1 Commits

Author	SHA256	Message	Date
Johannes Weberhofer	71062aa4fe	Accepting request 1302155 from home:weberho:branches:devel:kubic ... - Removed old update scripts which fixes boo#1245204 for traefik reloease v3. - Version 3.5.1 Bug fixes: * accesslogs,otel - Provide Log Body in OTEL access Log * acme - Bump github.com/go-acme/lego/v4 to v4.25.2 * k8s/gatewayapi - Make app protocol case insensitive * otel - Fix misspelling in docs * server - Bump to github.com/pires/go-proxyproto v0.8.1 - Silent expected errors on receiving sigterm signal * tracing - Fix capturedRequestHeaders and capturedResponseHeaders headers options not being canonicalized in tracing - Follow OTel semantic conventions for root span naming * webui - Update Traefik Proxy dashboard UI development deps * docker - Bump github.com/docker/docker to v28.3.3 (#12007 by kevinpollet) * Refactor to use reflect.TypeFor - Version 3.5.0 Please read the migration guide: https://doc.traefik.io/traefik/migration/v3/#v350 Enhancements: * acme - Add acme.httpChallenge.delay option - Allow configuration of ACME provider http timeout - OCSP stapling * healthcheck - Add unhealthy Interval to the health check configuration - Add url option to healthcheck command * k8s/gatewayapi - Bump sigs.k8s.io/gateway-api to v1.3.0 * k8s/ingress - Make the behavior of prefix matching in Ingress consistent with Kubernetes doc * k8s - NGINX Ingress Provider * middleware,authentication - Handle context canceled in ForwardAuth middleware * plugins - Ability to enable unsafe in yaegi through plugin manifest * tls - Introduce X25519MLKEM768 for Post-Quantum-Secure TLS * webui - Improve visualization for StatusRewrites option of errors middleware - Migrate Traefik Proxy dashboard UI to React Bug fixes: * healthcheck - Revert 11711 adding url param to healthcheck command * logs,metrics,tracing,accesslogs,otel - Add missing resource attributes detectors * logs,tracing,k8s,otel - Add k8s resource attributes automatically * metrics,otel - Add resourceAttributes option to OTel metrics * middleware,tracing - Introduce trace verbosity config and produce less spans by default - Synchronized changelog with boo tickets and cve entries - Version 3.4.5 * logs - Redact logged install configuration (gh#traefik/traefik#11907 by jspdown) * plugins - Fix client arbitrary file access during archive extraction zipslip (gh#traefik/traefik#11911 by odaysec) * server - Disable MPTCP by default (gh#traefik/traefik#11918 by rtribotte) * http3 - Bump github.com/quic-go/quic-go to v0.54.0 (gh#traefik/traefik#11919 by GreyXor) - Fixed boo#1246094 bad logrotate configuration allows potential escalation from traefik to root - Disabled MPTCP which caused issues (see gh#traefik/traefik#11869 - Version 3.4.4 - k8s/gatewayapi * Respect service.nativelb=false annotation when nativeLBByDefault is enabled (gh#traefik/traefik#11847 by sdelicata) - service * Fix concurrent access to balancer status map in WRR and P2C strategies (gh#traefik/traefik#11887 by kevinpollet) - Version 3.4.3 - http3 * Bump quic-go to v.0.49.0 - middleware * Do not log redis sentinel username and password - Improved logging - Added logrotate configuration - Allow reloading the traefik-service via systemctl - Removed manual download service and manual checksum verification - Version 3.4.1 - fix for CVE-2025-47952 boo#1243818 - docker * Do not warn network missing if connected to a container network (#11698 by holysoles) - k8s/crd * Fix CEL validation for RootCA in ServersTransport (#11775 by rtribotte) - middleware * Scope the rate limit counter key by source and by middleware (#11753 by aromeyer) - server * Use routing path in v3 matchers (#11790 by kevinpollet) - service * Make P2C strategy thread-safe (#11762 by lbenguigui) - webui * Do not display RemoveHeader option when not defined (#11782 by kevinpollet) - Important: please read the migration guide in regards to v3.4.0 changes - Version 3.4.0 changes - acme * Add acme.profile and acme.emailAddresses options (#11597 by ldez) - docker,ecs,docker/swarm,consulcatalog,nomad * Allow configuring server URLs with label providers (#11374 by yelvert) - k8s/crd * Improve CEL validation on Ingress CRD resources (#11311 by mloiseleur) * Remove default load-balancing strategy from CRD (#11701 by kevinpollet) * Restrict regex validation of HTTP status codes for Ingress CRD resources (#11670 by jnoordsij) - k8s/gatewayapi * Set rule priority in Gateway API TLSRoute (#11443 by augustozanellato) - k8s/ingress * Add ingress status for ClusterIP and NodePort Service Type (#11100 by mlec1) - middleware,authentication * Add option to preserve request method in forwardAuth (#11473 by an09mous) - middleware * Support rewriting status codes in error page middleware (#11520 by sevensolutions) * Add Redis rate limiter (#10211 by longquan0104) - service * Add p2c load-balancing strategy for servers load-balancer (#11547 by rtribotte) - sticky-session * Support domain configuration for sticky cookies (#11556 by jleal52) - tls,k8s/crd,service * Allow root CA to be added through config maps (#11475 by Nelwhix) - tls * Add support to disable session ticket (#11609 by avdhoot) - udp * Add support for UDP routing in systemd socket activation (#11022 by tsiid) - webui * Add auto webui theme option and default to it (#11455 by zizzfizzix) - Replace experimental maps and slices with stdlib (#11350 by Juneezee) - Bump github.com/redis/go-redis/v9 to v9.7.3 (#11687 by kevinpollet) - Important: Please read the migration guide in regards to v3.3.6 changes - Version 3.3.6 changes * The incoming request path is now cleaned before being used to match the router rules and sent to the backends. Any /../, /./ or duplicate slash segments in the request path is interpreted and/or collapsed. * Bump golang.org/x/net to v0.38.0 Fix for boo#1241731 and boo#1241733: CVE-2025-22872 - Bump golang.org/x/oauth2 to v0.28.0 Fix for boo#1239228 CVE-2025-22868 - Please read the migration guide in regards to v3.3.5 changes - Version 3.3.5 changes - k8s/gatewayapi * Set scheme to https with BackendTLSPolicy (#11586 by rtribotte) - middleware * Revert compress middleware algorithms priority to v2 behavior (#11641 by rtribotte) * Do not abort request when response content-type is malformed (#11628 by kevinpollet) * Compress data on flush when compression is not started (#11583 by kevinpollet) * Updates - Bump github.com/go-jose/go-jose/v4 to v4.0.5 fix boo#1237621 CVE-2025-27144 - Bump github.com/golang-jwt/jwt to v4.5.2 and v5.2.2 fix boo#1240454 CVE-2025-30204 - Bump x/crypto to v0.35.0 fix for boo#1239383 CVE-2025-22869, boo#1239363 CVE-2025-22869 - Change traefik user's home directory to /var/lib/traefik. This will allow traefik to store data for plugins from https://plugins.traefik.io/plugins without permission issues This change will reflect on existing installations automatically - Version 3.3.4 changes - fastproxy * Bump github.com/valyala/fasthttp to v1.58.0 (#11526 by kevinpollet) * Add WebSocket headers if they are present in the request (#11522 by kevinpollet) * Chunked responses does not have a Content-Length header (#11514 by kevinpollet) - metrics, otel * Change request duration metric unit from millisecond to second (#11523 by rtribotte) - sticky-session * Fix double hash in sticky cookie (#11518 by juliens) - tracing * Use ResourceAttributes instead of GlobalAttributes (#11515 by bruno-de-queiroz) * Fix panic when calling Tracer (#11479 by basgys) - Upgrade fixed boo#1235167 - Package mentioned in boo#1235270 CVE-2024-45338 has been upgraded - Version 3.3.3 changes - api * Do not create observability model by default (#11476 by rtribotte) - fastproxy * Fix content-length header assertion (#11498 by kevinpollet) * Handle responses without content length header (#11458 by rtribotte) - k8s/crd, k8s * Add missing headerField in Middleware CRD (#11499 by jspdown) - tracing, accesslogs * Bring back TraceID and SpanID fields in access logs (#11450 by rtribotte) - Fix possible privilege escalation when mofing the acme.json file to the new location. Thanks Johannes Segitz (fix for boo#1235408) - Version 3.3.2 - fastproxy * Do not read response body for HEAD requests (gh#traefik/traefik#11442) - metrics,tracing,accesslogs * Fix observability configuration on EntryPoints (gh#traefik/traefik#11446) - webui * Set content-type when serving webui index (gh#traefik/traefik#11428) - Version 3.3.1 changes - acme * Add options to control ACME propagation checks (#11241 by ldez) - api * Add support dump API endpoint (#11328 by mmatur) - http * Set Host header in HTTP provider request (#11237 by nikonhub) - k8s/crd, k8s * Make the IngressRoute kind optional (#11177 by skirtan1) - k8s/ingress, sticky-session, k8s/crd,k8s * Support serving endpoints (#11121 by BZValoche) * Fix fenced server status computation (#11361 by kevinpollet) - logs, accesslogs * OpenTelemetry Logs and Access Logs (#11319 by rtribotte) * Add experimental flag for OTLP logs integration (#11335 by kevinpollet) - metrics, tracing, accesslogs * Manage observability at entrypoint and router level (#11308 by rtribotte) - middleware, authentication * Add an option to preserve the ForwardAuth Server Location header (#11318 by Nelwhix) * Only calculate basic auth hashes once for concurrent requests (#11143 by michelheusschen) * Send request body to authorization server for forward auth (#11097 by kyo-ke) - plugins * Add AbortOnPluginFailure option to abort startup on plugin load failure (#11228 by bmagic) - sticky-session * Configurable path for sticky cookies (#11165 by IIpragmaII) - webui, api * Configurable API & Dashboard base path (#11250 by rtribotte) - Version 3.2.5 - websocket,server * Disable http2 connect setting for websocket by default (gh#traefik/traefik#11412) - Version 3.2.4 - acme * Update go-acme/lego to v4.21.0 (gh#traefik/traefik#11368) - k8s/gatewayapi * Support empty value for core Kubernetes API group (gh#traefik/traefik#11386) - middleware * Fix typo in basicauth note (gh#traefik/traefik#11397) - service * Configure ErrorLog in httputil.ReverseProxy (gh#traefik/traefik#11344) - tls * Upgrade github.com/spiffe/go-spiffe/v2 to v2.4.0 (gh#traefik/traefik#11385) - Remove duplicate github.com/coreos/go-systemd dependency (gh#traefik/traefik#11354) - Bump golang.org/x/net to v0.33.0 (gh#traefik/traefik#11365) mentioned in boo#1235256 CVE-2024-45338 - Version 3.2.3 - Fix for boo#1234513 CVE-2024-4533 - acme * Update go-acme/lego to v4.20.4 (gh#traefik/traefik#11295) - http3 * Update github.com/quic-go/quic-go to v0.48.2 (gh#traefik/traefik#11320) - docker,docker/swarm * Rename traefik.docker.* labels for Docker Swarm to traefik.swarm.* (gh#traefik/traefik#11247) - plugins * Fix WASM settings (gh#traefik/traefik#11321) - rules * Fix models mechanism for default rule syntax (gh#traefik/traefik#11300) - server * Update golang.org/x dependencies (gh#traefik/traefik#11336, CVE-2024-45337, boo#1234502) - golang-jwt has been updated to version 4.5.1 to fix CVE-2024-51744 and boo#1232940 - Version 3.2.1 changes - acme * Update go-acme/lego to v4.20.2 (gh#traefik/traefik#11263 by ldez) - logs * Change level of peeking first byte error log to DEBUG for Postgres (gh#traefik/traefik#11270 by rtribotte) - k8s/ingress,k8s * Fix HostRegexp config for rule syntax v2 (gh#traefik/traefik#11288 by kevinpollet) - logs Change level of peeking first byte error log to DEBUG for Postgres (gh#traefik/traefik#11270 by rtribotte, gh#traefik/traefik#11254 by rtribotte) - service * Fix internal handlers ServiceBuilder composition (gh#traefik/traefik#11281 by juliens) - service,fastproxy Fix case problem for websocket upgrade (gh#traefik/traefik#11246 by juliens) - server * Change level of peeking first byte error log to DEBUG (gh#traefik/traefik#11254 by rtribotte) * Apply keepalive config to h2c entrypoints (gh#traefik/traefik#11276 by davefu113) - middleware,server * Drop untrusted X-Forwarded-Prefix header (gh#traefik/traefik#11253 by rtribotte) - Update from 3.1.6 to 3.2.0 - Important: please read the migration guide when migrating to version 3.2.0 - Version 3.2.0 changes - acme * Remove same email requirement for certresolvers (#11019 by Emrio) * Add support for custom CA certificates by certificate resolver (#10816 by ldez) * Add 30 day certificatesDuration step (#10970 by luker983) - docker * Support HTTP BasicAuth for docker and swarm endpoint (#10776 by 985492783) - k8s, k8s/gatewayapi * Add supported features to the Gateway API GatewayClass status (#11056 by rtribotte) * Update sigs.k8s.io/gateway-api to v1.2.0-rc1 (#11124 by rtribotte) * Add support for backend protocol selection in HTTP and GRPC routes (#11051 by rtribotte) * Improve Kubernetes GatewayAPI TCPRoute and TLSRoute support (#11042 by rtribotte) * Support HTTPRoute destination port matching (#11134 by kevinpollet) * Bump sigs.k8s.io/gateway-api to v1.2.0-rc2 (#11131 by kevinpollet) * Add support for Gateway API BackendTLSPolicies (#11009 by rtribotte) * Support NativeLB option in GatewayAPI provider (#11147 by rtribotte) * Support ResponseHeaderModifier filter (#10987 by kevinpollet) * Support GRPC routes (#10975 by kevinpollet) * Bump sigs.k8s.io/gateway-api to v1.2.0 (#11167 by rtribotte) * Ensuring Gateway API reflected Traefik resource name unicity (#11222 by rtribotte) * Preserve GRPCRoute filters order (#11199 by kevinpollet) * Support http and https appProtocol for Kubernetes Service (#11176 by WillDaSilva) * Avoid updating Accepted status for routes matching no Gateways (#11170 by rtribotte) * Do not update gateway status when not selected by a gateway class (#11169 by kevinpollet) * Document nativeLBByDefault annotation on Kubernetes Gateway provider (#11209 by mloiseleur) - k8s/crd, k8s * Detail CRD update with v3.2 in the migration guide (#11164 by mloiseleur) - k8s/gatewayapi * Add missing RBAC in the migration guide (#11189 by mloiseleur) - k8s * Fix instructions for downloading CRDs of Gateway API v1.2 (#11191 by mloiseleur) - metrics, otel * Allow setting service.name for OTLP metrics (#10917 by cmartell-at-ocp) - middleware * Record trace id and EntryPoint span id into access log (#10921 by weijiany) * Support LogUserHeader with forwardAuth middleware (#10833 by GaleHuang) * Add encodings option to the compression middleware (#10943 by wollomatic) * Add support for ipv6 subnet in ipStrategy (#9747 by michal-kralik) - nomad * Support for watching instead of polling Nomad (#10997 by deverton-godaddy) - server * Introduce a fast proxy mode to improve HTTP/1.1 performances with backends (#11122 by kevinpollet) * Configurable max request header size (#10995 by lucasrod16) - service * Add mirrorBody option to HTTP mirroring (#11032 by MatteoPaier) * Add an option to preserve server path (#11192 by mmatur) * Detect and drop broken conns in the fastproxy pool (#11212 by kevinpollet) - Merge branch v3.1 into v3.2 (#11219 by kevinpollet) - Merge branch v3.1 into master (#11153 by kevinpollet) - Version 3.1.7 changes - k8s * Preserve HTTPRoute filters order (#11198 by kevinpollet) - Merge branch v2.11 into v3.1 - Update from 3.1.4 to 3.1.6 - Version 3.1.6 changes - middleware * Reuse compression writers (#11168 by michelheusschen) * Use correct default weight in Accept-Encoding (#11084 by michelheusschen) - plugins * Close wasm middleware to prevent memory leak (#11151 by ttys3) - Version 3.1.5 changes - k8s, ingress * Disable IngressClass lookup when disableClusterScopeResources is enabled (#11111 by jnoordsij) - server * Rework condition to not log on timeout (#11132 by rtribotte) - Merge branch v2.11 into v3.1 - Update to version 3.1.4 - Fixes CVE-2024-45410, boo#1230842 - k8s, ingress, rules, crd * Allow configuring rule syntax with Kubernetes Ingress annotation * Re-allow empty configuration for Kubernetes Ingress provider * Remove mentions about APIVersion traefik.io/v1 * Update quick-start-with-kubernetes.md to include required permissions - middlewares, metrics * Wrap capture for services used by pieces of middleware * Mention missing metrics removal in the migration guide * Guess Datadog socket type when prefix is unix - plugins * Removes goexport dependency and adds _initialize - tracing * Fix tracing documentation * OTLP doc + potential panic - Update ldflags to point to correct traefik version (v3 instead of v2) - Moved /etc/traefik/acme.json to /var/lib/traefik/acme.json to allow traefik running with "ProtectSystem=full" write access to the certificate store. The acme.json file will be automatically moved and the configuration will be updated accordingly. - Added /usr/lib/sysctl.d/90-itraefik.conf to increase UDP Buffer sizes as explained at https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes - Fixed service-file: set working directory, so that the /etc/traefik/acme.json file can be written in /etc/traefik/acme.json - Update to version 3.1.1 - Bug fixes: * grpc: Bump google.golang.org/grpc to v1.64.1 * k8s/gatewayapi: Do not update route status when nothing changed * metrics - Fix grafana dashboard to work with scrape interval greater than 15s - Update open connections gauge with connections count - Use ServiceName in traefik_service_server_up metric * docker: Update to github.com/docker/docker v27.1.1 * webui: Upgrade webui dependencies - fixes boo#1224308 and CVE-2024-4068 - Run traefik as traefik user, fixes boo#1227226 - Added ACME confiuration template - Update to version 3.1.1 - Bug fixes: * k8s/gatewayapi - Do not update route status when nothing changed * metrics - Fix grafana dashboard to work with scrape interval greater than 15s - Update open connections gauge with connections count - Use ServiceName in traefik_service_server_up metric - Updates - Fix for CVE-2024-6104, boo#1227059 Important: Please read the migration guide https://doc.traefik.io/traefik/v3.1/migration/v3/#v30-to-v31 - Update to version 3.1.0 - enhancements: * k8s/crd,k8s - Support HealthCheck for ExternalName services * k8s/ingress,k8s/crd,k8s - Allow to use internal Node IPs for NodePort services - Change log level from Warning to Info when ExternalName services is enabled * k8s/ingress,k8s/crd,k8s,k8s/gatewayapi - Migrate to EndpointSlices API * k8s,k8s/gatewayapi - Bump Gateway API to v1.1.0 - Compute HTTPRoute priorities - Fix route attachments to gateways - KubernetesGateway provider is no longer experimental - Set Gateway HTTPRoute status - Support HTTPRoute method and query param matching - Support HTTPURLRewrite filter - Support invalid HTTPRoute status - Support ReferenceGrant for HTTPRoute backends - Support RegularExpression for path matching * middleware - Add support for Zstandard to the compression middleware * middleware,k8s,k8s/gatewayapi - Improve HTTPRoute Redirect Filter with port and scheme - Support HTTPRoute redirect port and scheme * middleware - Support Content-Security-Policy-Report-Only in the headers middleware * plugins - Add logs for plugins load - Enhance wasm plugins * server - Support systemd socket-activation - Bug fixes: * healthcheck,k8s/crd,k8s - Fix Healthcheck default value for ExternalName services * k8s,k8s/gatewayapi - Do not disable Gateway API provider if not enabled in experimental - Retry on Gateway API resource status update * middleware,metrics,tracing - Upgrade to OpenTelemetry Semantic Conventions v1.26.0 * otel - Bump opentelemetry-go to v1.28 * plugins - Fix build only linux and darwin support wazergo - Update to version 3.0.4 * Bug fixes: - Fix for CVE-2024-39321 bsc#1227515 - [ecs] Fix ECS config for OIDC + IRSA (gh#traefik/traefik#10814 by mmatur) - [http3] Disable QUIC 0-RTT (gh#traefik/traefik#10867 by mmatur) - [middleware,server] Remove interface names from IPv6 (gh#traefik/traefik#10813 by JeroenED) - Update to version 3.0.3 * Updated libraries - Update to version 3.0.2 * Bug fixes: [logs] Bump OTel dependencies (#10763 by DrFaust92) [logs] Append to log file if it exists (#10756 by lbenguigui) [metrics] Fix service name label_replace in Grafana (#10758 by xdavidwu) [middleware] Forward the correct status code when compression is disabled within the Brotli handler (#10780 by rtribotte) [middleware] Support Accept-Encoding header weights with Compress middleware (#10777 by ldez) - Fix in traefik.yml configuration file - Update to version 3.0.1 * CVEs: * CVE-2024-24788 (bsc#1224018): A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop. * Bug fixes: * [k8s/ingress] Fix rule syntax version for all internal routers (gh#traefik/traefik#10689 by HalloTschuess) * [metrics,tracing] Allow empty configuration for OpenTelemetry metrics and tracing (gh#traefik/traefik#10729 by rtribotte) * [provider,tls] Bump tscert dependency to 28a91b69a046 (gh#traefik/traefik#10668 by kevinpollet) * [rules,tcp] Fix the rule syntax mechanism for TCP (gh#traefik/traefik#10680 by lbenguigui) * [tls,server] Remove deadlines when handling PostgreSQL connections (gh#traefik/traefik#10675 by rtribotte) * [webui] Add support for IP White list (gh#traefik/traefik#10740 by davidbaptista) - Packaging: * Use Traefik's src.tar.gz files containing a pre-built frontend to simplify the packaging process * Fixes bsc#1224308 and bsc#1224384 - Removed allow-node-21.patch and prepare-sources.sh script - Moved configuraton from .toml to .yml config - Update to version 3.0.0 * Announcment: https://traefik.io/blog/announcing-traefik-proxy-v3-rc/ * added support for popular, emerging technologies—WebAssembly (Wasm), OpenTelemetry, and Kubernetes Gateway API * revamped some key parts of the routing rules * added support for some leading edge technologies like HTTP/3, SPIFFE, and Tailscale * Migration guide: https://doc.traefik.io/traefik/v3.0/migration/v2-to-v3/ * Details: https://github.com/traefik/traefik/releases/tag/v3.0.0 - Added allow-node-21.patch to allow building with nodejs21, too - Removed traefik-fix-int-overflow-with-go-generate-10452.patch - Update to version 2.11.2 * Fix for boo#1235167 CVE-2024-28180 * Important * Read the migration guide at https://doc.traefik.io/traefik/migration/v2/#v2112 * CVEs: * GHSA-7f4j-64p6-5h5v (related to CVE-2023-45288) * CVE-2024-28869 (bsc#1222825) * Bug fixes: * [server] Revert LingeringTimeout and change default value for ReadTimeout * [server] Set default ReadTimeout value to 60s - Update to version 2.11.1: * Bug fixes: * [acme,tls] Enforce handling of ACME-TLS/1 challenges * [acme] Update go-acme/lego to v4.16.1 * [acme] Close created file in ACME local store CheckFile func * [docker,http3] Update to quic-go v0.42.0 and docker/cli v24.0.9 * [docker,marathon,rancher,ecs,tls,nomad] Allow to configure TLSStore default generated certificate with labels * [ecs] Adjust ECS network interface detection logi * [logs,tls] Fix log when default TLSStore and TLSOptions are defined multiple times * [middleware] Allow empty replacement with ReplacePathRegex middleware * [plugins] Update Yaegi to v0.16.1 * [provider,rules] Don't allow routers higher than internal ones * [rules] Reserve priority range for internal router * [server,tcp] Introduce Lingering Timeout * [tcp] Enforce failure for TCP HostSNI with hostname * [tracing] Bump Elastic APM to v2.4.8 * [webui] Fix dashboard exposition through a router * [webui] Display IPAllowlist middleware configuration in dashboard * [webui] Make text more readable in dark mode * [webui] Migrate to Quasar 2.x and Vue.js 3.x * [webui] Add a horizontal scroll for the mobile view - Remove node_modules.sums left over by obs-service-node_modules - configuration changes: * Enhanced default configuration file, including configs for http3 support. * Docker configuration has been disabled per default, file provider has been enabled. The directory for the file provider has been set to /etc/traefik/conf.d * Prepared directories for logging in /var/log/traefik * Enhanced default configuration file, including configs for http3 support. Settings are disabled per default. - packaging general: * Use standard source-download feature, modified _service file and removed _servicedata * packagers can invoke `prepare-sources.sh` to doenload sources and prepare go-packages as well as node_modules for the built process. - frontend packaging: * The frontend will now be packaged on OBS to have reproduceable builds. - Go packaging: * Added upstream patch traefik-fix-int-overflow-with-go-generate-10452.patch to allow packaging on 32bit architectures gh#traefik/traefik#10451 * Enabled CGO because there is no cross compilation needed in OSB (we build packages for every distribution/architecture seperately). PIE can not be used with CGO enabled for most architectures and is reported as failure sinc go 1.22. See https://github.com/golang/go/issues/64875 * Don't use pie-buildmode for ppc64 and s390x architectures - Update to version 2.11.0: * Enhancements: * [middleware] Deprecate IPWhiteList middleware in favor of IPAllowList * [redis] Add Redis Sentinel support * [server] Add KeepAliveMaxTime and KeepAliveMaxRequests features to entrypoints * [sticky-session] Hash WRR sticky cookies * Bug fixes: * [acme] Update go-acme/lego to v4.15.0 * [authentication] Fix NTLM and Kerberos * [file] Fix file watcher * [file] Update github.com/fsnotify/fsnotify to v1.7.0 * [http3] Update quic-go to v0.40.1 * [middleware,tcp] Add missing TCP IPAllowList middleware constructor * [nomad] Update the Nomad API dependency to v1.7.2 * [server] Fix ReadHeaderTimeout for PROXY protocol * [webui] Fixes the Header Button * [webui] Fix URL encode resource's id before calling API endpoints - Fixed packaging of UI - Update to version 2.10.7: * CVEs: * CVE-2023-45283 (boo#1216943) * CVE-2023-45284 (boo#1216944) * CVE-2023-47124 (boo#1217806) * CVE-2023-47633 (boo#1217807) * CVE-2023-47106 (boo#1217804) * GHSA-7v4p-328v-8v5g, CVE-2023-39325 (boo#1216109) * Bug fixes: * [accesslogs] Fix preflight response status in access logs * [accesslogs] Move origin fields capture to service level * [acme] Do not check for wildcard domains for non DNS challenge * [acme] Remove backoff for http challenge (CVE-2023-47124) * [acme] Update go-acme/lego to v4.14.0 * [consul,consulcatalog] Update github.com/hashicorp/consul/api * [http3] Update quic-go to v0.39.1 * [k8s/crd] Fix multiple subsets endpoint * [k8s/ingress,k8s/crd,k8s,hub] Clean code related to Hub * [k8s/ingress,k8s] fix: avoid panic on resource backends * [kv] Ignore ErrKeyNotFound error for the KV provider * [logs] Fixed datadog logs json format issue * [metrics] Enable Prometheus provider cleanup when only the router's metrics level is activated * [middleware,authentication] Adjust forward auth to avoid connection leak * [middleware,server] Improve CNAME flattening to avoid unnecessary error logging * [middleware,tracing,plugins] fix: traceability of the middleware plugins * [middleware] Allow X-Forwarded-For delete operation * [middleware] Encode query semicolons * [middleware] Fix stripPrefix middleware is not applied to retried attempts * [middleware] Missing trailer with custom errors middleware * [middleware] Support informational headers in middlewares redefining the response writer * [plugins] Improve error messages related to plugins * [provider] Refuse recursive requests (CVE-2023-47633) * [server] Deny request with fragment in URL path (CVE-2023-47106) * [server] Update x/net and grpc/grpc-go * [tracing] Remove deprecated code usage for datadog tracer * [tracing] Update DataDog tracing dependency to v1.50.1 * [webui] Add missing accessControlAllowOriginListRegex to middleware view * Fix false positive in url anonymization * Misc: * [webui] Updates the Hub tooltip content using a web component and adds an option to disable Hub button - Update Go version (CVE-2023-45283, CVE-2023-45284, CVE-2023-39325) - Update to version 2.10.1: * CVEs * CVE-2022-41724 (bsc#1208271) * CVE-2023-24534 (bsc#1210127) * CVE-2023-29013 (bsc#1210505) * Enhancements * [docker] Expose ContainerName in Docker provider * [hub] Remove hub configuration out of experimental * [k8s/crd] Introduce traefik.io API Group CRDs * [k8s/ingress,k8s/crd,k8s] Native Kubernetes service load-balancing * [middleware,metrics] Add prometheus metric requests_total with headers * [nomad] Support multiple namespaces in the Nomad Provider * [tracing] Add support to send DataDog traces via Unix Socket * [webui] Display period setting of the RateLimit middleware in the webui * [webui] Modify the Hub Button * Bug fixes * [docker] Expose ContainerName in Docker provider * [docker] Only warn about missing docker network when network_mode is not host or container * [ecs] Prevent panicking when a container has no network interfaces * [file] Make file provider more resilient wrt first configuration * [hub] hub: get out of experimental. * [k8s/crd] Introduce traefik.io API Group CRDs * [k8s/ingress,k8s/crd,k8s] Native Kubernetes service load-balancing * [logs] Differentiate UDP stream and TCP connection in logs * [metrics] Include user-defined default cert for traefik_tls_certs_not_after metric * [middleware,metrics] Add prometheus metric requests_total with headers * [middleware] Prevent from no rate limiting when average is zero * [middleware] Prevents superfluous WriteHeader call in the error middleware * [middleware] Sanitize X-Forwarded-Proto header in RedirectScheme middleware * [nomad] Fix default configuration settings for Nomad Provider * [nomad] Fix Nomad client TLS defaults * [nomad] Support multiple namespaces in the Nomad Provider * [plugins] Improve DeepCopy of PluginConf * [server] Remove User-Agent header removal from ReverseProxy director func * [tls,tcp] Adds the support for IPv6 in the TCP HostSNI matcher * [tracing] Add support to send DataDog traces via Unix Socket * [server] Update golang.org/x/net to v0.7.0 (CVE-2022-41724) - Update Go version (CVE-2023-24534, CVE-2023-29013) - Update to version 2.9.6: * CVEs * CVE-2022-23469 * CVE-2022-46153 * CVE-2022-41717 * Bug fixes * [acme] Update go-acme/lego to v4.9.1 * [k8s/crd] Support of allowEmptyServices in TraefikService * [logs] Remove logs of the request * [plugins] Increase the timeout on plugin download * [server] Update golang.org/x/net (CVE-2022-41717, bsc#1207208) * [tls] Handle broken TLS conf better * [tracing] Update DataDog tracing dependency to v1.43.1 * [webui] Add missing serialNumber passTLSClientCert option to middleware panel - Update to version 2.9.5: * Enhancements * [acme,tls] ACME Default Certificate * [consul,etcd,zk,kv,redis] Update valkeyrie to v1.0.0 * [consulcatalog,nomad] Support Nomad canary deployment * [consulcatalog] Move consulcatalog provider to only use health apis * [docker] Add support for reaching containers using host networking on Podman * [docker] Use IPv6 address * [docker] Add allowEmptyServices for Docker provider * [ecs] Add support for ECS Anywhere * [healthcheck] Add a method option to the service Health Check * [http3] Upgrade quic-go to v0.28.0 * [http] Start polling HTTP provider at the beginning * [k8s/crd,plugins] Load plugin configuration field value from Kubernetes Secret * [logs,tcp] Quiet down TCP RST packet error on read operation * [metrics] Add traffic size metrics * [middleware,pilot] Remove Pilot support * [rules,tcp] Support ALPN for TCP + TLS routers * [tcp,service,udp] Make the loadbalancers servers order random * [tls] Change default TLS options for more security * [tracing] Add Datadog GlobalTags support * Bug fixes * [logs,middleware] Create a new capture instance for each incoming request * [acme] Update go-acme/lego to v4.9.0 * [kv,redis] Fix Redis configuration type * [logs,middleware,metrics] Handle capture on redefined http.responseWriters * [middleware,k8s] Remove raw cert escape in PassTLSClientCert middleware * [plugins] Update Yaegi to v0.14.3 * Remove side effect on default transport tests * [acme] Fix ACME panic * [server] Update golang.org/x/net to latest version * [consulcatalog] Fix UDP loadbalancer tags not being used with Consul Catalog * [docker,rancher,ecs,provider] Simplify AddServer algorithm * [plugins] Allow empty plugin configuration * [rules] Fix query parameter matching with equal * [server] Optimize websocket headers handling * [plugins] Update Yaegi to v0.14.2 * [server] Fix IPv6 addr with square brackets * [webui,api] Display default TLS options in the dashboard - Update to version 2.8.4: * Enhancements * [consul,consulcatalog] Support multiple namespaces for Consul and ConsulCatalog providers * [logs] Add destination address to debug log * [middleware,provider,tls] Deprecate caOptional option in client TLS configuration * [middleware] Support URL replacement in errors middleware * [middleware] Allow config of additional CircuitBreaker params * [provider] Implement Traefik provider for Nomad orchestrator * [server] Allow HTTP/2 max concurrent stream configuration * [tls,k8s/crd] Support certificates configuration in TLSStore CRD * [webui,pilot,hub] Add Traefik Hub button and deprecate Pilot * [webui,plugins] Reach the catalog of plugins from the Traefik dashboard * Bug fixes * [docker,docker/swarm] Fix Docker provider mem leak on operation retries * [middleware] Fix retry middleware on panic * [plugins] Allow Traefik starting even if plugin service is unavailable * [marathon] Add missing context in backoff for Marathon * [k8s/ingress,k8s] Place namespace before name in router key for Ingress * [logs,middleware,tracing] Remove request dump from IPWhitelist debug log and tracing message * [metrics] Control allocation and copy of labelNamesValues type * [metrics] Fix service up gauge for Prometheus metrics * [yaml] Add missing inline tag for YAML serialization * [middleware,metrics] Improve performances when Prometheus metrics are enabled * [middleware] Support forwarded websocket protocol in RedirectScheme * [nomad] Use configured token in the Nomad client * [metrics] Ensure Datadog client is cleanly stopped * [healthcheck,service] Do not make multiple requests to the same URL for balancer healthcheck * [healthcheck,service] Add log when missing path in health check * [k8s/gatewayapi] Allow multiple listeners on same port in Gateway API provider * [middleware] RedirectScheme redirects based on X-Forwarded-Proto header * [rules] Fix HostRegexp and Query muxers * [logs] Fix invalid placeholder in log message - Update to version 2.7.0: * Enhancements * [consulcatalog] Watch for Consul events to rebuild the dynamic configuration * [healthcheck] Add Failover service * [http3] Configure advertised port using h3 server option * [hub] Add Traefik Hub Integration * [k8s/crd,k8s] Allow empty services in Kubernetes CRD * [metrics] Support InfluxDB v2 metrics backend * [plugins] Remove Pilot token setup constraint to use plugins * [provider] Refactor configuration reload/throttling * [rules,tcp] Add HostSNIRegexp rule matcher for TCP * [tcp] Add muxer for TCP Routers * [webui,pilot] Add Traefik Hub access and remove Pilot access * [webui] Add a link to service on router detail view * Bug fixes * [hub] Skip Provide when TLS is nil * [tcp] Fix TCP-TLS/HTTPS routing precedence * [webui,hub] Use dedicated entrypoint for the tunnels * [logs,k8s/crd] Fix log statement for ExternalName misconfig * [tcp,service] Fix initial tcp lookup when address is not available * [tls] Fix panic when getting certificates with non-existing store * [acme] Fix RenewInterval computation in ACME provider * [ecs,logs] Remove duplicate error logs * [ecs] Filter out ECS anywhere instance IDs * [middleware] Re-add missing writeheader call in flush * [middleware] Fix bug for when custom page is large enough * [middleware] Fix regexp handling in redirect middleware * [plugins] Fix slice parsing for plugins * [tls] Return TLS unrecognized_name error when no certificate is available * [acme] Add domain to HTTP challenge errors * [metrics] Fix metrics bucket key high cardinality * [middleware,tls] Use CNAME for SNI check on host header * [middleware,tracing] Rename Datadog span tags * [tls] Apply the same approach as the rules system on the TLS configuration choice * Includes a update to gopkg.in/yaml.v3 v3.0.1 which fixes CVE-2022-28948 resp. boo#1248536 - Update to version 2.6.0: * Updated Kubernetes Gateway API provider * Consul Enterprise support * Consul Connect support * Inflight request middleware for TCP routers * HTTP/3 support (experimental) * Added support for loading plugins directly from the filesystem (Local Plugins) * Added ability to create Provider Plugins * Added TCP Middleware * Kubernetes 1.22 API changes * Dropped support for Ingress API versions extensions/v1beta1 * Updated Traefik Proxy CRDs to use API apiextensions.k8s.io/v1 - Update to version 2.4.12: * Get Kubernetes server version early * Don't remove ingress config on API call failure * Ratelimiter: use correct ttlSeconds value, and always call Set * Check if defaultcertificate is defined in store * Disable ExternalName Services by default on Kubernetes providers * Fix: malformed Kubernetes resource names and references in tests * Disable Cross-Namespace by default for IngressRoute provider * Accesslog: support multiple values for a given header * Ignore http 1.0 request host missing errors * Headers Middleware: support http.CloseNotifier interface * Detect certificates content modifications * Update go-acme/lego to v4.4.0 * Fix: ACME preferred chain. * Remove error when HTTProutes is empty * Fix incorrect behaviour with multi-port endpoint subsets * Kubernetes ingress provider to search via all endpoints * Fix plugin unzip call on windows * Update Yaegi to v0.9.17 * Bump paerser to v0.1.4 * Create buffered signals channel * Fix: use defaultEntryPoints when no entryPoint is defined in a TCPRouter * Use a dynamic buffer to handle client Hello SNI detection * Error span on 5xx only - Allow to override build date with SOURCE_DATE_EPOCH in order to make builds reproducible (boo#1047218) - Update to version 2.4.8: * Prepare release v2.4.8 * Raise errors for non-ASCII domain names in a router's rules * Adding an option to (de)activate Pilot integration into the Traefik dashboard * Doc: improve basic auth middleware httpasswd example * Add missing `traefik.` prefix across sample config * Fix travis docker image pulling for docs * updating docs to remove a no longer needed note * Update to gateway-api v0.2.0 * server: updating go-proxyproto with security bugfix from upstream * Update go-acme/lego to v4.3.1 - Initial package release to version 1.7.7: * Check for watched namespace before getting kubernetes objects * Allow empty path with App-root annotation * kubernetes: sort and uniq TLS secrets * Skip TLS section with no secret in Kubernetes ingress OBS-URL: https://build.opensuse.org/request/show/1302155 OBS-URL: https://build.opensuse.org/package/show/devel:kubic/traefik?expand=0&rev=89	2025-09-01 07:53:51 +00:00