Merge branch 'v3.0' of github.com:traefik/traefik

Signed-off-by: baalajimaestro <me@baalajimaestro.me>

.golangci.yml

@@ -1,8 +1,5 @@
 run:
   timeout: 10m
-  skip-files: []
-  skip-dirs:
-    - pkg/provider/kubernetes/crd/generated/
 
 linters-settings:
   govet:
@@ -209,11 +206,16 @@ linters:
     - maintidx # kind of duplicate of gocyclo
     - nonamedreturns # Too strict
     - gosmopolitan  # not relevant
+    - exportloopref # Useless with go1.22
+    - musttag
+    - intrange # bug (fixed in golangci-lint v1.58)
 
 issues:
   exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0
+  exclude-dirs:
+    - pkg/provider/kubernetes/crd/generated/
   exclude:
     - 'Error return value of .((os\.)?std(out|err)\..*|.*Close|.*Flush|os\.Remove(All)?|.*printf?|os\.(Un)?Setenv). is not checked'
     - "should have a package comment, unless it's in another file for this package"

.semaphore/semaphore.yml

@@ -25,7 +25,7 @@ global_job_config:
       - export "PATH=${GOPATH}/bin:${PATH}"
       - mkdir -vp "${SEMAPHORE_GIT_DIR}" "${GOPATH}/bin"
       - export GOPROXY=https://proxy.golang.org,direct
-      - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b "${GOPATH}/bin" v1.56.2
+      - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b "${GOPATH}/bin" v1.57.0
       - curl -sSfL https://gist.githubusercontent.com/traefiker/6d7ac019c11d011e4f131bb2cca8900e/raw/goreleaser.sh | bash -s -- -b "${GOPATH}/bin"
       - checkout
       - cache restore traefik-$(checksum go.sum)

cmd/traefik/traefik_test.go

@@ -95,7 +95,6 @@ func TestAppendCertMetric(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

docs/content/contributing/maintainers.md

@@ -21,6 +21,8 @@ description: "Traefik Proxy is an open source software with a thriving community
 * Harold Ozouf [@jspdown](https://github.com/jspdown)
 * Tom Moulard [@tommoulard](https://github.com/tommoulard)
 * Landry Benguigui [@lbenguigui](https://github.com/lbenguigui)
+* Simon Delicata [@sdelicata](https://github.com/sdelicata)
+* Baptiste Mayelle [@youkoulayley](https://github.com/youkoulayley)
 
 ## Past Maintainers
 

docs/content/migration/v2-to-v3.md

@@ -92,6 +92,34 @@ Docker provider `tls.CAOptional` option has been removed in v3, as TLS client au
 
 The `tls.caOptional` option should be removed from the Docker provider static configuration.
 
+### Kubernetes Gateway API
+
+#### Experimental Channel Resources (TLSRoute and TCPRoute)
+
+In v3, the Kubernetes Gateway API provider does not enable support for the experimental channel API resources by default.
+
+##### Remediation
+
+The `experimentalChannel` option should be used to enable the support for the experimental channel API resources.
+
+??? example "An example usage of the Kubernetes Gateway API provider with experimental channel support enabled"
+
+    ```yaml tab="File (YAML)"
+    providers:
+      kubernetesGateway:
+        experimentalChannel: true
+    ```
+    
+    ```toml tab="File (TOML)"
+    [providers.kubernetesGateway]
+        experimentalChannel = true
+      # ...
+    ```
+    
+    ```bash tab="CLI"
+    --providers.kubernetesgateway.experimentalchannel=true
+    ```
+
 ### Experimental Configuration
 
 #### HTTP3
@@ -696,7 +724,7 @@ Here are two possible transition strategies:
 
 Please check the [OpenTelemetry Tracing provider documention](../observability/tracing/opentelemetry.md) for more information.
 
-#### Internal Resources Observability (AccessLogs, Metrics and Tracing)
+#### Internal Resources Observability
 
 In v3, observability for internal routers or services (e.g.: `ping@internal`) is disabled by default.
 To enable it one should use the new `addInternals` option for AccessLogs, Metrics or Tracing.
@@ -704,4 +732,4 @@ Please take a look at the observability documentation for more information:
 
 - [AccessLogs](../observability/access-logs.md#addinternals)
 - [Metrics](../observability/metrics/overview.md#addinternals)
-- [AccessLogs](../observability/tracing/overview.md#addinternals)
+- [Tracing](../observability/tracing/overview.md#addinternals)

docs/content/migration/v2.md

@@ -563,3 +563,20 @@ To enable these ciphers, please set the option `CipherSuites` in your [TLS confi
 > (https://go.dev/doc/go1.22#crypto/tls)
 
 To enable TLS 1.0, please set the option `MinVersion` to `VersionTLS10` in your [TLS configuration](https://doc.traefik.io/traefik/https/tls/#cipher-suites) or set the environment variable `GODEBUG=tls10server=1`.
+
+## v2.11.1
+
+### Maximum Router Priority Value
+
+Before v2.11.1, the maximum user-defined router priority value is:
+
+- `MaxInt32` for 32-bit platforms,
+- `MaxInt64` for 64-bit platforms.
+
+Please check out the [go documentation](https://pkg.go.dev/math#pkg-constants) for more information.
+
+In v2.11.1, Traefik reserves a range of priorities for its internal routers and now, 
+the maximum user-defined router priority value is:
+
+- `(MaxInt32 - 1000)` for 32-bit platforms,
+- `(MaxInt64 - 1000)` for 64-bit platforms.

docs/content/observability/access-logs.md

@@ -30,7 +30,7 @@ accessLog: {}
 
 _Optional, Default="false"_
 
-Enables accessLogs for internal resources.
+Enables accessLogs for internal resources (e.g.: `ping@internal`).
 
 ```yaml tab="File (YAML)"
 accesslog:

docs/content/observability/metrics/overview.md

@@ -21,7 +21,7 @@ and [Kubernetes](https://grafana.com/grafana/dashboards/17347) deployments.
 
 _Optional, Default="false"_
 
-Enables metrics for internal resources.
+Enables metrics for internal resources (e.g.: `ping@internals`).
 
 ```yaml tab="File (YAML)"
 metrics:

docs/content/observability/tracing/overview.md

@@ -36,7 +36,7 @@ tracing: {}
 
 _Optional, Default="false"_
 
-Enables tracing for internal resources.
+Enables tracing for internal resources (e.g.: `ping@internal`).
 
 ```yaml tab="File (YAML)"
 tracing:

docs/content/providers/kubernetes-gateway.md

@@ -212,6 +212,29 @@ providers:
 --providers.kubernetesgateway.namespaces=default,production
 ```
 
+### `experimentalChannel`
+
+_Optional, Default: false_
+
+Toggles support for the Experimental Channel resources ([Gateway API release channels documentation](https://gateway-api.sigs.k8s.io/concepts/versioning/#release-channels)).
+This option currently enables support for `TCPRoute` and `TLSRoute`.
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesGateway:
+    experimentalChannel: true
+```
+
+```toml tab="File (TOML)"
+[providers.kubernetesGateway]
+    experimentalChannel = true
+  # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetesgateway.experimentalchannel=true
+```
+
 ### `labelselector`
 
 _Optional, Default: ""_

docs/content/providers/nomad.md

@@ -511,3 +511,27 @@ providers:
 --providers.nomad.namespaces=ns1,ns2
 # ...
 ```
+
+### `allowEmptyServices`
+
+_Optional, Default: false_
+
+If the parameter is set to `true`,
+it allows the creation of an empty [servers load balancer](../routing/services/index.md#servers-load-balancer) if the targeted Nomad service has no endpoints available. This results in a `503` HTTP response instead of a `404`.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    allowEmptyServices: true
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.nomad]
+  allowEmptyServices = true
+  # ...
+```
+
+```bash tab="CLI"
+--providers.nomad.allowEmptyServices=true
+```

docs/content/reference/static-configuration/cli-ref.md

@@ -729,6 +729,9 @@ Kubernetes certificate authority file path (not needed for in-cluster client).
 `--providers.kubernetesgateway.endpoint`:  
 Kubernetes server endpoint (required for external cluster client).
 
+`--providers.kubernetesgateway.experimentalchannel`:  
+Toggles Experimental Channel resources support (TCPRoute, TLSRoute...). (Default: ```false```)
+
 `--providers.kubernetesgateway.labelselector`:  
 Kubernetes label selector to select specific GatewayClasses.
 
@@ -786,6 +789,9 @@ Kubernetes bearer token (not needed for in-cluster client). It accepts either a
 `--providers.nomad`:  
 Enable Nomad backend with default settings. (Default: ```false```)
 
+`--providers.nomad.allowemptyservices`:  
+Allow the creation of services without endpoints. (Default: ```false```)
+
 `--providers.nomad.constraints`:  
 Constraints is an expression that Traefik matches against the Nomad service's tags to determine whether to create route(s) for that service.
 

docs/content/reference/static-configuration/env-ref.md

@@ -729,6 +729,9 @@ Kubernetes certificate authority file path (not needed for in-cluster client).
 `TRAEFIK_PROVIDERS_KUBERNETESGATEWAY_ENDPOINT`:  
 Kubernetes server endpoint (required for external cluster client).
 
+`TRAEFIK_PROVIDERS_KUBERNETESGATEWAY_EXPERIMENTALCHANNEL`:  
+Toggles Experimental Channel resources support (TCPRoute, TLSRoute...). (Default: ```false```)
+
 `TRAEFIK_PROVIDERS_KUBERNETESGATEWAY_LABELSELECTOR`:  
 Kubernetes label selector to select specific GatewayClasses.
 
@@ -786,6 +789,9 @@ Kubernetes bearer token (not needed for in-cluster client). It accepts either a
 `TRAEFIK_PROVIDERS_NOMAD`:  
 Enable Nomad backend with default settings. (Default: ```false```)
 
+`TRAEFIK_PROVIDERS_NOMAD_ALLOWEMPTYSERVICES`:  
+Allow the creation of services without endpoints. (Default: ```false```)
+
 `TRAEFIK_PROVIDERS_NOMAD_CONSTRAINTS`:  
 Constraints is an expression that Traefik matches against the Nomad service's tags to determine whether to create route(s) for that service.
 

docs/content/reference/static-configuration/file.toml

@@ -146,6 +146,7 @@
     namespaces = ["foobar", "foobar"]
     labelSelector = "foobar"
     throttleDuration = "42s"
+    experimentalChannel = true
   [providers.rest]
     insecure = true
   [providers.consulCatalog]
@@ -184,6 +185,7 @@
     stale = true
     exposedByDefault = true
     refreshInterval = "42s"
+    allowEmptyServices = true
     namespaces = ["foobar", "foobar"]
     [providers.nomad.endpoint]
       address = "foobar"

docs/content/reference/static-configuration/file.yaml

@@ -163,6 +163,7 @@ providers:
       - foobar
     labelSelector: foobar
     throttleDuration: 42s
+    experimentalChannel: true
   rest:
     insecure: true
   consulCatalog:
@@ -215,6 +216,7 @@ providers:
     stale: true
     exposedByDefault: true
     refreshInterval: 42s
+    allowEmptyServices: true
     namespaces:
       - foobar
       - foobar

docs/content/routing/providers/kubernetes-crd.md

@@ -374,7 +374,7 @@ Register the `IngressRoute` [kind](../../reference/dynamic-configuration/kuberne
 | [4]  | `routes[n].priority`           | Defines the [priority](../routers/index.md#priority) to disambiguate rules of the same length, for route matching                                                                                                                                                                            |
 | [5]  | `routes[n].middlewares`        | List of reference to [Middleware](#kind-middleware)                                                                                                                                                                                                                                          |
 | [6]  | `middlewares[n].name`          | Defines the [Middleware](#kind-middleware) name                                                                                                                                                                                                                                              |
-| [7]  | `middlewares[n].namespace`     | Defines the [Middleware](#kind-middleware) namespace                                                                                                                                                                                                                                         |
+| [7]  | `middlewares[n].namespace`     | Defines the [Middleware](#kind-middleware) namespace. It can be omitted when the Middleware is in the IngressRoute namespace.                                                                                                                                                                    |
 | [8]  | `routes[n].services`           | List of any combination of [TraefikService](#kind-traefikservice) and reference to a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) (See below for `ExternalName Service` setup)                                                                     |
 | [9]  | `services[n].port`             | Defines the port of a [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/). This can be a reference to a named port.                                                                                                                                       |
 | [10] | `services[n].serversTransport` | Defines the reference to a [ServersTransport](#kind-serverstransport). The ServersTransport namespace is assumed to be the [Kubernetes service](https://kubernetes.io/docs/concepts/services-networking/service/) namespace (see [ServersTransport reference](#serverstransport-reference)). |

docs/content/routing/providers/kubernetes-gateway.md

@@ -241,29 +241,49 @@ Kubernetes cluster before creating `HTTPRoute` objects.
             - name: api@internal
               group: traefik.io                 # [18]
               kind: TraefikService              # [19]
+        - filters:                              # [20]
+          - type: ExtensionRef                  # [21]
+            extensionRef:                       # [22]
+              group: traefik.io                 # [23]
+              kind: Middleware                  # [24]
+              name: my-middleware               # [25]
+          - type: RequestRedirect               # [26]
+            requestRedirect:                    # [27]
+              scheme: https                     # [28]
+              statusCode: 301                   # [29]
     ```
 
-| Ref  | Attribute     | Description                                                                                                                                                                 |
+| Ref  | Attribute         | Description                                                                                                                                                                 |
-|------|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+|------|-------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| [1]  | `parentRefs`  | References the resources (usually Gateways) that a Route wants to be attached to.                                                                                           |
+| [1]  | `parentRefs`      | References the resources (usually Gateways) that a Route wants to be attached to.                                                                                           |
-| [2]  | `name`        | Name of the referent.                                                                                                                                                       |
+| [2]  | `name`            | Name of the referent.                                                                                                                                                       |
-| [3]  | `namespace`   | Namespace of the referent. When unspecified (or empty string), this refers to the local namespace of the Route.                                                             |
+| [3]  | `namespace`       | Namespace of the referent. When unspecified (or empty string), this refers to the local namespace of the Route.                                                             |
-| [4]  | `sectionName` | Name of a section within the target resource (the Listener name).                                                                                                           |
+| [4]  | `sectionName`     | Name of a section within the target resource (the Listener name).                                                                                                           |
-| [5]  | `hostnames`   | A set of hostname that should match against the HTTP Host header to select a HTTPRoute to process the request.                                                              |
+| [5]  | `hostnames`       | A set of hostname that should match against the HTTP Host header to select a HTTPRoute to process the request.                                                              |
-| [6]  | `rules`       | A list of HTTP matchers, filters and actions.                                                                                                                               |
+| [6]  | `rules`           | A list of HTTP matchers, filters and actions.                                                                                                                               |
-| [7]  | `matches`     | Conditions used for matching the rule against incoming HTTP requests. Each match is independent, i.e. this rule will be matched if **any** one of the matches is satisfied. |
+| [7]  | `matches`         | Conditions used for matching the rule against incoming HTTP requests. Each match is independent, i.e. this rule will be matched if **any** one of the matches is satisfied. |
-| [8]  | `path`        | An HTTP request path matcher. If this field is not specified, a default prefix match on the "/" path is provided.                                                           |
+| [8]  | `path`            | An HTTP request path matcher. If this field is not specified, a default prefix match on the "/" path is provided.                                                           |
-| [9]  | `type`        | Type of match against the path Value (supported types: `Exact`, `Prefix`).                                                                                                  |
+| [9]  | `type`            | Type of match against the path Value (supported types: `Exact`, `Prefix`).                                                                                                  |
-| [10] | `value`       | The value of the HTTP path to match against.                                                                                                                                |
+| [10] | `value`           | The value of the HTTP path to match against.                                                                                                                                |
-| [11] | `headers`     | Conditions to select a HTTP route by matching HTTP request headers.                                                                                                         |
+| [11] | `headers`         | Conditions to select a HTTP route by matching HTTP request headers.                                                                                                         |
-| [12] | `type`        | Type of match for the HTTP request header match against the `values` (supported types: `Exact`).                                                                            |
+| [12] | `name`            | Name of the HTTP header to be matched.                                                                                                                                      |
-| [13] | `value`       | A map of HTTP Headers to be matched. It MUST contain at least one entry.                                                                                                    |
+| [13] | `value`           | Value of HTTP Header to be matched.                                                                                                                                         |
-| [14] | `backendRefs` | Defines the backend(s) where matching requests should be sent.                                                                                                              |
+| [14] | `backendRefs`     | Defines the backend(s) where matching requests should be sent.                                                                                                              |
-| [15] | `name`        | The name of the referent service.                                                                                                                                           |
+| [15] | `name`            | The name of the referent service.                                                                                                                                           |
-| [16] | `weight`      | The proportion of traffic forwarded to a targetRef, computed as weight/(sum of all weights in targetRefs).                                                                  |
+| [16] | `weight`          | The proportion of traffic forwarded to a targetRef, computed as weight/(sum of all weights in targetRefs).                                                                  |
-| [17] | `port`        | The port of the referent service.                                                                                                                                           |
+| [17] | `port`            | The port of the referent service.                                                                                                                                           |
-| [18] | `group`       | Group is the group of the referent. Only `traefik.io` and `gateway.networking.k8s.io` values are supported.                                                                 |
+| [18] | `group`           | Group is the group of the referent. Only `traefik.io` and `gateway.networking.k8s.io` values are supported.                                                                 |
-| [19] | `kind`        | Kind is kind of the referent. Only `TraefikService` and `Service` values are supported.                                                                                     |
+| [19] | `kind`            | Kind is kind of the referent. Only `TraefikService` and `Service` values are supported.                                                                                     |
+| [20] | `filters`         | Defines the filters (middlewares) applied to the route.                                                                                                                     |
+| [21] | `type`            | Defines the type of filter; ExtensionRef is used for configuring custom HTTP filters.                                                                                       |
+| [22] | `extensionRef`    | Configuration of the custom HTTP filter.                                                                                                                                    |
+| [23] | `group`           | Group of the kubernetes object to reference.                                                                                                                                |
+| [24] | `kind`            | Kind of the kubernetes object to reference.                                                                                                                                 |
+| [25] | `name`            | Name of the kubernetes object to reference.                                                                                                                                 |
+| [26] | `type`            | Defines the type of filter; RequestRedirect redirects a request to another location.                                                                                        |
+| [27] | `requestRedirect` | Configuration of redirect filter.                                                                                                                                           |
+| [28] | `scheme`          | Scheme is the scheme to be used in the value of the Location header in the response.                                                                                        |
+| [29] | `statusCode`      | StatusCode is the HTTP status code to be used in response.                                                                                                                  |
 
 ### Kind: `TCPRoute`
 

docs/content/routing/routers/index.md

@@ -442,6 +442,14 @@ The priority is directly equal to the length of the rule, and so the longest len
 
 A value of `0` for the priority is ignored: `priority = 0` means that the default rules length sorting is used.
 
+??? warning "Maximum Value"
+  
+    Traefik reserves a range of priorities for its internal routers,
+    the maximum user-defined router priority value is:
+
+      - `(MaxInt32 - 1000)` for 32-bit platforms,
+      - `(MaxInt64 - 1000)` for 64-bit platforms.
+
 ??? info "How default priorities are computed"
 
     ```yaml tab="File (YAML)"
@@ -1148,6 +1156,14 @@ The priority is directly equal to the length of the rule, and so the longest len
 
 A value of `0` for the priority is ignored: `priority = 0` means that the default rules length sorting is used.
 
+??? warning "Maximum Value"
+
+    Traefik reserves a range of priorities for its internal routers,
+    the maximum user-defined router priority value is:
+
+      - `(MaxInt32 - 1000)` for 32-bit platforms,
+      - `(MaxInt64 - 1000)` for 64-bit platforms.
+
 ??? info "How default priorities are computed"
 
     ```yaml tab="File (YAML)"

go.mod

@@ -61,7 +61,7 @@ require (
 	github.com/tidwall/gjson v1.17.0
 	github.com/traefik/grpc-web v0.16.0
 	github.com/traefik/paerser v0.2.0
-	github.com/traefik/yaegi v0.15.1
+	github.com/traefik/yaegi v0.16.1
 	github.com/unrolled/render v1.0.2
 	github.com/unrolled/secure v1.0.9
 	github.com/vulcand/oxy/v2 v2.0.0-20230427132221-be5cf38f3c1c

go.sum

@@ -1097,8 +1097,8 @@ github.com/traefik/grpc-web v0.16.0 h1:eeUWZaFg6ZU0I9dWOYE2D5qkNzRBmXzzuRlxdltas
 github.com/traefik/grpc-web v0.16.0/go.mod h1:2ttniSv7pTgBWIU2HZLokxRfFX3SA60c/DTmQQgVml4=
 github.com/traefik/paerser v0.2.0 h1:zqCLGSXoNlcBd+mzqSCLjon/I6phqIjeJL2xFB2ysgQ=
 github.com/traefik/paerser v0.2.0/go.mod h1:afzaVcgF8A+MpTnPG4wBr4whjanCSYA6vK5RwaYVtRc=
-github.com/traefik/yaegi v0.15.1 h1:YA5SbaL6HZA0Exh9T/oArRHqGN2HQ+zgmCY7dkoTXu4=
+github.com/traefik/yaegi v0.16.1 h1:f1De3DVJqIDKmnasUF6MwmWv1dSEEat0wcpXhD2On3E=
-github.com/traefik/yaegi v0.15.1/go.mod h1:AVRxhaI2G+nUsaM1zyktzwXn69G3t/AuTDrCiTds9p0=
+github.com/traefik/yaegi v0.16.1/go.mod h1:4eVhbPb3LnD2VigQjhYbEJ69vDRFdT2HQNrXx8eEwUY=
 github.com/transip/gotransip/v6 v6.23.0 h1:PsTdjortrEZ8IFFifEryzjVjOy9SgK4ahlnhKBBIQgA=
 github.com/transip/gotransip/v6 v6.23.0/go.mod h1:nzv9eN2tdsUrm5nG5ZX6AugYIU4qgsMwIn2c0EZLk8c=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=

integration/fixtures/k8s_gateway.toml

@@ -27,3 +27,4 @@
     address = ":8443"
 
 [providers.kubernetesGateway]
+    experimentalChannel = true

integration/fixtures/tcp/service_errors.toml

@@ -24,10 +24,12 @@
   [tcp.routers.router1]
     service = "service1"
     rule = "HostSNI(`snitest.net`)"
+    [tcp.routers.router1.tls]
 
   [tcp.routers.router2]
     service = "service2"
     rule = "HostSNI(`snitest.com`)"
+    [tcp.routers.router2.tls]
 
 [tcp.services]
   [tcp.services.service1]

integration/https_test.go

@@ -1134,8 +1134,6 @@ func (s *HTTPSSuite) TestWithDomainFronting() {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		req, err := http.NewRequest(http.MethodGet, "https://127.0.0.1:4443", nil)
 		require.NoError(s.T(), err)
 		req.Host = test.hostHeader
@@ -1179,8 +1177,6 @@ func (s *HTTPSSuite) TestWithInvalidTLSOption() {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		tlsConfig := &tls.Config{
 			InsecureSkipVerify: true,
 		}

pkg/api/dashboard/dashboard.go

@@ -39,7 +39,7 @@ func Append(router *mux.Router, customAssets fs.FS) {
 			// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
 			w.Header().Del("Content-Type")
 
-			http.StripPrefix("/dashboard/", http.FileServer(http.FS(assets))).ServeHTTP(w, r)
+			http.StripPrefix("/dashboard/", http.FileServerFS(assets)).ServeHTTP(w, r)
 		})
 }
 
@@ -56,7 +56,7 @@ func (g Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
 	w.Header().Del("Content-Type")
 
-	http.FileServer(http.FS(assets)).ServeHTTP(w, r)
+	http.FileServerFS(assets).ServeHTTP(w, r)
 }
 
 func safePrefix(req *http.Request) string {

pkg/api/dashboard/dashboard_test.go

@@ -42,7 +42,6 @@ func Test_safePrefix(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -91,7 +90,6 @@ func Test_ContentSecurityPolicy(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/api/handler_entrypoint_test.go

@@ -210,7 +210,6 @@ func TestHandler_EntryPoints(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/api/handler_http_test.go

@@ -998,7 +998,6 @@ func TestHandler_HTTP(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/api/handler_overview_test.go

@@ -269,7 +269,6 @@ func TestHandler_Overview(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/api/handler_tcp_test.go

@@ -874,7 +874,6 @@ func TestHandler_TCP(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/api/handler_test.go

@@ -127,7 +127,6 @@ func TestHandler_RawData(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -252,7 +251,6 @@ func TestHandler_GetMiddleware(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/api/handler_udp_test.go

@@ -564,7 +564,6 @@ func TestHandler_UDP(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/api/sort_test.go

@@ -828,7 +828,6 @@ func TestSortRouters(t *testing.T) {
 		},
 	}
 	for _, test := range testCases {
-		test := test
 		t.Run(fmt.Sprintf("%s-%s", test.direction, test.sortBy), func(t *testing.T) {
 			t.Parallel()
 
@@ -1339,7 +1338,6 @@ func TestSortServices(t *testing.T) {
 		},
 	}
 	for _, test := range testCases {
-		test := test
 		t.Run(fmt.Sprintf("%s-%s", test.direction, test.sortBy), func(t *testing.T) {
 			t.Parallel()
 
@@ -1674,7 +1672,6 @@ func TestSortMiddlewares(t *testing.T) {
 		},
 	}
 	for _, test := range testCases {
-		test := test
 		t.Run(fmt.Sprintf("%s-%s", test.direction, test.sortBy), func(t *testing.T) {
 			t.Parallel()
 

pkg/cli/deprecation_test.go

@@ -267,7 +267,6 @@ func TestDeprecationNotice(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -385,7 +384,6 @@ func TestLoad(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			tconfig := cmd.NewTraefikConfiguration()
 			c := &cli.Command{Configuration: tconfig}

pkg/collector/collector.go

@@ -65,7 +65,7 @@ func createBody(staticConfiguration *static.Configuration) (*bytes.Buffer, error
 	}
 
 	buf := new(bytes.Buffer)
-	err = json.NewEncoder(buf).Encode(data) //nolint:musttag // cannot be changed for historical reasons.
+	err = json.NewEncoder(buf).Encode(data)
 	if err != nil {
 		return nil, err
 	}

pkg/config/kv/kv_node_test.go

@@ -244,7 +244,6 @@ func TestDecodeToNode(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/config/kv/kv_test.go

@@ -87,7 +87,6 @@ func TestDecode(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/config/runtime/runtime_http_test.go

@@ -208,7 +208,6 @@ func TestGetRoutersByEntryPoints(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 			runtimeConfig := NewConfig(test.conf)

pkg/config/runtime/runtime_tcp_test.go

@@ -208,7 +208,6 @@ func TestGetTCPRoutersByEntryPoints(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 			runtimeConfig := NewConfig(test.conf)

pkg/config/runtime/runtime_test.go

@@ -665,8 +665,6 @@ func TestPopulateUsedBy(t *testing.T) {
 		},
 	}
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/config/runtime/runtime_udp_test.go

@@ -189,7 +189,6 @@ func TestGetUDPRoutersByEntryPoints(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 			runtimeConfig := NewConfig(test.conf)

pkg/config/static/static_config.go

@@ -288,6 +288,10 @@ func (c *Configuration) SetEffectiveConfiguration() {
 			entryPoints[epName] = gateway.Entrypoint{Address: entryPoint.GetAddress(), HasHTTPTLSConf: entryPoint.HTTP.TLS != nil}
 		}
 
+		if c.Providers.KubernetesCRD != nil {
+			c.Providers.KubernetesCRD.FillExtensionBuilderRegistry(c.Providers.KubernetesGateway)
+		}
+
 		c.Providers.KubernetesGateway.EntryPoints = entryPoints
 	}
 

pkg/config/static/static_config_test.go

@@ -26,7 +26,6 @@ func TestHasEntrypoint(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/healthcheck/healthcheck_test.go

@@ -243,7 +243,6 @@ func TestServiceHealthChecker_newRequest(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -405,7 +404,6 @@ func TestServiceHealthChecker_Launch(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/ip/checker_test.go

@@ -36,7 +36,6 @@ func TestIsAuthorized(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -117,7 +116,6 @@ func TestNew(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -289,7 +287,6 @@ func TestContainsIsAllowed(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/ip/strategy_test.go

@@ -21,7 +21,6 @@ func TestRemoteAddrStrategy_GetIP(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -61,7 +60,6 @@ func TestDepthStrategy_GetIP(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -109,7 +107,6 @@ func TestTrustedIPsStrategy_GetIP(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/metrics/datadog_test.go

@@ -67,7 +67,6 @@ func TestDatadog_parseDatadogAddress(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/metrics/opentelemetry_test.go

@@ -89,8 +89,6 @@ func TestOpenTelemetry_labels(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -181,8 +179,6 @@ func TestOpenTelemetry_GaugeCollectorAdd(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -275,8 +271,6 @@ func TestOpenTelemetry_GaugeCollectorSet(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/metrics/prometheus_test.go

@@ -64,7 +64,6 @@ func TestRegisterPromState(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			actualNbRegistries := 0
 			for _, prom := range test.prometheusSlice {
@@ -381,7 +380,6 @@ func TestPrometheus(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			family := findMetricFamily(test.name, metricsFamilies)
 			if family == nil {

pkg/middlewares/accesslog/logger_formatters_test.go

@@ -86,7 +86,6 @@ func TestCommonLogFormatter_Format(t *testing.T) {
 	t.Setenv("TZ", "Etc/GMT+9")
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -150,7 +149,6 @@ func Test_toLog(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/accesslog/logger_test.go

@@ -180,7 +180,6 @@ func TestLoggerHeaderFields(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			logFile, err := os.CreateTemp(t.TempDir(), "*.log")
 			require.NoError(t, err)
@@ -469,7 +468,6 @@ func TestLoggerJSON(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -687,7 +685,6 @@ func TestNewLogHandlerOutputStdout(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			// NOTE: It is not possible to run these cases in parallel because we capture Stdout
 

pkg/middlewares/accesslog/parser_test.go

@@ -60,7 +60,6 @@ func TestParseAccessLog(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/accesslog/save_retries_test.go

@@ -28,8 +28,6 @@ func TestSaveRetries(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
-
 		t.Run(fmt.Sprintf("%d retries", test.requestAttempt), func(t *testing.T) {
 			t.Parallel()
 			saveRetries := &SaveRetries{}

pkg/middlewares/addprefix/add_prefix_test.go

@@ -29,7 +29,6 @@ func TestNewAddPrefix(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -75,7 +74,6 @@ func TestAddPrefix(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/auth/basic_auth_test.go

@@ -210,7 +210,6 @@ func TestBasicAuthUsersFromFile(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/auth/digest_auth_test.go

@@ -88,7 +88,6 @@ func TestDigestAuthUsersFromFile(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/buffering/buffering_test.go

@@ -48,7 +48,6 @@ func TestBuffering(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/compress/brotli/brotli_test.go

@@ -88,7 +88,6 @@ func Test_NoBody(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -347,7 +346,6 @@ func Test_ExcludedContentTypes(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -452,7 +450,6 @@ func Test_IncludedContentTypes(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -557,7 +554,6 @@ func Test_FlushExcludedContentTypes(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -676,7 +672,6 @@ func Test_FlushIncludedContentTypes(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -831,8 +826,6 @@ func TestParseContentType_equals(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/compress/compress_test.go

@@ -74,8 +74,6 @@ func TestNegotiation(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -299,7 +297,6 @@ func TestShouldNotCompressWhenSpecificContentType(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -351,7 +348,6 @@ func TestShouldCompressWhenSpecificContentType(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -547,8 +543,6 @@ func TestMinResponseBodyBytes(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/connectionheader/connectionheader_test.go

@@ -47,7 +47,6 @@ func TestRemover(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/contenttype/content_type_test.go

@@ -46,7 +46,6 @@ func TestAutoDetection(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/customerrors/custom_errors_test.go

@@ -157,7 +157,6 @@ func TestHandler(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/forwardedheaders/forwarded_header_test.go

@@ -272,7 +272,6 @@ func TestServeHTTP(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -369,7 +368,6 @@ func Test_isWebsocketRequest(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/headers/header_test.go

@@ -52,7 +52,6 @@ func TestNewHeader_customRequestHeader(t *testing.T) {
 	emptyHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/headers/headers_test.go

@@ -59,7 +59,6 @@ func TestNew_allowedHosts(t *testing.T) {
 	require.NoError(t, err)
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/headers/secure_test.go

@@ -67,7 +67,6 @@ func Test_newSecure_modifyResponse(t *testing.T) {
 	emptyHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) })
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/ipallowlist/ip_allowlist_test.go

@@ -41,7 +41,6 @@ func TestNewIPAllowLister(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -102,7 +101,6 @@ func TestIPAllowLister_ServeHTTP(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/ipwhitelist/ip_whitelist_test.go

@@ -33,7 +33,6 @@ func TestNewIPWhiteLister(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -76,7 +75,6 @@ func TestIPWhiteLister_ServeHTTP(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/metrics/metrics_test.go

@@ -80,7 +80,6 @@ func Test_getMethod(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.method, func(t *testing.T) {
 			t.Parallel()
 
@@ -132,7 +131,6 @@ func Test_getRequestProtocol(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -175,7 +173,6 @@ func Test_grpcStatusCode(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/observability/entrypoint_test.go

@@ -122,7 +122,6 @@ func TestEntryPointMiddleware_metrics(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/passtlsclientcert/pass_tls_client_cert_test.go

@@ -310,7 +310,6 @@ func TestPassTLSClientCert_PEM(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -533,7 +532,6 @@ func TestPassTLSClientCert_certInfo(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -604,7 +602,6 @@ WqeUSNGYV//RunTeuRDAf5OxehERb1srzBXhRZ3cZdzXbgR/`,
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -645,7 +642,6 @@ func Test_getSANs(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/ratelimiter/rate_limiter_test.go

@@ -89,7 +89,6 @@ func TestNewRateLimiter(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -248,7 +247,6 @@ func TestRateLimit(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			if test.loadDuration >= time.Minute && testing.Short() {
 				t.Skip("skipping test in short mode.")

pkg/middlewares/redirect/redirect_regex_test.go

@@ -154,7 +154,6 @@ func TestRedirectRegexHandler(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/redirect/redirect_scheme_test.go

@@ -283,8 +283,6 @@ func TestRedirectSchemeHandler(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/replacepathregex/replace_path_regex.go

@@ -52,7 +52,7 @@ func (rp *replacePathRegex) ServeHTTP(rw http.ResponseWriter, req *http.Request)
 		currentPath = req.URL.EscapedPath()
 	}
 
-	if rp.regexp != nil && len(rp.replacement) > 0 && rp.regexp.MatchString(currentPath) {
+	if rp.regexp != nil && rp.regexp.MatchString(currentPath) {
 		req.Header.Add(replacepath.ReplacedPathHeader, currentPath)
 		req.URL.RawPath = rp.regexp.ReplaceAllString(currentPath, rp.replacement)
 

pkg/middlewares/replacepathregex/replace_path_regex_test.go

@@ -44,6 +44,28 @@ func TestReplacePathRegex(t *testing.T) {
 			expectedRawPath: "/who-am-i/and/who-am-i",
 			expectedHeader:  "/whoami/and/whoami",
 		},
+		{
+			desc: "empty replacement",
+			path: "/whoami/and/whoami",
+			config: dynamic.ReplacePathRegex{
+				Replacement: "",
+				Regex:       `/whoami`,
+			},
+			expectedPath:    "/and",
+			expectedRawPath: "/and",
+			expectedHeader:  "/whoami/and/whoami",
+		},
+		{
+			desc: "empty trimmed replacement",
+			path: "/whoami/and/whoami",
+			config: dynamic.ReplacePathRegex{
+				Replacement: " ",
+				Regex:       `/whoami`,
+			},
+			expectedPath:    "/and",
+			expectedRawPath: "/and",
+			expectedHeader:  "/whoami/and/whoami",
+		},
 		{
 			desc: "no match",
 			path: "/whoami/and/whoami",

pkg/middlewares/requestdecorator/hostresolver_test.go

@@ -35,7 +35,6 @@ func TestCNAMEFlatten(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/requestdecorator/request_decorator_test.go

@@ -38,7 +38,6 @@ func TestRequestHost(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -80,7 +79,6 @@ func TestRequestFlattening(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -173,7 +171,6 @@ func Test_parseHost(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/retry/retry_test.go

@@ -101,7 +101,6 @@ func TestRetry(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -272,7 +271,6 @@ func TestRetryWebsocket(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/snicheck/snicheck_test.go

@@ -37,7 +37,6 @@ func TestSNICheck_ServeHTTP(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/stripprefix/strip_prefix_test.go

@@ -134,7 +134,6 @@ func TestStripPrefix(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/stripprefixregex/strip_prefix_regex_test.go

@@ -108,7 +108,6 @@ func TestStripPrefixRegex(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.path, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/tcp/ipallowlist/ip_allowlist_test.go

@@ -39,7 +39,6 @@ func TestNewIPAllowLister(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -81,7 +80,6 @@ func TestIPAllowLister_ServeHTTP(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/middlewares/tcp/ipwhitelist/ip_whitelist_test.go

@@ -39,7 +39,6 @@ func TestNewIPWhiteLister(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -81,7 +80,6 @@ func TestIPWhiteLister_ServeHTTP(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/muxer/http/matcher_test.go

@@ -65,7 +65,6 @@ func TestClientIPMatcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -139,7 +138,6 @@ func TestMethodMatcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -257,7 +255,6 @@ func TestHostMatcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -357,7 +354,6 @@ func TestHostRegexpMatcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -431,7 +427,6 @@ func TestPathMatcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -524,7 +519,6 @@ func TestPathRegexpMatcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -596,7 +590,6 @@ func TestPathPrefixMatcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -683,8 +676,6 @@ func TestHeaderMatcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -792,7 +783,6 @@ func TestHeaderRegexpMatcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -881,7 +871,6 @@ func TestQueryMatcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -995,7 +984,6 @@ func TestQueryRegexpMatcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/muxer/http/matcher_v2.go

@@ -25,15 +25,21 @@ var httpFuncsV2 = map[string]func(*matchersTree, ...string) error{
 }
 
 func pathV2(tree *matchersTree, paths ...string) error {
+	var routes []*mux.Route
+
 	for _, path := range paths {
-		if !strings.HasPrefix(path, "/") {
+		route := mux.NewRouter().NewRoute()
-			return fmt.Errorf("path %q does not start with a '/'", path)
+
+		if err := route.Path(path).GetError(); err != nil {
+			return err
 		}
+
+		routes = append(routes, route)
 	}
 
 	tree.matcher = func(req *http.Request) bool {
-		for _, path := range paths {
+		for _, route := range routes {
-			if req.URL.Path == path {
+			if route.Match(req, &mux.RouteMatch{}) {
 				return true
 			}
 		}
@@ -45,15 +51,21 @@ func pathV2(tree *matchersTree, paths ...string) error {
 }
 
 func pathPrefixV2(tree *matchersTree, paths ...string) error {
+	var routes []*mux.Route
+
 	for _, path := range paths {
-		if !strings.HasPrefix(path, "/") {
+		route := mux.NewRouter().NewRoute()
-			return fmt.Errorf("path %q does not start with a '/'", path)
+
+		if err := route.PathPrefix(path).GetError(); err != nil {
+			return err
 		}
+
+		routes = append(routes, route)
 	}
 
 	tree.matcher = func(req *http.Request) bool {
-		for _, path := range paths {
+		for _, route := range routes {
-			if strings.HasPrefix(req.URL.Path, path) {
+			if route.Match(req, &mux.RouteMatch{}) {
 				return true
 			}
 		}

pkg/muxer/http/matcher_v2_test.go

@@ -69,7 +69,6 @@ func TestClientIPV2Matcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -146,7 +145,6 @@ func TestMethodV2Matcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -271,7 +269,6 @@ func TestHostV2Matcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -374,7 +371,6 @@ func TestHostRegexpV2Matcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -454,10 +450,21 @@ func TestPathV2Matcher(t *testing.T) {
 				"https://example.com/css/main.css": http.StatusNotFound,
 			},
 		},
+		{
+			desc: "valid Path matcher with regexp",
+			rule: "Path(`/css{path:(/.*)?}`)",
+			expected: map[string]int{
+				"https://example.com":                              http.StatusNotFound,
+				"https://example.com/css/main.css":                 http.StatusOK,
+				"https://example.org/css/main.css":                 http.StatusOK,
+				"https://example.com/css/components/component.css": http.StatusOK,
+				"https://example.com/css.css":                      http.StatusNotFound,
+				"https://example.com/js/main.js":                   http.StatusNotFound,
+			},
+		},
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -535,10 +542,21 @@ func TestPathPrefixV2Matcher(t *testing.T) {
 				"https://example.com/css/main.css": http.StatusOK,
 			},
 		},
+		{
+			desc: "valid PathPrefix matcher with regexp",
+			rule: "PathPrefix(`/css-{name:[0-9]?}`)",
+			expected: map[string]int{
+				"https://example.com":                                     http.StatusNotFound,
+				"https://example.com/css-1/main.css":                      http.StatusOK,
+				"https://example.org/css-222/main.css":                    http.StatusOK,
+				"https://example.com/css-333333/components/component.css": http.StatusOK,
+				"https://example.com/css.css":                             http.StatusNotFound,
+				"https://example.com/js/main.js":                          http.StatusNotFound,
+			},
+		},
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -625,8 +643,6 @@ func TestHeadersMatcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -734,7 +750,6 @@ func TestHeaderRegexpV2Matcher(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -827,7 +842,6 @@ func TestHostRegexp(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -1495,8 +1509,6 @@ func Test_addRoute(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/muxer/http/mux_test.go

@@ -222,8 +222,6 @@ func TestMuxer(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -378,14 +376,12 @@ func Test_addRoutePriority(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 			muxer, err := NewMuxer()
 			require.NoError(t, err)
 
 			for _, route := range test.cases {
-				route := route
 				handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 					w.Header().Set("X-From", route.xFrom)
 				})
@@ -446,7 +442,6 @@ func TestParseDomains(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.expression, func(t *testing.T) {
 			t.Parallel()
 
@@ -511,7 +506,6 @@ func TestEmptyHost(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -550,7 +544,6 @@ func TestGetRulePriority(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/muxer/tcp/matcher_test.go

@@ -31,7 +31,6 @@ func Test_HostSNICatchAll(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -137,7 +136,6 @@ func Test_HostSNI(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -220,7 +218,6 @@ func Test_HostSNIRegexp(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -292,7 +289,6 @@ func Test_ClientIP(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -356,7 +352,6 @@ func Test_ALPN(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/muxer/tcp/matcher_v2_test.go

@@ -461,8 +461,6 @@ func Test_addTCPRouteV2(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -561,7 +559,6 @@ func TestParseHostSNIV2(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.expression, func(t *testing.T) {
 			t.Parallel()
 
@@ -606,8 +603,6 @@ func Test_HostSNICatchAllV2(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -708,8 +703,6 @@ func Test_HostSNIV2(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -823,8 +816,6 @@ func Test_HostSNIRegexpV2(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -916,8 +907,6 @@ func Test_ClientIPV2(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -985,8 +974,6 @@ func Test_ALPNV2(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/muxer/tcp/mux_test.go

@@ -263,8 +263,6 @@ func Test_addTCPRoute(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -373,7 +371,6 @@ func TestParseHostSNI(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -436,8 +433,6 @@ func Test_Priority(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -446,7 +441,6 @@ func Test_Priority(t *testing.T) {
 
 			matchedRule := ""
 			for rule, priority := range test.rules {
-				rule := rule
 				err := muxer.AddRoute(rule, "", priority, tcp.HandlerFunc(func(conn tcp.WriteCloser) {
 					matchedRule = rule
 				}))
@@ -488,7 +482,6 @@ func TestGetRulePriority(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/provider/acme/local_store_test.go

@@ -44,7 +44,6 @@ func TestLocalStore_GetAccount(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			s := NewLocalStore(test.filename)
 

pkg/provider/acme/provider_test.go

@@ -166,7 +166,6 @@ func TestGetUncheckedCertificates(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -241,7 +240,6 @@ func TestProvider_sanitizeDomains(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -423,7 +421,6 @@ func TestDeleteUnnecessaryDomains(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -497,7 +494,6 @@ func TestIsAccountMatchingCaServer(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -573,7 +569,6 @@ func TestInitAccount(t *testing.T) {
 		},
 	}
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -632,7 +627,6 @@ func Test_getCertificateRenewDurations(t *testing.T) {
 		},
 	}
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/provider/aggregator/aggregator.go

@@ -179,7 +179,6 @@ func (p ProviderAggregator) Provide(configurationChan chan<- dynamic.Message, po
 	}
 
 	for _, prd := range p.providers {
-		prd := prd
 		safe.Go(func() {
 			p.launchProvider(configurationChan, pool, prd)
 		})

pkg/provider/constraints/constraints_labels_test.go

@@ -161,7 +161,6 @@ func TestMatchLabels(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.expr, func(t *testing.T) {
 			t.Parallel()
 

pkg/provider/constraints/constraints_tags_test.go

@@ -95,7 +95,6 @@ func TestMatchTags(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.expr, func(t *testing.T) {
 			t.Parallel()
 

pkg/provider/consulcatalog/config_test.go

@@ -298,7 +298,6 @@ func TestDefaultRule(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -3347,8 +3346,6 @@ func Test_buildConfiguration(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -3414,8 +3411,6 @@ func TestNamespaces(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -3864,7 +3859,6 @@ func TestFilterHealthStatuses(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/provider/consulcatalog/convert_types_test.go

@@ -52,7 +52,6 @@ func Test_tagsToNeutralLabels(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 

pkg/provider/docker/config_test.go

@@ -395,7 +395,6 @@ func TestDynConfBuilder_DefaultRule(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -3649,8 +3648,6 @@ func TestDynConfBuilder_build(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -3837,7 +3834,6 @@ func TestDynConfBuilder_getIPPort_docker(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -3950,7 +3946,6 @@ func TestDynConfBuilder_getIPAddress_docker(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -4020,7 +4015,6 @@ func TestDynConfBuilder_getIPAddress_swarm(t *testing.T) {
 	}
 
 	for serviceID, test := range testCases {
-		test := test
 		t.Run(strconv.Itoa(serviceID), func(t *testing.T) {
 			t.Parallel()
 

pkg/provider/docker/pswarm.go

@@ -187,8 +187,7 @@ func (p *SwarmProvider) listServices(ctx context.Context, dockerClient client.AP
 
 	networkMap := make(map[string]*dockertypes.NetworkResource)
 	for _, network := range networkList {
-		networkToAdd := network
+		networkMap[network.ID] = &network
-		networkMap[network.ID] = &networkToAdd
 	}
 
 	var dockerDataList []dockerData

pkg/provider/docker/pswarm_test.go

@@ -63,7 +63,6 @@ func TestListTasks(t *testing.T) {
 	}
 
 	for caseID, test := range testCases {
-		test := test
 		t.Run(strconv.Itoa(caseID), func(t *testing.T) {
 			t.Parallel()
 
@@ -230,7 +229,6 @@ func TestSwarmProvider_listServices(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -351,7 +349,6 @@ func TestSwarmProvider_parseService_task(t *testing.T) {
 	}
 
 	for caseID, test := range testCases {
-		test := test
 		t.Run(strconv.Itoa(caseID), func(t *testing.T) {
 			t.Parallel()