ServersTransport

A ServersTransport allows you to configure the connection between Traefik and the HTTP servers in Kubernetes.

Before creating ServersTransport objects, you need to apply the Traefik Kubernetes CRDs to your Kubernetes cluster.

This registers the ServersTransport kind and other Traefik-specific resources.

It can be applied on a service using:

The option services.serverstransport on a IngressRoute (if the service is a Kubernetes Service)
The option serverstransport on a TraefikService (if the service is a Kubernetes Service)

Reference a ServersTransport CRD from another namespace

The value must be of form namespace-name@kubernetescrd, and the allowCrossNamespace option must be enabled at the provider level.

Configuration Example¶

serversTransport

apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
  name: mytransport
  namespace: default

spec:
  serverName: example.org
  insecureSkipVerify: true

IngressRoute

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: testroute
  namespace: default

spec:
  entryPoints:
    - web
  routes:
  - match: Host(`example.com`)
    kind: Rule
    services:
    - name: whoami
      port: 80
      serversTransport: mytransport

Configuration Options¶

Field	Description	Default	Required
`serverstransport.` `serverName`	Defines the server name that will be used for SNI.		No
`serverstransport.` `insecureSkipVerify`	Controls whether the server's certificate chain and host name is verified.	false	No
`serverstransport.` `rootcas`	Set of root certificate authorities to use when verifying server certificates. (for mTLS connections).		No
`serverstransport.` `certificatesSecrets`	Certificates to present to the server for mTLS.		No
`serverstransport.` `maxIdleConnsPerHost`	Maximum idle (keep-alive) connections to keep per-host.	200	No
`serverstransport.` `disableHTTP2`	Disables HTTP/2 for connections with servers.	false	No
`serverstransport.` `peerCertURI`	Defines the URI used to match against SAN URIs during the server's certificate verification.	""	No
`serverstransport.` `forwardingTimeouts.dialTimeout`	Amount of time to wait until a connection to a server can be established. Zero means no timeout.	30s	No
`serverstransport.` `forwardingTimeouts.responseHeaderTimeout`	Amount of time to wait for a server's response headers after fully writing the request (including its body, if any). Zero means no timeout	0s	No
`serverstransport.` `forwardingTimeouts.idleConnTimeout`	Maximum amount of time an idle (keep-alive) connection will remain idle before closing itself. Zero means no timeout.	90s	No
`serverstransport.` `spiffe.ids`	Allow SPIFFE IDs. This takes precedence over the SPIFFE TrustDomain.		No
`serverstransport.` `spiffe.trustDomain`	Allow SPIFFE trust domain.	""	No

CA Secret

The CA secret must contain a base64 encoded certificate under either a tls.ca or a ca.crt key.