What traefik/traefik shipped
Generated by FoxPlug from public activity — not affiliated with Traefik.
Week of September 14, 2026
What shipped
- FastProxy now isolates NTLM and Negotiate backend connections to the frontend connection that authenticated them, matching the behavior of the default proxy. Pull request #13914
- NTLM and Kerberos credential-bearing requests are dispatched on dedicated connection-scoped transports before reaching the shared backend connection pool. Pull request #13902
- SSL-passthrough Ingress routes now follow the same routing path as other Ingress routes, with the TCP router forwarding connections without decryption. Pull request #13915
- The Ingress-NGINX provider no longer normalizes namespace and resource names, preventing collisions when names contain dots. Pull request #13922
- The `Ssl-Client-*` request headers are now set on the HTTP router when the `nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream` annotation is enabled. Pull request #13912
- Documentation grammar corrected in TCP HostSNI rules reference. Pull request #13895
- Documentation grammar corrected in TCP ServersTransport reference. Pull request #13894
- Test fixed to properly wait for connection handler to return before starting subsequent connections. Pull request #13870
- Integration test example regular expression end anchor corrected. Pull request #13898
- Branch v3.7 merged into master. Pull request #13889
Why it matters
This week's changes improve authentication handling for connection-bound schemes like NTLM and Kerberos, ensure consistent Ingress routing behavior, and fix a Kubernetes resource naming issue that could cause configuration collisions. These fixes strengthen reliability for users relying on advanced authentication and Kubernetes integration.
Changelog entry
- FastProxy: isolate NTLM and Negotiate backend connections to frontend connection Pull request #13914
- Dispatch NTLM and Kerberos credential-bearing requests on dedicated connection-scoped transports Pull request #13902
- Route ssl-passthrough Ingress through standard routing path Pull request #13915
- Ingress-NGINX provider: do not normalize resource names Pull request #13922
- Set Ssl-Client-* request headers on Ingress-NGINX HTTP router for auth-tls-pass-certificate-to-upstream Pull request #13912
Improved NTLM and Kerberos connection isolation in FastProxy. Fixed SSL-passthrough routing consistency. Prevented Ingress-NGINX resource name collisions with dotted names.
This week we improved handling of connection-bound authentication schemes. FastProxy now properly isolates NTLM and Negotiate connections matching the default proxy. SSL-passthrough Ingress routes follow standard routing paths. We also fixed a Kubernetes resource naming issue in the Ingress-NGINX provider that could cause collisions when resource names contain dots.