Unused Traefik TLSOptions
Traefik TLSOptions are used to configure Traefik Proxy TLS connection parameters. TLSOptions are referenced from IngressRoute. This validator detects when a TLSOptions is not attached to IngressRoutes. That can be an indication of a typo in the TLSOptions name, namespace or IngressRoutes reference.
Affected Resources: TLSOptions
Examples
apiVersion: traefik.containo.us/v1alpha1
kind: TLSOption
metadata:
name: bar # Different name in IngressRoute
namespace: samples
spec:
cipherSuites:
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
- TLS_AES_256_GCM_SHA384
- TLS_AES_128_GCM_SHA256
- TLS_CHACHA20_POLY1305_SHA256
- TLS_FALLBACK_SCSV
curvePreferences:
- CurveP521
- CurveP384
minVersion: VersionTLS12
sniStrict: true
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: whoami
spec:
entryPoints:
- websecure
routes:
- kind: Rule
match: Host(`demo.kubevious.io`)
services:
- kind: Service
name: whoami-svc
port: 80
tls:
certResolver: le
options:
name: foo # TLSOptions not found in the namespace "samples"
namespace: samples
Resolution
Learn More
Need other validation rules?
Please let us know if there are other built-in validation rules you would like to see in Kubevious to detect misconfigurations and violations to best practices. Optionally, you can provide your details so we can reach out to you with follow-up questions.