr4whjanCSYA6vK5RwaYVtRc=
-github.com/traefik/yaegi v0.15.1 h1:YA5SbaL6HZA0Exh9T/oArRHqGN2HQ+zgmCY7dkoTXu4=
-github.com/traefik/yaegi v0.15.1/go.mod h1:AVRxhaI2G+nUsaM1zyktzwXn69G3t/AuTDrCiTds9p0=
+github.com/traefik/yaegi v0.16.1 h1:f1De3DVJqIDKmnasUF6MwmWv1dSEEat0wcpXhD2On3E=
+github.com/traefik/yaegi v0.16.1/go.mod h1:4eVhbPb3LnD2VigQjhYbEJ69vDRFdT2HQNrXx8eEwUY=
 github.com/transip/gotransip/v6 v6.23.0 h1:PsTdjortrEZ8IFFifEryzjVjOy9SgK4ahlnhKBBIQgA=
 github.com/transip/gotransip/v6 v6.23.0/go.mod h1:nzv9eN2tdsUrm5nG5ZX6AugYIU4qgsMwIn2c0EZLk8c=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
--- a/integration/fixtures/k8s_gateway.toml
+++ b/integration/fixtures/k8s_gateway.toml
@ -27,3 +27,4 @@
    address = ":8443"

 [providers.kubernetesGateway]
+    experimentalChannel = true
--- a/integration/fixtures/tcp/service_errors.toml
+++ b/integration/fixtures/tcp/service_errors.toml
@ -24,10 +24,12 @@
  [tcp.routers.router1]
    service = "service1"
    rule = "HostSNI(`snitest.net`)"
+    [tcp.routers.router1.tls]

  [tcp.routers.router2]
    service = "service2"
    rule = "HostSNI(`snitest.com`)"
+    [tcp.routers.router2.tls]

 [tcp.services]
  [tcp.services.service1]
--- a/integration/https_test.go
+++ b/integration/https_test.go
@ -1134,8 +1134,6 @@ func (s *HTTPSSuite) TestWithDomainFronting() {
 	}

 	for _, test := range testCases {
-		test := test
-
 		req, err := http.NewRequest(http.MethodGet, "https://127.0.0.1:4443", nil)
 		require.NoError(s.T(), err)
 		req.Host = test.hostHeader
@ -1179,8 +1177,6 @@ func (s *HTTPSSuite) TestWithInvalidTLSOption() {
 	}

 	for _, test := range testCases {
-		test := test
-
 		tlsConfig := &tls.Config{
 			InsecureSkipVerify: true,
 		}
--- a/pkg/api/dashboard/dashboard.go
+++ b/pkg/api/dashboard/dashboard.go
@ -39,7 +39,7 @@ func Append(router *mux.Router, customAssets fs.FS) {
 			// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
 			w.Header().Del("Content-Type")

-			http.StripPrefix("/dashboard/", http.FileServer(http.FS(assets))).ServeHTTP(w, r)
+			http.StripPrefix("/dashboard/", http.FileServerFS(assets)).ServeHTTP(w, r)
 		})
 }

@ -56,7 +56,7 @@ func (g Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
 	w.Header().Del("Content-Type")

-	http.FileServer(http.FS(assets)).ServeHTTP(w, r)
+	http.FileServerFS(assets).ServeHTTP(w, r)
 }

 func safePrefix(req *http.Request) string {
--- a/pkg/api/dashboard/dashboard_test.go
+++ b/pkg/api/dashboard/dashboard_test.go
@ -42,7 +42,6 @@ func Test_safePrefix(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -91,7 +90,6 @@ func Test_ContentSecurityPolicy(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/api/handler_entrypoint_test.go
+++ b/pkg/api/handler_entrypoint_test.go
@ -210,7 +210,6 @@ func TestHandler_EntryPoints(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/api/handler_http_test.go
+++ b/pkg/api/handler_http_test.go
@ -998,7 +998,6 @@ func TestHandler_HTTP(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/api/handler_overview_test.go
+++ b/pkg/api/handler_overview_test.go
@ -269,7 +269,6 @@ func TestHandler_Overview(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/api/handler_tcp_test.go
+++ b/pkg/api/handler_tcp_test.go
@ -874,7 +874,6 @@ func TestHandler_TCP(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/api/handler_test.go
+++ b/pkg/api/handler_test.go
@ -127,7 +127,6 @@ func TestHandler_RawData(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -252,7 +251,6 @@ func TestHandler_GetMiddleware(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/api/handler_udp_test.go
+++ b/pkg/api/handler_udp_test.go
@ -564,7 +564,6 @@ func TestHandler_UDP(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/api/sort_test.go
+++ b/pkg/api/sort_test.go
@ -828,7 +828,6 @@ func TestSortRouters(t *testing.T) {
 		},
 	}
 	for _, test := range testCases {
-		test := test
 		t.Run(fmt.Sprintf("%s-%s", test.direction, test.sortBy), func(t *testing.T) {
 			t.Parallel()

@ -1339,7 +1338,6 @@ func TestSortServices(t *testing.T) {
 		},
 	}
 	for _, test := range testCases {
-		test := test
 		t.Run(fmt.Sprintf("%s-%s", test.direction, test.sortBy), func(t *testing.T) {
 			t.Parallel()

@ -1674,7 +1672,6 @@ func TestSortMiddlewares(t *testing.T) {
 		},
 	}
 	for _, test := range testCases {
-		test := test
 		t.Run(fmt.Sprintf("%s-%s", test.direction, test.sortBy), func(t *testing.T) {
 			t.Parallel()

--- a/pkg/cli/deprecation_test.go
+++ b/pkg/cli/deprecation_test.go
@ -267,7 +267,6 @@ func TestDeprecationNotice(t *testing.T) {
 	}

 	for _, test := range tests {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -385,7 +384,6 @@ func TestLoad(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			tconfig := cmd.NewTraefikConfiguration()
 			c := &cli.Command{Configuration: tconfig}
--- a/pkg/collector/collector.go
+++ b/pkg/collector/collector.go
@ -65,7 +65,7 @@ func createBody(staticConfiguration *static.Configuration) (*bytes.Buffer, error
 	}

 	buf := new(bytes.Buffer)
-	err = json.NewEncoder(buf).Encode(data) //nolint:musttag // cannot be changed for historical reasons.
+	err = json.NewEncoder(buf).Encode(data)
 	if err != nil {
 		return nil, err
 	}
--- a/pkg/config/kv/kv_node_test.go
+++ b/pkg/config/kv/kv_node_test.go
@ -244,7 +244,6 @@ func TestDecodeToNode(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/config/kv/kv_test.go
+++ b/pkg/config/kv/kv_test.go
@ -87,7 +87,6 @@ func TestDecode(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/config/runtime/runtime_http_test.go
+++ b/pkg/config/runtime/runtime_http_test.go
@ -208,7 +208,6 @@ func TestGetRoutersByEntryPoints(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 			runtimeConfig := NewConfig(test.conf)
--- a/pkg/config/runtime/runtime_tcp_test.go
+++ b/pkg/config/runtime/runtime_tcp_test.go
@ -208,7 +208,6 @@ func TestGetTCPRoutersByEntryPoints(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 			runtimeConfig := NewConfig(test.conf)
--- a/pkg/config/runtime/runtime_test.go
+++ b/pkg/config/runtime/runtime_test.go
@ -665,8 +665,6 @@ func TestPopulateUsedBy(t *testing.T) {
 		},
 	}
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/config/runtime/runtime_udp_test.go
+++ b/pkg/config/runtime/runtime_udp_test.go
@ -189,7 +189,6 @@ func TestGetUDPRoutersByEntryPoints(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 			runtimeConfig := NewConfig(test.conf)
--- a/pkg/config/static/static_config_test.go
+++ b/pkg/config/static/static_config_test.go
@ -26,7 +26,6 @@ func TestHasEntrypoint(t *testing.T) {
 	}

 	for _, test := range tests {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/healthcheck/healthcheck_test.go
+++ b/pkg/healthcheck/healthcheck_test.go
@ -243,7 +243,6 @@ func TestServiceHealthChecker_newRequest(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -405,7 +404,6 @@ func TestServiceHealthChecker_Launch(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/ip/checker_test.go
+++ b/pkg/ip/checker_test.go
@ -36,7 +36,6 @@ func TestIsAuthorized(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -117,7 +116,6 @@ func TestNew(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -289,7 +287,6 @@ func TestContainsIsAllowed(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/ip/strategy_test.go
+++ b/pkg/ip/strategy_test.go
@ -21,7 +21,6 @@ func TestRemoteAddrStrategy_GetIP(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -61,7 +60,6 @@ func TestDepthStrategy_GetIP(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -109,7 +107,6 @@ func TestTrustedIPsStrategy_GetIP(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/metrics/datadog_test.go
+++ b/pkg/metrics/datadog_test.go
@ -67,7 +67,6 @@ func TestDatadog_parseDatadogAddress(t *testing.T) {
 	}

 	for _, test := range tests {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/metrics/opentelemetry_test.go
+++ b/pkg/metrics/opentelemetry_test.go
@ -89,8 +89,6 @@ func TestOpenTelemetry_labels(t *testing.T) {
 	}

 	for _, test := range tests {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -181,8 +179,6 @@ func TestOpenTelemetry_GaugeCollectorAdd(t *testing.T) {
 	}

 	for _, test := range tests {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -275,8 +271,6 @@ func TestOpenTelemetry_GaugeCollectorSet(t *testing.T) {
 	}

 	for _, test := range tests {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/metrics/prometheus_test.go
+++ b/pkg/metrics/prometheus_test.go
@ -64,7 +64,6 @@ func TestRegisterPromState(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			actualNbRegistries := 0
 			for _, prom := range test.prometheusSlice {
@ -381,7 +380,6 @@ func TestPrometheus(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			family := findMetricFamily(test.name, metricsFamilies)
 			if family == nil {
--- a/pkg/middlewares/accesslog/logger_formatters_test.go
+++ b/pkg/middlewares/accesslog/logger_formatters_test.go
@ -86,7 +86,6 @@ func TestCommonLogFormatter_Format(t *testing.T) {
 	t.Setenv("TZ", "Etc/GMT+9")

 	for _, test := range testCases {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()

@ -150,7 +149,6 @@ func Test_toLog(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/accesslog/logger_test.go
+++ b/pkg/middlewares/accesslog/logger_test.go
@ -180,7 +180,6 @@ func TestLoggerHeaderFields(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			logFile, err := os.CreateTemp(t.TempDir(), "*.log")
 			require.NoError(t, err)
@ -469,7 +468,6 @@ func TestLoggerJSON(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -687,7 +685,6 @@ func TestNewLogHandlerOutputStdout(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			// NOTE: It is not possible to run these cases in parallel because we capture Stdout

--- a/pkg/middlewares/accesslog/parser_test.go
+++ b/pkg/middlewares/accesslog/parser_test.go
@ -60,7 +60,6 @@ func TestParseAccessLog(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/accesslog/save_retries_test.go
+++ b/pkg/middlewares/accesslog/save_retries_test.go
@ -28,8 +28,6 @@ func TestSaveRetries(t *testing.T) {
 	}

 	for _, test := range tests {
-		test := test
-
 		t.Run(fmt.Sprintf("%d retries", test.requestAttempt), func(t *testing.T) {
 			t.Parallel()
 			saveRetries := &SaveRetries{}
--- a/pkg/middlewares/addprefix/add_prefix_test.go
+++ b/pkg/middlewares/addprefix/add_prefix_test.go
@ -29,7 +29,6 @@ func TestNewAddPrefix(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -75,7 +74,6 @@ func TestAddPrefix(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/auth/basic_auth_test.go
+++ b/pkg/middlewares/auth/basic_auth_test.go
@ -210,7 +210,6 @@ func TestBasicAuthUsersFromFile(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/auth/digest_auth_test.go
+++ b/pkg/middlewares/auth/digest_auth_test.go
@ -88,7 +88,6 @@ func TestDigestAuthUsersFromFile(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/buffering/buffering_test.go
+++ b/pkg/middlewares/buffering/buffering_test.go
@ -48,7 +48,6 @@ func TestBuffering(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/compress/brotli/brotli_test.go
+++ b/pkg/middlewares/compress/brotli/brotli_test.go
@ -88,7 +88,6 @@ func Test_NoBody(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -347,7 +346,6 @@ func Test_ExcludedContentTypes(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -452,7 +450,6 @@ func Test_IncludedContentTypes(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -557,7 +554,6 @@ func Test_FlushExcludedContentTypes(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -676,7 +672,6 @@ func Test_FlushIncludedContentTypes(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -831,8 +826,6 @@ func TestParseContentType_equals(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/compress/compress_test.go
+++ b/pkg/middlewares/compress/compress_test.go
@ -74,8 +74,6 @@ func TestNegotiation(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -299,7 +297,6 @@ func TestShouldNotCompressWhenSpecificContentType(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -351,7 +348,6 @@ func TestShouldCompressWhenSpecificContentType(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -547,8 +543,6 @@ func TestMinResponseBodyBytes(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/connectionheader/connectionheader_test.go
+++ b/pkg/middlewares/connectionheader/connectionheader_test.go
@ -47,7 +47,6 @@ func TestRemover(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/contenttype/content_type_test.go
+++ b/pkg/middlewares/contenttype/content_type_test.go
@ -46,7 +46,6 @@ func TestAutoDetection(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/customerrors/custom_errors_test.go
+++ b/pkg/middlewares/customerrors/custom_errors_test.go
@ -157,7 +157,6 @@ func TestHandler(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/forwardedheaders/forwarded_header_test.go
+++ b/pkg/middlewares/forwardedheaders/forwarded_header_test.go
@ -272,7 +272,6 @@ func TestServeHTTP(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -369,7 +368,6 @@ func Test_isWebsocketRequest(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/headers/header_test.go
+++ b/pkg/middlewares/headers/header_test.go
@ -52,7 +52,6 @@ func TestNewHeader_customRequestHeader(t *testing.T) {
 	emptyHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/headers/headers_test.go
+++ b/pkg/middlewares/headers/headers_test.go
@ -59,7 +59,6 @@ func TestNew_allowedHosts(t *testing.T) {
 	require.NoError(t, err)

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/headers/secure_test.go
+++ b/pkg/middlewares/headers/secure_test.go
@ -67,7 +67,6 @@ func Test_newSecure_modifyResponse(t *testing.T) {
 	emptyHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) })

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/ipallowlist/ip_allowlist_test.go
+++ b/pkg/middlewares/ipallowlist/ip_allowlist_test.go
@ -41,7 +41,6 @@ func TestNewIPAllowLister(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -102,7 +101,6 @@ func TestIPAllowLister_ServeHTTP(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/ipwhitelist/ip_whitelist_test.go
+++ b/pkg/middlewares/ipwhitelist/ip_whitelist_test.go
@ -33,7 +33,6 @@ func TestNewIPWhiteLister(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -76,7 +75,6 @@ func TestIPWhiteLister_ServeHTTP(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/metrics/metrics_test.go
+++ b/pkg/middlewares/metrics/metrics_test.go
@ -80,7 +80,6 @@ func Test_getMethod(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.method, func(t *testing.T) {
 			t.Parallel()

@ -132,7 +131,6 @@ func Test_getRequestProtocol(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -175,7 +173,6 @@ func Test_grpcStatusCode(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/observability/entrypoint_test.go
+++ b/pkg/middlewares/observability/entrypoint_test.go
@ -122,7 +122,6 @@ func TestEntryPointMiddleware_metrics(t *testing.T) {
 	}

 	for _, test := range tests {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/passtlsclientcert/pass_tls_client_cert_test.go
+++ b/pkg/middlewares/passtlsclientcert/pass_tls_client_cert_test.go
@ -310,7 +310,6 @@ func TestPassTLSClientCert_PEM(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -533,7 +532,6 @@ func TestPassTLSClientCert_certInfo(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -604,7 +602,6 @@ WqeUSNGYV//RunTeuRDAf5OxehERb1srzBXhRZ3cZdzXbgR/`,
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -645,7 +642,6 @@ func Test_getSANs(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/ratelimiter/rate_limiter_test.go
+++ b/pkg/middlewares/ratelimiter/rate_limiter_test.go
@ -89,7 +89,6 @@ func TestNewRateLimiter(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -248,7 +247,6 @@ func TestRateLimit(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			if test.loadDuration >= time.Minute && testing.Short() {
 				t.Skip("skipping test in short mode.")
--- a/pkg/middlewares/redirect/redirect_regex_test.go
+++ b/pkg/middlewares/redirect/redirect_regex_test.go
@ -154,7 +154,6 @@ func TestRedirectRegexHandler(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/redirect/redirect_scheme_test.go
+++ b/pkg/middlewares/redirect/redirect_scheme_test.go
@ -283,8 +283,6 @@ func TestRedirectSchemeHandler(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/replacepathregex/replace_path_regex.go
+++ b/pkg/middlewares/replacepathregex/replace_path_regex.go
@ -52,7 +52,7 @@ func (rp *replacePathRegex) ServeHTTP(rw http.ResponseWriter, req *http.Request)
 		currentPath = req.URL.EscapedPath()
 	}

-	if rp.regexp != nil && len(rp.replacement) > 0 && rp.regexp.MatchString(currentPath) {
+	if rp.regexp != nil && rp.regexp.MatchString(currentPath) {
 		req.Header.Add(replacepath.ReplacedPathHeader, currentPath)
 		req.URL.RawPath = rp.regexp.ReplaceAllString(currentPath, rp.replacement)

--- a/pkg/middlewares/replacepathregex/replace_path_regex_test.go
+++ b/pkg/middlewares/replacepathregex/replace_path_regex_test.go
@ -44,6 +44,28 @@ func TestReplacePathRegex(t *testing.T) {
 			expectedRawPath: "/who-am-i/and/who-am-i",
 			expectedHeader:  "/whoami/and/whoami",
 		},
+		{
+			desc: "empty replacement",
+			path: "/whoami/and/whoami",
+			config: dynamic.ReplacePathRegex{
+				Replacement: "",
+				Regex:       `/whoami`,
+			},
+			expectedPath:    "/and",
+			expectedRawPath: "/and",
+			expectedHeader:  "/whoami/and/whoami",
+		},
+		{
+			desc: "empty trimmed replacement",
+			path: "/whoami/and/whoami",
+			config: dynamic.ReplacePathRegex{
+				Replacement: " ",
+				Regex:       `/whoami`,
+			},
+			expectedPath:    "/and",
+			expectedRawPath: "/and",
+			expectedHeader:  "/whoami/and/whoami",
+		},
 		{
 			desc: "no match",
 			path: "/whoami/and/whoami",
--- a/pkg/middlewares/requestdecorator/hostresolver_test.go
+++ b/pkg/middlewares/requestdecorator/hostresolver_test.go
@ -35,7 +35,6 @@ func TestCNAMEFlatten(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/requestdecorator/request_decorator_test.go
+++ b/pkg/middlewares/requestdecorator/request_decorator_test.go
@ -38,7 +38,6 @@ func TestRequestHost(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -80,7 +79,6 @@ func TestRequestFlattening(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -173,7 +171,6 @@ func Test_parseHost(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/retry/retry_test.go
+++ b/pkg/middlewares/retry/retry_test.go
@ -101,7 +101,6 @@ func TestRetry(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -272,7 +271,6 @@ func TestRetryWebsocket(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/snicheck/snicheck_test.go
+++ b/pkg/middlewares/snicheck/snicheck_test.go
@ -37,7 +37,6 @@ func TestSNICheck_ServeHTTP(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/stripprefix/strip_prefix_test.go
+++ b/pkg/middlewares/stripprefix/strip_prefix_test.go
@ -134,7 +134,6 @@ func TestStripPrefix(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/stripprefixregex/strip_prefix_regex_test.go
+++ b/pkg/middlewares/stripprefixregex/strip_prefix_regex_test.go
@ -108,7 +108,6 @@ func TestStripPrefixRegex(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.path, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/tcp/ipallowlist/ip_allowlist_test.go
+++ b/pkg/middlewares/tcp/ipallowlist/ip_allowlist_test.go
@ -39,7 +39,6 @@ func TestNewIPAllowLister(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -81,7 +80,6 @@ func TestIPAllowLister_ServeHTTP(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/middlewares/tcp/ipwhitelist/ip_whitelist_test.go
+++ b/pkg/middlewares/tcp/ipwhitelist/ip_whitelist_test.go
@ -39,7 +39,6 @@ func TestNewIPWhiteLister(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -81,7 +80,6 @@ func TestIPWhiteLister_ServeHTTP(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/muxer/http/matcher_test.go
+++ b/pkg/muxer/http/matcher_test.go
@ -65,7 +65,6 @@ func TestClientIPMatcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -139,7 +138,6 @@ func TestMethodMatcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -257,7 +255,6 @@ func TestHostMatcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -357,7 +354,6 @@ func TestHostRegexpMatcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -431,7 +427,6 @@ func TestPathMatcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -524,7 +519,6 @@ func TestPathRegexpMatcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -596,7 +590,6 @@ func TestPathPrefixMatcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -683,8 +676,6 @@ func TestHeaderMatcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -792,7 +783,6 @@ func TestHeaderRegexpMatcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -881,7 +871,6 @@ func TestQueryMatcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -995,7 +984,6 @@ func TestQueryRegexpMatcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/muxer/http/matcher_v2.go
+++ b/pkg/muxer/http/matcher_v2.go
@ -25,15 +25,21 @@ var httpFuncsV2 = map[string]func(*matchersTree, ...string) error{
 }

 func pathV2(tree *matchersTree, paths ...string) error {
+	var routes []*mux.Route
+
 	for _, path := range paths {
-		if !strings.HasPrefix(path, "/") {
-			return fmt.Errorf("path %q does not start with a '/'", path)
+		route := mux.NewRouter().NewRoute()
+
+		if err := route.Path(path).GetError(); err != nil {
+			return err
 		}
+
+		routes = append(routes, route)
 	}

 	tree.matcher = func(req *http.Request) bool {
-		for _, path := range paths {
-			if req.URL.Path == path {
+		for _, route := range routes {
+			if route.Match(req, &mux.RouteMatch{}) {
 				return true
 			}
 		}
@ -45,15 +51,21 @@ func pathV2(tree *matchersTree, paths ...string) error {
 }

 func pathPrefixV2(tree *matchersTree, paths ...string) error {
+	var routes []*mux.Route
+
 	for _, path := range paths {
-		if !strings.HasPrefix(path, "/") {
-			return fmt.Errorf("path %q does not start with a '/'", path)
+		route := mux.NewRouter().NewRoute()
+
+		if err := route.PathPrefix(path).GetError(); err != nil {
+			return err
 		}
+
+		routes = append(routes, route)
 	}

 	tree.matcher = func(req *http.Request) bool {
-		for _, path := range paths {
-			if strings.HasPrefix(req.URL.Path, path) {
+		for _, route := range routes {
+			if route.Match(req, &mux.RouteMatch{}) {
 				return true
 			}
 		}
--- a/pkg/muxer/http/matcher_v2_test.go
+++ b/pkg/muxer/http/matcher_v2_test.go
@ -69,7 +69,6 @@ func TestClientIPV2Matcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -146,7 +145,6 @@ func TestMethodV2Matcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -271,7 +269,6 @@ func TestHostV2Matcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -374,7 +371,6 @@ func TestHostRegexpV2Matcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -454,10 +450,21 @@ func TestPathV2Matcher(t *testing.T) {
 				"https://example.com/css/main.css": http.StatusNotFound,
 			},
 		},
+		{
+			desc: "valid Path matcher with regexp",
+			rule: "Path(`/css{path:(/.*)?}`)",
+			expected: map[string]int{
+				"https://example.com":                              http.StatusNotFound,
+				"https://example.com/css/main.css":                 http.StatusOK,
+				"https://example.org/css/main.css":                 http.StatusOK,
+				"https://example.com/css/components/component.css": http.StatusOK,
+				"https://example.com/css.css":                      http.StatusNotFound,
+				"https://example.com/js/main.js":                   http.StatusNotFound,
+			},
+		},
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -535,10 +542,21 @@ func TestPathPrefixV2Matcher(t *testing.T) {
 				"https://example.com/css/main.css": http.StatusOK,
 			},
 		},
+		{
+			desc: "valid PathPrefix matcher with regexp",
+			rule: "PathPrefix(`/css-{name:[0-9]?}`)",
+			expected: map[string]int{
+				"https://example.com":                                     http.StatusNotFound,
+				"https://example.com/css-1/main.css":                      http.StatusOK,
+				"https://example.org/css-222/main.css":                    http.StatusOK,
+				"https://example.com/css-333333/components/component.css": http.StatusOK,
+				"https://example.com/css.css":                             http.StatusNotFound,
+				"https://example.com/js/main.js":                          http.StatusNotFound,
+			},
+		},
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -625,8 +643,6 @@ func TestHeadersMatcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -734,7 +750,6 @@ func TestHeaderRegexpV2Matcher(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -827,7 +842,6 @@ func TestHostRegexp(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -1495,8 +1509,6 @@ func Test_addRoute(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/muxer/http/mux_test.go
+++ b/pkg/muxer/http/mux_test.go
@ -222,8 +222,6 @@ func TestMuxer(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -378,14 +376,12 @@ func Test_addRoutePriority(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 			muxer, err := NewMuxer()
 			require.NoError(t, err)

 			for _, route := range test.cases {
-				route := route
 				handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 					w.Header().Set("X-From", route.xFrom)
 				})
@ -446,7 +442,6 @@ func TestParseDomains(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.expression, func(t *testing.T) {
 			t.Parallel()

@ -511,7 +506,6 @@ func TestEmptyHost(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -550,7 +544,6 @@ func TestGetRulePriority(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/muxer/tcp/matcher_test.go
+++ b/pkg/muxer/tcp/matcher_test.go
@ -31,7 +31,6 @@ func Test_HostSNICatchAll(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -137,7 +136,6 @@ func Test_HostSNI(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -220,7 +218,6 @@ func Test_HostSNIRegexp(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -292,7 +289,6 @@ func Test_ClientIP(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -356,7 +352,6 @@ func Test_ALPN(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/muxer/tcp/matcher_v2_test.go
+++ b/pkg/muxer/tcp/matcher_v2_test.go
@ -461,8 +461,6 @@ func Test_addTCPRouteV2(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -561,7 +559,6 @@ func TestParseHostSNIV2(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.expression, func(t *testing.T) {
 			t.Parallel()

@ -606,8 +603,6 @@ func Test_HostSNICatchAllV2(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -708,8 +703,6 @@ func Test_HostSNIV2(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -823,8 +816,6 @@ func Test_HostSNIRegexpV2(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -916,8 +907,6 @@ func Test_ClientIPV2(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -985,8 +974,6 @@ func Test_ALPNV2(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/muxer/tcp/mux_test.go
+++ b/pkg/muxer/tcp/mux_test.go
@ -263,8 +263,6 @@ func Test_addTCPRoute(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -373,7 +371,6 @@ func TestParseHostSNI(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -436,8 +433,6 @@ func Test_Priority(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -446,7 +441,6 @@ func Test_Priority(t *testing.T) {

 			matchedRule := ""
 			for rule, priority := range test.rules {
-				rule := rule
 				err := muxer.AddRoute(rule, "", priority, tcp.HandlerFunc(func(conn tcp.WriteCloser) {
 					matchedRule = rule
 				}))
@ -488,7 +482,6 @@ func TestGetRulePriority(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/provider/acme/local_store_test.go
+++ b/pkg/provider/acme/local_store_test.go
@ -44,7 +44,6 @@ func TestLocalStore_GetAccount(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			s := NewLocalStore(test.filename)

--- a/pkg/provider/acme/provider_test.go
+++ b/pkg/provider/acme/provider_test.go
@ -166,7 +166,6 @@ func TestGetUncheckedCertificates(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -241,7 +240,6 @@ func TestProvider_sanitizeDomains(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -423,7 +421,6 @@ func TestDeleteUnnecessaryDomains(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -497,7 +494,6 @@ func TestIsAccountMatchingCaServer(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -573,7 +569,6 @@ func TestInitAccount(t *testing.T) {
 		},
 	}
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -632,7 +627,6 @@ func Test_getCertificateRenewDurations(t *testing.T) {
 		},
 	}
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/provider/aggregator/aggregator.go
+++ b/pkg/provider/aggregator/aggregator.go
@ -179,7 +179,6 @@ func (p ProviderAggregator) Provide(configurationChan chan<- dynamic.Message, po
 	}

 	for _, prd := range p.providers {
-		prd := prd
 		safe.Go(func() {
 			p.launchProvider(configurationChan, pool, prd)
 		})
--- a/pkg/provider/constraints/constraints_labels_test.go
+++ b/pkg/provider/constraints/constraints_labels_test.go
@ -161,7 +161,6 @@ func TestMatchLabels(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.expr, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/provider/constraints/constraints_tags_test.go
+++ b/pkg/provider/constraints/constraints_tags_test.go
@ -95,7 +95,6 @@ func TestMatchTags(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.expr, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/provider/consulcatalog/config_test.go
+++ b/pkg/provider/consulcatalog/config_test.go
@ -298,7 +298,6 @@ func TestDefaultRule(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -3347,8 +3346,6 @@ func Test_buildConfiguration(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -3414,8 +3411,6 @@ func TestNamespaces(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -3864,7 +3859,6 @@ func TestFilterHealthStatuses(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/provider/consulcatalog/convert_types_test.go
+++ b/pkg/provider/consulcatalog/convert_types_test.go
@ -52,7 +52,6 @@ func Test_tagsToNeutralLabels(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/pkg/provider/docker/config_test.go
+++ b/pkg/provider/docker/config_test.go
@ -395,7 +395,6 @@ func TestDynConfBuilder_DefaultRule(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -3649,8 +3648,6 @@ func TestDynConfBuilder_build(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -3837,7 +3834,6 @@ func TestDynConfBuilder_getIPPort_docker(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -3950,7 +3946,6 @@ func TestDynConfBuilder_getIPAddress_docker(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -4020,7 +4015,6 @@ func TestDynConfBuilder_getIPAddress_swarm(t *testing.T) {
 	}

 	for serviceID, test := range testCases {
-		test := test
 		t.Run(strconv.Itoa(serviceID), func(t *testing.T) {
 			t.Parallel()

--- a/pkg/provider/docker/pswarm.go
+++ b/pkg/provider/docker/pswarm.go
@ -187,8 +187,7 @@ func (p *SwarmProvider) listServices(ctx context.Context, dockerClient client.AP

 	networkMap := make(map[string]*dockertypes.NetworkResource)
 	for _, network := range networkList {
-		networkToAdd := network
-		networkMap[network.ID] = &networkToAdd
+		networkMap[network.ID] = &network
 	}

 	var dockerDataList []dockerData
--- a/pkg/provider/docker/pswarm_test.go
+++ b/pkg/provider/docker/pswarm_test.go
@ -63,7 +63,6 @@ func TestListTasks(t *testing.T) {
 	}

 	for caseID, test := range testCases {
-		test := test
 		t.Run(strconv.Itoa(caseID), func(t *testing.T) {
 			t.Parallel()

@ -230,7 +229,6 @@ func TestSwarmProvider_listServices(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -351,7 +349,6 @@ func TestSwarmProvider_parseService_task(t *testing.T) {
 	}

 	for caseID, test := range testCases {
-		test := test
 		t.Run(strconv.Itoa(caseID), func(t *testing.T) {
 			t.Parallel()

--- a/pkg/provider/docker/shared_test.go
+++ b/pkg/provider/docker/shared_test.go
@ -66,7 +66,6 @@ func Test_getPort_docker(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -96,7 +95,6 @@ func Test_getPort_swarm(t *testing.T) {
 	}

 	for serviceID, test := range testCases {
-		test := test
 		t.Run(strconv.Itoa(serviceID), func(t *testing.T) {
 			t.Parallel()

--- a/pkg/provider/ecs/config_test.go
+++ b/pkg/provider/ecs/config_test.go
@ -366,7 +366,6 @@ func TestDefaultRule(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

@ -3234,8 +3233,6 @@ func Test_buildConfiguration(t *testing.T) {
 	}

 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

--- a/Show more
+++ b/Show more