config.go

package config

import (
	"crypto/tls"
	"flag"
	"fmt"
	"net/http"
	"os"
	"sort"
	"strconv"
	"strings"
	"time"

	"gopkg.in/yaml.v2"

	log "github.com/sirupsen/logrus"

	"github.com/prometheus/client_golang/prometheus"
	"github.com/zalando/skipper"
	"github.com/zalando/skipper/dataclients/kubernetes"
	"github.com/zalando/skipper/eskip"
	"github.com/zalando/skipper/net"
	"github.com/zalando/skipper/proxy"
	routesrv "github.com/zalando/skipper/routesrv"
	"github.com/zalando/skipper/swarm"
)

type Config struct {
	ConfigFile string

	// generic:
	Address                         string         `yaml:"address"`
	EnableTCPQueue                  bool           `yaml:"enable-tcp-queue"`
	ExpectedBytesPerRequest         int            `yaml:"expected-bytes-per-request"`
	MaxTCPListenerConcurrency       int            `yaml:"max-tcp-listener-concurrency"`
	MaxTCPListenerQueue             int            `yaml:"max-tcp-listener-queue"`
	IgnoreTrailingSlash             bool           `yaml:"ignore-trailing-slash"`
	Insecure                        bool           `yaml:"insecure"`
	ProxyPreserveHost               bool           `yaml:"proxy-preserve-host"`
	DevMode                         bool           `yaml:"dev-mode"`
	SupportListener                 string         `yaml:"support-listener"`
	DebugListener                   string         `yaml:"debug-listener"`
	CertPathTLS                     string         `yaml:"tls-cert"`
	KeyPathTLS                      string         `yaml:"tls-key"`
	StatusChecks                    *listFlag      `yaml:"status-checks"`
	PrintVersion                    bool           `yaml:"version"`
	MaxLoopbacks                    int            `yaml:"max-loopbacks"`
	DefaultHTTPStatus               int            `yaml:"default-http-status"`
	PluginDir                       string         `yaml:"plugindir"`
	LoadBalancerHealthCheckInterval time.Duration  `yaml:"lb-healthcheck-interval"`
	ReverseSourcePredicate          bool           `yaml:"reverse-source-predicate"`
	RemoveHopHeaders                bool           `yaml:"remove-hop-headers"`
	RfcPatchPath                    bool           `yaml:"rfc-patch-path"`
	MaxAuditBody                    int            `yaml:"max-audit-body"`
	EnableBreakers                  bool           `yaml:"enable-breakers"`
	Breakers                        breakerFlags   `yaml:"breaker"`
	EnableRatelimiters              bool           `yaml:"enable-ratelimits"`
	Ratelimits                      ratelimitFlags `yaml:"ratelimits"`
	EnableRouteLIFOMetrics          bool           `yaml:"enable-route-lifo-metrics"`
	MetricsFlavour                  *listFlag      `yaml:"metrics-flavour"`
	FilterPlugins                   *pluginFlag    `yaml:"filter-plugin"`
	PredicatePlugins                *pluginFlag    `yaml:"predicate-plugin"`
	DataclientPlugins               *pluginFlag    `yaml:"dataclient-plugin"`
	MultiPlugins                    *pluginFlag    `yaml:"multi-plugin"`

	// logging, metrics, tracing:
	EnablePrometheusMetrics             bool      `yaml:"enable-prometheus-metrics"`
	OpenTracing                         string    `yaml:"opentracing"`
	OpenTracingInitialSpan              string    `yaml:"opentracing-initial-span"`
	OpenTracingExcludedProxyTags        string    `yaml:"opentracing-excluded-proxy-tags"`
	OpentracingLogFilterLifecycleEvents bool      `yaml:"opentracing-log-filter-lifecycle-events"`
	OpentracingLogStreamEvents          bool      `yaml:"opentracing-log-stream-events"`
	OpentracingBackendNameTag           bool      `yaml:"opentracing-backend-name-tag"`
	MetricsListener                     string    `yaml:"metrics-listener"`
	MetricsPrefix                       string    `yaml:"metrics-prefix"`
	EnableProfile                       bool      `yaml:"enable-profile"`
	DebugGcMetrics                      bool      `yaml:"debug-gc-metrics"`
	RuntimeMetrics                      bool      `yaml:"runtime-metrics"`
	ServeRouteMetrics                   bool      `yaml:"serve-route-metrics"`
	ServeRouteCounter                   bool      `yaml:"serve-route-counter"`
	ServeHostMetrics                    bool      `yaml:"serve-host-metrics"`
	ServeHostCounter                    bool      `yaml:"serve-host-counter"`
	ServeMethodMetric                   bool      `yaml:"serve-method-metric"`
	ServeStatusCodeMetric               bool      `yaml:"serve-status-code-metric"`
	BackendHostMetrics                  bool      `yaml:"backend-host-metrics"`
	AllFiltersMetrics                   bool      `yaml:"all-filters-metrics"`
	CombinedResponseMetrics             bool      `yaml:"combined-response-metrics"`
	RouteResponseMetrics                bool      `yaml:"route-response-metrics"`
	RouteBackendErrorCounters           bool      `yaml:"route-backend-error-counters"`
	RouteStreamErrorCounters            bool      `yaml:"route-stream-error-counters"`
	RouteBackendMetrics                 bool      `yaml:"route-backend-metrics"`
	RouteCreationMetrics                bool      `yaml:"route-creation-metrics"`
	MetricsUseExpDecaySample            bool      `yaml:"metrics-exp-decay-sample"`
	HistogramMetricBucketsString        string    `yaml:"histogram-metric-buckets"`
	HistogramMetricBuckets              []float64 `yaml:"-"`
	DisableMetricsCompat                bool      `yaml:"disable-metrics-compat"`
	ApplicationLog                      string    `yaml:"application-log"`
	ApplicationLogLevel                 log.Level `yaml:"-"`
	ApplicationLogLevelString           string    `yaml:"application-log-level"`
	ApplicationLogPrefix                string    `yaml:"application-log-prefix"`
	ApplicationLogJSONEnabled           bool      `yaml:"application-log-json-enabled"`
	AccessLog                           string    `yaml:"access-log"`
	AccessLogDisabled                   bool      `yaml:"access-log-disabled"`
	AccessLogJSONEnabled                bool      `yaml:"access-log-json-enabled"`
	AccessLogStripQuery                 bool      `yaml:"access-log-strip-query"`
	SuppressRouteUpdateLogs             bool      `yaml:"suppress-route-update-logs"`

	// route sources:
	EtcdUrls                  string               `yaml:"etcd-urls"`
	EtcdPrefix                string               `yaml:"etcd-prefix"`
	EtcdTimeout               time.Duration        `yaml:"etcd-timeout"`
	EtcdInsecure              bool                 `yaml:"etcd-insecure"`
	EtcdOAuthToken            string               `yaml:"etcd-oauth-token"`
	EtcdUsername              string               `yaml:"etcd-username"`
	EtcdPassword              string               `yaml:"etcd-password"`
	InnkeeperURL              string               `yaml:"innkeeper-url"`
	InnkeeperAuthToken        string               `yaml:"innkeeper-auth-token"`
	InnkeeperPreRouteFilters  string               `yaml:"innkeeper-pre-route-filters"`
	InnkeeperPostRouteFilters string               `yaml:"innkeeper-post-route-filters"`
	RoutesFile                string               `yaml:"routes-file"`
	RoutesURLs                *listFlag            `yaml:"routes-urls"`
	InlineRoutes              string               `yaml:"inline-routes"`
	AppendFilters             *defaultFiltersFlags `yaml:"default-filters-append"`
	PrependFilters            *defaultFiltersFlags `yaml:"default-filters-prepend"`
	EditRoute                 *routeChangerConfig  `yaml:"edit-route"`
	CloneRoute                *routeChangerConfig  `yaml:"clone-route"`
	SourcePollTimeout         int64                `yaml:"source-poll-timeout"`
	WaitFirstRouteLoad        bool                 `yaml:"wait-first-route-load"`

	// Forwarded headers
	ForwardedHeadersList            *listFlag            `yaml:"forwarded-headers"`
	ForwardedHeaders                net.ForwardedHeaders `yaml:"-"`
	ForwardedHeadersExcludeCIDRList *listFlag            `yaml:"forwarded-headers-exclude-cidrs"`
	ForwardedHeadersExcludeCIDRs    net.IPNets           `yaml:"-"`

	// host patch:
	NormalizeHost bool          `yaml:"normalize-host"`
	HostPatch     net.HostPatch `yaml:"-"`

	// Kubernetes:
	KubernetesIngress                       bool                `yaml:"kubernetes"`
	KubernetesInCluster                     bool                `yaml:"kubernetes-in-cluster"`
	KubernetesURL                           string              `yaml:"kubernetes-url"`
	KubernetesHealthcheck                   bool                `yaml:"kubernetes-healthcheck"`
	KubernetesHTTPSRedirect                 bool                `yaml:"kubernetes-https-redirect"`
	KubernetesHTTPSRedirectCode             int                 `yaml:"kubernetes-https-redirect-code"`
	KubernetesIngressV1                     bool                `yaml:"kubernetes-ingress-v1"`
	KubernetesIngressClass                  string              `yaml:"kubernetes-ingress-class"`
	KubernetesRouteGroupClass               string              `yaml:"kubernetes-routegroup-class"`
	WhitelistedHealthCheckCIDR              string              `yaml:"whitelisted-healthcheck-cidr"`
	KubernetesPathModeString                string              `yaml:"kubernetes-path-mode"`
	KubernetesPathMode                      kubernetes.PathMode `yaml:"-"`
	KubernetesNamespace                     string              `yaml:"kubernetes-namespace"`
	KubernetesEnableEastWest                bool                `yaml:"enable-kubernetes-east-west"`
	KubernetesEastWestDomain                string              `yaml:"kubernetes-east-west-domain"`
	KubernetesEastWestRangeDomains          *listFlag           `yaml:"kubernetes-east-west-range-domains"`
	KubernetesEastWestRangePredicatesString string              `yaml:"kubernetes-east-west-range-predicates"`
	KubernetesEastWestRangePredicates       []*eskip.Predicate  `yaml:"-"`
	KubernetesOnlyAllowedExternalNames      bool                `yaml:"kubernetes-only-allowed-external-names"`
	KubernetesAllowedExternalNames          regexpListFlag      `yaml:"kubernetes-allowed-external-names"`

	// Default filters
	DefaultFiltersDir string `yaml:"default-filters-dir"`

	// Auth:
	EnableOAuth2GrantFlow           bool          `yaml:"enable-oauth2-grant-flow"`
	OauthURL                        string        `yaml:"oauth-url"`
	OauthScope                      string        `yaml:"oauth-scope"`
	OauthCredentialsDir             string        `yaml:"oauth-credentials-dir"`
	Oauth2AuthURL                   string        `yaml:"oauth2-auth-url"`
	Oauth2TokenURL                  string        `yaml:"oauth2-token-url"`
	Oauth2RevokeTokenURL            string        `yaml:"oauth2-revoke-token-url"`
	Oauth2TokeninfoURL              string        `yaml:"oauth2-tokeninfo-url"`
	Oauth2TokeninfoTimeout          time.Duration `yaml:"oauth2-tokeninfo-timeout"`
	Oauth2SecretFile                string        `yaml:"oauth2-secret-file"`
	Oauth2ClientID                  string        `yaml:"oauth2-client-id"`
	Oauth2ClientSecret              string        `yaml:"oauth2-client-secret"`
	Oauth2ClientIDFile              string        `yaml:"oauth2-client-id-file"`
	Oauth2ClientSecretFile          string        `yaml:"oauth2-client-secret-file"`
	Oauth2AuthURLParameters         mapFlags      `yaml:"oauth2-auth-url-parameters"`
	Oauth2CallbackPath              string        `yaml:"oauth2-callback-path"`
	Oauth2TokenintrospectionTimeout time.Duration `yaml:"oauth2-tokenintrospect-timeout"`
	Oauth2AccessTokenHeaderName     string        `yaml:"oauth2-access-token-header-name"`
	Oauth2TokeninfoSubjectKey       string        `yaml:"oauth2-tokeninfo-subject-key"`
	Oauth2TokenCookieName           string        `yaml:"oauth2-token-cookie-name"`
	WebhookTimeout                  time.Duration `yaml:"webhook-timeout"`
	OidcSecretsFile                 string        `yaml:"oidc-secrets-file"`
	CredentialPaths                 *listFlag     `yaml:"credentials-paths"`
	CredentialsUpdateInterval       time.Duration `yaml:"credentials-update-interval"`

	// TLS client certs
	ClientKeyFile  string            `yaml:"client-tls-key"`
	ClientCertFile string            `yaml:"client-tls-cert"`
	Certificates   []tls.Certificate `yaml:"-"`

	// TLS version
	TLSMinVersion string `yaml:"tls-min-version"`

	// API Monitoring
	ApiUsageMonitoringEnable                       bool   `yaml:"enable-api-usage-monitoring"`
	ApiUsageMonitoringRealmKeys                    string `yaml:"api-usage-monitoring-realm-keys"`
	ApiUsageMonitoringClientKeys                   string `yaml:"api-usage-monitoring-client-keys"`
	ApiUsageMonitoringDefaultClientTrackingPattern string `yaml:"api-usage-monitoring-default-client-tracking-pattern"`
	ApiUsageMonitoringRealmsTrackingPattern        string `yaml:"api-usage-monitoring-realms-tracking-pattern"`

	// connections, timeouts:
	WaitForHealthcheckInterval   time.Duration `yaml:"wait-for-healthcheck-interval"`
	IdleConnsPerHost             int           `yaml:"idle-conns-num"`
	CloseIdleConnsPeriod         time.Duration `yaml:"close-idle-conns-period"`
	BackendFlushInterval         time.Duration `yaml:"backend-flush-interval"`
	ExperimentalUpgrade          bool          `yaml:"experimental-upgrade"`
	ExperimentalUpgradeAudit     bool          `yaml:"experimental-upgrade-audit"`
	ReadTimeoutServer            time.Duration `yaml:"read-timeout-server"`
	ReadHeaderTimeoutServer      time.Duration `yaml:"read-header-timeout-server"`
	WriteTimeoutServer           time.Duration `yaml:"write-timeout-server"`
	IdleTimeoutServer            time.Duration `yaml:"idle-timeout-server"`
	MaxHeaderBytes               int           `yaml:"max-header-bytes"`
	EnableConnMetricsServer      bool          `yaml:"enable-connection-metrics"`
	TimeoutBackend               time.Duration `yaml:"timeout-backend"`
	KeepaliveBackend             time.Duration `yaml:"keepalive-backend"`
	EnableDualstackBackend       bool          `yaml:"enable-dualstack-backend"`
	TlsHandshakeTimeoutBackend   time.Duration `yaml:"tls-timeout-backend"`
	ResponseHeaderTimeoutBackend time.Duration `yaml:"response-header-timeout-backend"`
	ExpectContinueTimeoutBackend time.Duration `yaml:"expect-continue-timeout-backend"`
	MaxIdleConnsBackend          int           `yaml:"max-idle-connection-backend"`
	DisableHTTPKeepalives        bool          `yaml:"disable-http-keepalives"`

	// swarm:
	EnableSwarm bool `yaml:"enable-swarm"`
	// redis based
	SwarmRedisURLs          *listFlag     `yaml:"swarm-redis-urls"`
	SwarmRedisPassword      string        `yaml:"swarm-redis-password"`
	SwarmRedisHashAlgorithm string        `yaml:"swarm-redis-hash-algorithm"`
	SwarmRedisDialTimeout   time.Duration `yaml:"swarm-redis-dial-timeout"`
	SwarmRedisReadTimeout   time.Duration `yaml:"swarm-redis-read-timeout"`
	SwarmRedisWriteTimeout  time.Duration `yaml:"swarm-redis-write-timeout"`
	SwarmRedisPoolTimeout   time.Duration `yaml:"swarm-redis-pool-timeout"`
	SwarmRedisMinConns      int           `yaml:"swarm-redis-min-conns"`
	SwarmRedisMaxConns      int           `yaml:"swarm-redis-max-conns"`
	// swim based
	SwarmKubernetesNamespace          string        `yaml:"swarm-namespace"`
	SwarmKubernetesLabelSelectorKey   string        `yaml:"swarm-label-selector-key"`
	SwarmKubernetesLabelSelectorValue string        `yaml:"swarm-label-selector-value"`
	SwarmPort                         int           `yaml:"swarm-port"`
	SwarmMaxMessageBuffer             int           `yaml:"swarm-max-msg-buffer"`
	SwarmLeaveTimeout                 time.Duration `yaml:"swarm-leave-timeout"`
	SwarmStaticSelf                   string        `yaml:"swarm-static-self"`
	SwarmStaticOther                  string        `yaml:"swarm-static-other"`

	ClusterRatelimitMaxGroupShards int `yaml:"cluster-ratelimit-max-group-shards"`
}

const (
	// TLS
	defaultMinTLSVersion = "1.2"

	// environment keys:
	redisPasswordEnv = "SWARM_REDIS_PASSWORD"
)

func NewConfig() *Config {
	cfg := new(Config)
	cfg.MetricsFlavour = commaListFlag("codahale", "prometheus")
	cfg.StatusChecks = commaListFlag()
	cfg.FilterPlugins = newPluginFlag()
	cfg.PredicatePlugins = newPluginFlag()
	cfg.DataclientPlugins = newPluginFlag()
	cfg.MultiPlugins = newPluginFlag()
	cfg.CredentialPaths = commaListFlag()
	cfg.SwarmRedisURLs = commaListFlag()
	cfg.AppendFilters = &defaultFiltersFlags{}
	cfg.PrependFilters = &defaultFiltersFlags{}
	cfg.CloneRoute = &routeChangerConfig{}
	cfg.EditRoute = &routeChangerConfig{}
	cfg.KubernetesEastWestRangeDomains = commaListFlag()
	cfg.RoutesURLs = commaListFlag()
	cfg.ForwardedHeadersList = commaListFlag()
	cfg.ForwardedHeadersExcludeCIDRList = commaListFlag()

	flag.StringVar(&cfg.ConfigFile, "config-file", "", "if provided the flags will be loaded/overwritten by the values on the file (yaml)")

	// generic:
	flag.StringVar(&cfg.Address, "address", ":9090", "network address that skipper should listen on")
	flag.BoolVar(&cfg.EnableTCPQueue, "enable-tcp-queue", false, "enable the TCP listener queue")
	flag.IntVar(&cfg.ExpectedBytesPerRequest, "expected-bytes-per-request", 50*1024, "bytes per request, that is used to calculate concurrency limits to buffer connection spikes")
	flag.IntVar(&cfg.MaxTCPListenerConcurrency, "max-tcp-listener-concurrency", 0, "sets hardcoded max for TCP listener concurrency, normally calculated based on available memory cgroups with max TODO")
	flag.IntVar(&cfg.MaxTCPListenerQueue, "max-tcp-listener-queue", 0, "sets hardcoded max queue size for TCP listener, normally calculated 10x concurrency with max TODO:50k")
	flag.BoolVar(&cfg.IgnoreTrailingSlash, "ignore-trailing-slash", false, "flag indicating to ignore trailing slashes in paths when routing")
	flag.BoolVar(&cfg.Insecure, "insecure", false, "flag indicating to ignore the verification of the TLS certificates of the backend services")
	flag.BoolVar(&cfg.ProxyPreserveHost, "proxy-preserve-host", false, "flag indicating to preserve the incoming request 'Host' header in the outgoing requests")
	flag.BoolVar(&cfg.DevMode, "dev-mode", false, "enables developer time behavior, like ubuffered routing updates")
	flag.StringVar(&cfg.SupportListener, "support-listener", ":9911", "network address used for exposing the /metrics endpoint. An empty value disables support endpoint.")
	flag.StringVar(&cfg.DebugListener, "debug-listener", "", "when this address is set, skipper starts an additional listener returning the original and transformed requests")
	flag.StringVar(&cfg.CertPathTLS, "tls-cert", "", "the path on the local filesystem to the certificate file(s) (including any intermediates), multiple may be given comma separated")
	flag.StringVar(&cfg.KeyPathTLS, "tls-key", "", "the path on the local filesystem to the certificate's private key file(s), multiple keys may be given comma separated - the order must match the certs")
	flag.Var(cfg.StatusChecks, "status-checks", "experimental URLs to check before reporting healthy on startup")
	flag.BoolVar(&cfg.PrintVersion, "version", false, "print Skipper version")
	flag.IntVar(&cfg.MaxLoopbacks, "max-loopbacks", proxy.DefaultMaxLoopbacks, "maximum number of loopbacks for an incoming request, set to -1 to disable loopbacks")
	flag.IntVar(&cfg.DefaultHTTPStatus, "default-http-status", http.StatusNotFound, "default HTTP status used when no route is found for a request")
	flag.StringVar(&cfg.PluginDir, "plugindir", "", "set the directory to load plugins from, default is ./")
	flag.DurationVar(&cfg.LoadBalancerHealthCheckInterval, "lb-healthcheck-interval", 0, "use to set the health checker interval to check healthiness of former dead or unhealthy routes")
	flag.BoolVar(&cfg.ReverseSourcePredicate, "reverse-source-predicate", false, "reverse the order of finding the client IP from X-Forwarded-For header")
	flag.BoolVar(&cfg.RemoveHopHeaders, "remove-hop-headers", false, "enables removal of Hop-Headers according to RFC-2616")
	flag.BoolVar(&cfg.RfcPatchPath, "rfc-patch-path", false, "patches the incoming request path to preserve uncoded reserved characters according to RFC 2616 and RFC 3986")
	flag.IntVar(&cfg.MaxAuditBody, "max-audit-body", 1024, "sets the max body to read to log in the audit log body")
	flag.BoolVar(&cfg.EnableBreakers, "enable-breakers", false, enableBreakersUsage)
	flag.Var(&cfg.Breakers, "breaker", breakerUsage)
	flag.BoolVar(&cfg.EnableRatelimiters, "enable-ratelimits", false, enableRatelimitsUsage)
	flag.Var(&cfg.Ratelimits, "ratelimits", ratelimitsUsage)
	flag.BoolVar(&cfg.EnableRouteLIFOMetrics, "enable-route-lifo-metrics", false, "enable metrics for the individual route LIFO queues")
	flag.Var(cfg.MetricsFlavour, "metrics-flavour", "Metrics flavour is used to change the exposed metrics format. Supported metric formats: 'codahale' and 'prometheus', you can select both of them")
	flag.Var(cfg.FilterPlugins, "filter-plugin", "set a custom filter plugins to load, a comma separated list of name and arguments")
	flag.Var(cfg.PredicatePlugins, "predicate-plugin", "set a custom predicate plugins to load, a comma separated list of name and arguments")
	flag.Var(cfg.DataclientPlugins, "dataclient-plugin", "set a custom dataclient plugins to load, a comma separated list of name and arguments")
	flag.Var(cfg.MultiPlugins, "multi-plugin", "set a custom multitype plugins to load, a comma separated list of name and arguments")

	// logging, metrics, tracing:
	flag.BoolVar(&cfg.EnablePrometheusMetrics, "enable-prometheus-metrics", false, "*Deprecated*: use metrics-flavour. Switch to Prometheus metrics format to expose metrics")
	flag.StringVar(&cfg.OpenTracing, "opentracing", "noop", "list of arguments for opentracing (space separated), first argument is the tracer implementation")
	flag.StringVar(&cfg.OpenTracingInitialSpan, "opentracing-initial-span", "ingress", "set the name of the initial, pre-routing, tracing span")
	flag.StringVar(&cfg.OpenTracingExcludedProxyTags, "opentracing-excluded-proxy-tags", "", "set tags that should be excluded from spans created for proxy operation. must be a comma-separated list of strings.")
	flag.BoolVar(&cfg.OpentracingLogFilterLifecycleEvents, "opentracing-log-filter-lifecycle-events", true, "enables the logs for request & response filters' lifecycle events that are marking start & end times.")
	flag.BoolVar(&cfg.OpentracingLogStreamEvents, "opentracing-log-stream-events", true, "enables the logs for events marking the times response headers & payload are streamed to the client")
	flag.BoolVar(&cfg.OpentracingBackendNameTag, "opentracing-backend-name-tag", false, "enables an additional tracing tag that contains a backend name for a route when it's available  (e.g. for RouteGroups) (default false)")
	flag.StringVar(&cfg.MetricsListener, "metrics-listener", ":9911", "network address used for exposing the /metrics endpoint. An empty value disables metrics iff support listener is also empty.")
	flag.StringVar(&cfg.MetricsPrefix, "metrics-prefix", "skipper.", "allows setting a custom path prefix for metrics export")
	flag.BoolVar(&cfg.EnableProfile, "enable-profile", false, "enable profile information on the metrics endpoint with path /pprof")
	flag.BoolVar(&cfg.DebugGcMetrics, "debug-gc-metrics", false, "enables reporting of the Go garbage collector statistics exported in debug.GCStats")
	flag.BoolVar(&cfg.RuntimeMetrics, "runtime-metrics", true, "enables reporting of the Go runtime statistics exported in runtime and specifically runtime.MemStats")
	flag.BoolVar(&cfg.ServeRouteMetrics, "serve-route-metrics", false, "enables reporting total serve time metrics for each route")
	flag.BoolVar(&cfg.ServeRouteCounter, "serve-route-counter", false, "enables reporting counting metrics for each route. Has the route, HTTP method and status code as labels. Currently just implemented for the Prometheus metrics flavour")
	flag.BoolVar(&cfg.ServeHostMetrics, "serve-host-metrics", false, "enables reporting total serve time metrics for each host")
	flag.BoolVar(&cfg.ServeHostCounter, "serve-host-counter", false, "enables reporting counting metrics for each host. Has the route, HTTP method and status code as labels. Currently just implemented for the Prometheus metrics flavour")
	flag.BoolVar(&cfg.ServeMethodMetric, "serve-method-metric", true, "enables the HTTP method as a domain of the total serve time metric. It affects both route and host splitted metrics")
	flag.BoolVar(&cfg.ServeStatusCodeMetric, "serve-status-code-metric", true, "enables the HTTP response status code as a domain of the total serve time metric. It affects both route and host splitted metrics")
	flag.BoolVar(&cfg.BackendHostMetrics, "backend-host-metrics", false, "enables reporting total serve time metrics for each backend")
	flag.BoolVar(&cfg.AllFiltersMetrics, "all-filters-metrics", false, "enables reporting combined filter metrics for each route")
	flag.BoolVar(&cfg.CombinedResponseMetrics, "combined-response-metrics", false, "enables reporting combined response time metrics")
	flag.BoolVar(&cfg.RouteResponseMetrics, "route-response-metrics", false, "enables reporting response time metrics for each route")
	flag.BoolVar(&cfg.RouteBackendErrorCounters, "route-backend-error-counters", false, "enables counting backend errors for each route")
	flag.BoolVar(&cfg.RouteStreamErrorCounters, "route-stream-error-counters", false, "enables counting streaming errors for each route")
	flag.BoolVar(&cfg.RouteBackendMetrics, "route-backend-metrics", false, "enables reporting backend response time metrics for each route")
	flag.BoolVar(&cfg.RouteCreationMetrics, "route-creation-metrics", false, "enables reporting for route creation times")
	flag.BoolVar(&cfg.MetricsUseExpDecaySample, "metrics-exp-decay-sample", false, "use exponentially decaying sample in metrics")
	flag.StringVar(&cfg.HistogramMetricBucketsString, "histogram-metric-buckets", "", "use custom buckets for prometheus histograms, must be a comma-separated list of numbers")
	flag.BoolVar(&cfg.DisableMetricsCompat, "disable-metrics-compat", false, "disables the default true value for all-filters-metrics, route-response-metrics, route-backend-errorCounters and route-stream-error-counters")
	flag.StringVar(&cfg.ApplicationLog, "application-log", "", "output file for the application log. When not set, /dev/stderr is used")
	flag.StringVar(&cfg.ApplicationLogLevelString, "application-log-level", "INFO", "log level for application logs, possible values: PANIC, FATAL, ERROR, WARN, INFO, DEBUG")
	flag.StringVar(&cfg.ApplicationLogPrefix, "application-log-prefix", "[APP]", "prefix for each log entry")
	flag.BoolVar(&cfg.ApplicationLogJSONEnabled, "application-log-json-enabled", false, "when this flag is set, log in JSON format is used")
	flag.StringVar(&cfg.AccessLog, "access-log", "", "output file for the access log, When not set, /dev/stderr is used")
	flag.BoolVar(&cfg.AccessLogDisabled, "access-log-disabled", false, "when this flag is set, no access log is printed")
	flag.BoolVar(&cfg.AccessLogJSONEnabled, "access-log-json-enabled", false, "when this flag is set, log in JSON format is used")
	flag.BoolVar(&cfg.AccessLogStripQuery, "access-log-strip-query", false, "when this flag is set, the access log strips the query strings from the access log")
	flag.BoolVar(&cfg.SuppressRouteUpdateLogs, "suppress-route-update-logs", false, "print only summaries on route updates/deletes")

	// route sources:
	flag.StringVar(&cfg.EtcdUrls, "etcd-urls", "", "urls of nodes in an etcd cluster, storing route definitions")
	flag.StringVar(&cfg.EtcdPrefix, "etcd-prefix", "/skipper", "path prefix for skipper related data in etcd")
	flag.DurationVar(&cfg.EtcdTimeout, "etcd-timeout", time.Second, "http client timeout duration for etcd")
	flag.BoolVar(&cfg.EtcdInsecure, "etcd-insecure", false, "ignore the verification of TLS certificates for etcd")
	flag.StringVar(&cfg.EtcdOAuthToken, "etcd-oauth-token", "", "optional token for OAuth authentication with etcd")
	flag.StringVar(&cfg.EtcdUsername, "etcd-username", "", "optional username for basic authentication with etcd")
	flag.StringVar(&cfg.EtcdPassword, "etcd-password", "", "optional password for basic authentication with etcd")
	flag.StringVar(&cfg.InnkeeperURL, "innkeeper-url", "", "API endpoint of the Innkeeper service, storing route definitions")
	flag.StringVar(&cfg.InnkeeperAuthToken, "innkeeper-auth-token", "", "fixed token for innkeeper authentication")
	flag.StringVar(&cfg.InnkeeperPreRouteFilters, "innkeeper-pre-route-filters", "", "filters to be prepended to each route loaded from Innkeeper")
	flag.StringVar(&cfg.InnkeeperPostRouteFilters, "innkeeper-post-route-filters", "", "filters to be appended to each route loaded from Innkeeper")
	flag.StringVar(&cfg.RoutesFile, "routes-file", "", "file containing route definitions")
	flag.Var(cfg.RoutesURLs, "routes-urls", "comma separated URLs to route definitions in eskip format")
	flag.StringVar(&cfg.InlineRoutes, "inline-routes", "", "inline routes in eskip format")
	flag.Int64Var(&cfg.SourcePollTimeout, "source-poll-timeout", int64(3000), "polling timeout of the routing data sources, in milliseconds")
	flag.Var(cfg.AppendFilters, "default-filters-append", "set of default filters to apply to append to all filters of all routes")
	flag.Var(cfg.PrependFilters, "default-filters-prepend", "set of default filters to apply to prepend to all filters of all routes")
	flag.Var(cfg.EditRoute, "edit-route", "match and edit filters and predicates of all routes")
	flag.Var(cfg.CloneRoute, "clone-route", "clone all matching routes and replace filters and predicates of all matched routes")
	flag.BoolVar(&cfg.WaitFirstRouteLoad, "wait-first-route-load", false, "prevent starting the listener before the first batch of routes were loaded")

	// Forwarded headers
	flag.Var(cfg.ForwardedHeadersList, "forwarded-headers", "comma separated list of headers to add to the incoming request before routing\n"+
		"X-Forwarded-For sets or appends with comma the remote IP of the request to the X-Forwarded-For header value\n"+
		"X-Forwarded-Host sets X-Forwarded-Host value to the request host\n"+
		"X-Forwarded-Port=<port> sets X-Forwarded-Port value\n"+
		"X-Forwarded-Proto=<http|https> sets X-Forwarded-Proto value")
	flag.Var(cfg.ForwardedHeadersExcludeCIDRList, "forwarded-headers-exclude-cidrs", "disables addition of forwarded headers for the remote host IPs from the comma separated list of CIDRs")

	flag.BoolVar(&cfg.NormalizeHost, "normalize-host", false, "converts request host to lowercase and removes port and trailing dot if any")

	// Kubernetes:
	flag.BoolVar(&cfg.KubernetesIngress, "kubernetes", false, "enables skipper to generate routes for ingress resources in kubernetes cluster. Enables -normalize-host")
	flag.BoolVar(&cfg.KubernetesInCluster, "kubernetes-in-cluster", false, "specify if skipper is running inside kubernetes cluster")
	flag.StringVar(&cfg.KubernetesURL, "kubernetes-url", "", "kubernetes API base URL for the ingress data client; requires kubectl proxy running; omit if kubernetes-in-cluster is set to true")
	flag.BoolVar(&cfg.KubernetesHealthcheck, "kubernetes-healthcheck", true, "automatic healthcheck route for internal IPs with path /kube-system/healthz; valid only with kubernetes")
	flag.BoolVar(&cfg.KubernetesHTTPSRedirect, "kubernetes-https-redirect", true, "automatic HTTP->HTTPS redirect route; valid only with kubernetes")
	flag.IntVar(&cfg.KubernetesHTTPSRedirectCode, "kubernetes-https-redirect-code", 308, "overrides the default redirect code (308) when used together with -kubernetes-https-redirect")
	flag.BoolVar(&cfg.KubernetesIngressV1, "kubernetes-ingress-v1", false, "enable kubernetes ingress version v1, defaults to version v1beta1")
	flag.StringVar(&cfg.KubernetesIngressClass, "kubernetes-ingress-class", "", "ingress class regular expression used to filter ingress resources for kubernetes")
	flag.StringVar(&cfg.KubernetesRouteGroupClass, "kubernetes-routegroup-class", "", "route group class regular expression used to filter route group resources for kubernetes")
	flag.StringVar(&cfg.WhitelistedHealthCheckCIDR, "whitelisted-healthcheck-cidr", "", "sets the iprange/CIDRS to be whitelisted during healthcheck")
	flag.StringVar(&cfg.KubernetesPathModeString, "kubernetes-path-mode", "kubernetes-ingress", "controls the default interpretation of Kubernetes ingress paths: <kubernetes-ingress|path-regexp|path-prefix>")
	flag.StringVar(&cfg.KubernetesNamespace, "kubernetes-namespace", "", "watch only this namespace for ingresses")
	flag.BoolVar(&cfg.KubernetesEnableEastWest, "enable-kubernetes-east-west", false, "*Deprecated*: use kubernetes-east-west-range feature. Enables east-west communication, which automatically adds routes for Ingress objects with hostname <name>.<namespace>.skipper.cluster.local")
	flag.StringVar(&cfg.KubernetesEastWestDomain, "kubernetes-east-west-domain", "", "*Deprecated*: use kubernetes-east-west-range feature. Sets the east-west domain, defaults to .skipper.cluster.local")
	flag.Var(cfg.KubernetesEastWestRangeDomains, "kubernetes-east-west-range-domains", "set the the cluster internal domains for east west traffic. Identified routes to such domains will include the -kubernetes-east-west-range-predicates")
	flag.StringVar(&cfg.KubernetesEastWestRangePredicatesString, "kubernetes-east-west-range-predicates", "", "set the predicates that will be appended to routes identified as to -kubernetes-east-west-range-domains")
	flag.BoolVar(&cfg.KubernetesOnlyAllowedExternalNames, "kubernetes-only-allowed-external-names", false, "only accept external name services, route group network backends and route group explicit LB endpoints from an allow list defined by zero or more -kubernetes-allowed-external-name flags")
	flag.Var(&cfg.KubernetesAllowedExternalNames, "kubernetes-allowed-external-name", "set zero or more regular expressions from which at least one should be matched by the external name services, route group network addresses and explicit endpoints domain names")

	// Auth:
	flag.BoolVar(&cfg.EnableOAuth2GrantFlow, "enable-oauth2-grant-flow", false, "enables OAuth2 Grant Flow filter")
	flag.StringVar(&cfg.OauthURL, "oauth-url", "", "OAuth2 URL for Innkeeper authentication")
	flag.StringVar(&cfg.OauthScope, "oauth-scope", "", "the whitespace separated list of oauth scopes")
	flag.StringVar(&cfg.OauthCredentialsDir, "oauth-credentials-dir", "", "directory where oauth credentials are stored: client.json and user.json")
	flag.StringVar(&cfg.Oauth2AuthURL, "oauth2-auth-url", "", "sets the OAuth2 Auth URL to redirect the requests to when login is required")
	flag.StringVar(&cfg.Oauth2TokenURL, "oauth2-token-url", "", "the url where the access code should be exchanged for the access token")
	flag.StringVar(&cfg.Oauth2RevokeTokenURL, "oauth2-revoke-token-url", "", "the url where the access and refresh tokens can be revoked when logging out")
	flag.StringVar(&cfg.Oauth2TokeninfoURL, "oauth2-tokeninfo-url", "", "sets the default tokeninfo URL to query information about an incoming OAuth2 token in oauth2Tokeninfo filters")
	flag.StringVar(&cfg.Oauth2SecretFile, "oauth2-secret-file", "", "sets the filename with the encryption key for the authentication cookie and grant flow state stored in secrets registry")
	flag.StringVar(&cfg.Oauth2ClientID, "oauth2-client-id", "", "sets the OAuth2 client id of the current service, used to exchange the access code")
	flag.StringVar(&cfg.Oauth2ClientSecret, "oauth2-client-secret", "", "sets the OAuth2 client secret associated with the oauth2-client-id, used to exchange the access code")
	flag.StringVar(&cfg.Oauth2ClientIDFile, "oauth2-client-id-file", "", "sets the path of the file containing the OAuth2 client id of the current service, used to exchange the access code")
	flag.StringVar(&cfg.Oauth2ClientSecretFile, "oauth2-client-secret-file", "", "sets the path of the file containing the OAuth2 client secret associated with the oauth2-client-id, used to exchange the access code")
	flag.StringVar(&cfg.Oauth2CallbackPath, "oauth2-callback-path", "", "sets the path where the OAuth2 callback requests with the authorization code should be redirected to")
	flag.DurationVar(&cfg.Oauth2TokeninfoTimeout, "oauth2-tokeninfo-timeout", 2*time.Second, "sets the default tokeninfo request timeout duration to 2000ms")
	flag.DurationVar(&cfg.Oauth2TokenintrospectionTimeout, "oauth2-tokenintrospect-timeout", 2*time.Second, "sets the default tokenintrospection request timeout duration to 2000ms")
	flag.Var(&cfg.Oauth2AuthURLParameters, "oauth2-auth-url-parameters", "sets additional parameters to send when calling the OAuth2 authorize or token endpoints as key-value pairs")
	flag.StringVar(&cfg.Oauth2AccessTokenHeaderName, "oauth2-access-token-header-name", "", "sets the access token to a header on the request with this name")
	flag.StringVar(&cfg.Oauth2TokeninfoSubjectKey, "oauth2-tokeninfo-subject-key", "uid", "sets the access token to a header on the request with this name")
	flag.StringVar(&cfg.Oauth2TokenCookieName, "oauth2-token-cookie-name", "oauth2-grant", "sets the name of the cookie where the encrypted token is stored")
	flag.DurationVar(&cfg.WebhookTimeout, "webhook-timeout", 2*time.Second, "sets the webhook request timeout duration")
	flag.StringVar(&cfg.OidcSecretsFile, "oidc-secrets-file", "", "file storing the encryption key of the OID Connect token")
	flag.Var(cfg.CredentialPaths, "credentials-paths", "directories or files to watch for credentials to use by bearerinjector filter")
	flag.DurationVar(&cfg.CredentialsUpdateInterval, "credentials-update-interval", 10*time.Minute, "sets the interval to update secrets")

	// TLS client certs
	flag.StringVar(&cfg.ClientKeyFile, "client-tls-key", "", "TLS Key file for backend connections, multiple keys may be given comma separated - the order must match the certs")
	flag.StringVar(&cfg.ClientCertFile, "client-tls-cert", "", "TLS certificate files for backend connections, multiple keys may be given comma separated - the order must match the keys")

	// TLS version
	flag.StringVar(&cfg.TLSMinVersion, "tls-min-version", defaultMinTLSVersion, "minimal TLS Version to be used in server, proxy and client connections")

	// API Monitoring:
	flag.BoolVar(&cfg.ApiUsageMonitoringEnable, "enable-api-usage-monitoring", false, "enables the apiUsageMonitoring filter")
	flag.StringVar(&cfg.ApiUsageMonitoringRealmKeys, "api-usage-monitoring-realm-keys", "", "name of the property in the JWT payload that contains the authority realm")
	flag.StringVar(&cfg.ApiUsageMonitoringClientKeys, "api-usage-monitoring-client-keys", "sub", "comma separated list of names of the properties in the JWT body that contains the client ID")
	flag.StringVar(&cfg.ApiUsageMonitoringDefaultClientTrackingPattern, "api-usage-monitoring-default-client-tracking-pattern", "", "*Deprecated*: set `client_tracking_pattern` directly on filter")
	flag.StringVar(&cfg.ApiUsageMonitoringRealmsTrackingPattern, "api-usage-monitoring-realms-tracking-pattern", "services", "regular expression used for matching monitored realms (defaults is 'services')")

	// Default filters:
	flag.StringVar(&cfg.DefaultFiltersDir, "default-filters-dir", "", "path to directory which contains default filter configurations per service and namespace (disabled if not set)")

	// Connections, timeouts:
	flag.DurationVar(&cfg.WaitForHealthcheckInterval, "wait-for-healthcheck-interval", (10+5)*3*time.Second, "period waiting to become unhealthy in the loadbalancer pool in front of this instance, before shutdown triggered by SIGINT or SIGTERM") // kube-ingress-aws-controller default
	flag.IntVar(&cfg.IdleConnsPerHost, "idle-conns-num", proxy.DefaultIdleConnsPerHost, "maximum idle connections per backend host")
	flag.DurationVar(&cfg.CloseIdleConnsPeriod, "close-idle-conns-period", proxy.DefaultCloseIdleConnsPeriod, "sets the time interval of closing all idle connections. Not closing when 0")
	flag.DurationVar(&cfg.BackendFlushInterval, "backend-flush-interval", 20*time.Millisecond, "flush interval for upgraded proxy connections")
	flag.BoolVar(&cfg.ExperimentalUpgrade, "experimental-upgrade", false, "enable experimental feature to handle upgrade protocol requests")
	flag.BoolVar(&cfg.ExperimentalUpgradeAudit, "experimental-upgrade-audit", false, "enable audit logging of the request line and the messages during the experimental web socket upgrades")
	flag.DurationVar(&cfg.ReadTimeoutServer, "read-timeout-server", 5*time.Minute, "set ReadTimeout for http server connections")
	flag.DurationVar(&cfg.ReadHeaderTimeoutServer, "read-header-timeout-server", 60*time.Second, "set ReadHeaderTimeout for http server connections")
	flag.DurationVar(&cfg.WriteTimeoutServer, "write-timeout-server", 60*time.Second, "set WriteTimeout for http server connections")
	flag.DurationVar(&cfg.IdleTimeoutServer, "idle-timeout-server", 60*time.Second, "set IdleTimeout for http server connections")
	flag.IntVar(&cfg.MaxHeaderBytes, "max-header-bytes", http.DefaultMaxHeaderBytes, "set MaxHeaderBytes for http server connections")
	flag.BoolVar(&cfg.EnableConnMetricsServer, "enable-connection-metrics", false, "enables connection metrics for http server connections")
	flag.DurationVar(&cfg.TimeoutBackend, "timeout-backend", 60*time.Second, "sets the TCP client connection timeout for backend connections")
	flag.DurationVar(&cfg.KeepaliveBackend, "keepalive-backend", 30*time.Second, "sets the keepalive for backend connections")
	flag.BoolVar(&cfg.EnableDualstackBackend, "enable-dualstack-backend", true, "enables DualStack for backend connections")
	flag.DurationVar(&cfg.TlsHandshakeTimeoutBackend, "tls-timeout-backend", 60*time.Second, "sets the TLS handshake timeout for backend connections")
	flag.DurationVar(&cfg.ResponseHeaderTimeoutBackend, "response-header-timeout-backend", 60*time.Second, "sets the HTTP response header timeout for backend connections")
	flag.DurationVar(&cfg.ExpectContinueTimeoutBackend, "expect-continue-timeout-backend", 30*time.Second, "sets the HTTP expect continue timeout for backend connections")
	flag.IntVar(&cfg.MaxIdleConnsBackend, "max-idle-connection-backend", 0, "sets the maximum idle connections for all backend connections")
	flag.BoolVar(&cfg.DisableHTTPKeepalives, "disable-http-keepalives", false, "forces backend to always create a new connection")

	// Swarm:
	flag.BoolVar(&cfg.EnableSwarm, "enable-swarm", false, "enable swarm communication between nodes in a skipper fleet")
	flag.Var(cfg.SwarmRedisURLs, "swarm-redis-urls", "Redis URLs as comma separated list, used for building a swarm, for example in redis based cluster ratelimits.\nUse "+redisPasswordEnv+" environment variable or 'swarm-redis-password' key in config file to set redis password")
	flag.StringVar(&cfg.SwarmRedisHashAlgorithm, "swarm-redis-hash-algorithm", "", "sets hash algorithm to be used in redis ring client to find the shard <jump|mpchash|rendezvous|rendezvousVnodes>, defaults to github.com/go-redis/redis default")
	flag.DurationVar(&cfg.SwarmRedisDialTimeout, "swarm-redis-dial-timeout", net.DefaultDialTimeout, "set redis client dial timeout")
	flag.DurationVar(&cfg.SwarmRedisReadTimeout, "swarm-redis-read-timeout", net.DefaultReadTimeout, "set redis socket read timeout")
	flag.DurationVar(&cfg.SwarmRedisWriteTimeout, "swarm-redis-write-timeout", net.DefaultWriteTimeout, "set redis socket write timeout")
	flag.DurationVar(&cfg.SwarmRedisPoolTimeout, "swarm-redis-pool-timeout", net.DefaultPoolTimeout, "set redis get connection from pool timeout")
	flag.IntVar(&cfg.SwarmRedisMinConns, "swarm-redis-min-conns", net.DefaultMinConns, "set min number of connections to redis")
	flag.IntVar(&cfg.SwarmRedisMaxConns, "swarm-redis-max-conns", net.DefaultMaxConns, "set max number of connections to redis")
	flag.StringVar(&cfg.SwarmKubernetesNamespace, "swarm-namespace", swarm.DefaultNamespace, "Kubernetes namespace to find swarm peer instances")
	flag.StringVar(&cfg.SwarmKubernetesLabelSelectorKey, "swarm-label-selector-key", swarm.DefaultLabelSelectorKey, "Kubernetes labelselector key to find swarm peer instances")
	flag.StringVar(&cfg.SwarmKubernetesLabelSelectorValue, "swarm-label-selector-value", swarm.DefaultLabelSelectorValue, "Kubernetes labelselector value to find swarm peer instances")
	flag.IntVar(&cfg.SwarmPort, "swarm-port", swarm.DefaultPort, "swarm port to use to communicate with our peers")
	flag.IntVar(&cfg.SwarmMaxMessageBuffer, "swarm-max-msg-buffer", swarm.DefaultMaxMessageBuffer, "swarm max message buffer size to use for member list messages")
	flag.DurationVar(&cfg.SwarmLeaveTimeout, "swarm-leave-timeout", swarm.DefaultLeaveTimeout, "swarm leave timeout to use for leaving the memberlist on timeout")
	flag.StringVar(&cfg.SwarmStaticSelf, "swarm-static-self", "", "set static swarm self node, for example 127.0.0.1:9001")
	flag.StringVar(&cfg.SwarmStaticOther, "swarm-static-other", "", "set static swarm all nodes, for example 127.0.0.1:9002,127.0.0.1:9003")

	flag.IntVar(&cfg.ClusterRatelimitMaxGroupShards, "cluster-ratelimit-max-group-shards", 1, "sets the maximum number of group shards for the clusterRatelimit filter")

	return cfg
}

func (c *Config) Parse() error {
	flag.Parse()

	// check if arguments were correctly parsed.
	if len(flag.Args()) != 0 {
		return fmt.Errorf("invalid arguments: %s", flag.Args())
	}

	configKeys := make(map[string]interface{})
	if c.ConfigFile != "" {
		yamlFile, err := os.ReadFile(c.ConfigFile)
		if err != nil {
			return fmt.Errorf("invalid config file: %v", err)
		}

		err = yaml.Unmarshal(yamlFile, c)
		if err != nil {
			return fmt.Errorf("unmarshalling config file error: %v", err)
		}

		_ = yaml.Unmarshal(yamlFile, configKeys)

		flag.Parse()
	}

	checkDeprecated(configKeys,
		"enable-prometheus-metrics",
		"api-usage-monitoring-default-client-tracking-pattern",
		"enable-kubernetes-east-west",
		"kubernetes-east-west-domain",
	)

	logLevel, err := log.ParseLevel(c.ApplicationLogLevelString)
	if err != nil {
		return err
	}

	kubernetesPathMode, err := kubernetes.ParsePathMode(c.KubernetesPathModeString)
	if err != nil {
		return err
	}

	kubernetesEastWestRangePredicates, err := eskip.ParsePredicates(c.KubernetesEastWestRangePredicatesString)
	if err != nil {
		return fmt.Errorf("invalid east-west-range-predicates: %w", err)
	}

	histogramBuckets, err := c.parseHistogramBuckets()
	if err != nil {
		return err
	}

	c.ApplicationLogLevel = logLevel
	c.KubernetesPathMode = kubernetesPathMode
	c.KubernetesEastWestRangePredicates = kubernetesEastWestRangePredicates
	c.HistogramMetricBuckets = histogramBuckets

	if c.ClientKeyFile != "" && c.ClientCertFile != "" {
		certsFiles := strings.Split(c.ClientCertFile, ",")
		keyFiles := strings.Split(c.ClientKeyFile, ",")

		var certificates []tls.Certificate
		for i := range keyFiles {
			certificate, err := tls.LoadX509KeyPair(certsFiles[i], keyFiles[i])
			if err != nil {
				return fmt.Errorf("invalid key/cert pair: %v", err)
			}

			certificates = append(certificates, certificate)
		}

		c.Certificates = certificates
	}

	err = c.parseForwardedHeaders()
	if err != nil {
		return err
	}

	if c.NormalizeHost || c.KubernetesIngress {
		c.HostPatch = net.HostPatch{
			ToLower:           true,
			RemovePort:        true,
			RemoteTrailingDot: true,
		}
	}

	c.parseEnv()
	return nil
}

func (c *Config) ToRouteSrvOptions() routesrv.Options {
	var whitelistCIDRS []string
	if len(c.WhitelistedHealthCheckCIDR) > 0 {
		whitelistCIDRS = strings.Split(c.WhitelistedHealthCheckCIDR, ",")
	}

	return routesrv.Options{
		Address:                            c.Address,
		DefaultFiltersDir:                  c.DefaultFiltersDir,
		KubernetesAllowedExternalNames:     c.KubernetesAllowedExternalNames,
		KubernetesInCluster:                c.KubernetesInCluster,
		KubernetesURL:                      c.KubernetesURL,
		KubernetesHealthcheck:              c.KubernetesHealthcheck,
		KubernetesHTTPSRedirect:            c.KubernetesHTTPSRedirect,
		KubernetesHTTPSRedirectCode:        c.KubernetesHTTPSRedirectCode,
		KubernetesIngressV1:                c.KubernetesIngressV1,
		KubernetesIngressClass:             c.KubernetesIngressClass,
		KubernetesRouteGroupClass:          c.KubernetesRouteGroupClass,
		KubernetesPathMode:                 c.KubernetesPathMode,
		KubernetesNamespace:                c.KubernetesNamespace,
		KubernetesEnableEastWest:           c.KubernetesEnableEastWest,
		KubernetesEastWestDomain:           c.KubernetesEastWestDomain,
		KubernetesEastWestRangeDomains:     c.KubernetesEastWestRangeDomains.values,
		KubernetesEastWestRangePredicates:  c.KubernetesEastWestRangePredicates,
		KubernetesOnlyAllowedExternalNames: c.KubernetesOnlyAllowedExternalNames,
		OpenTracingBackendNameTag:          c.OpentracingBackendNameTag,
		OpenTracing:                        strings.Split(c.OpenTracing, " "),
		OriginMarker:                       c.RouteCreationMetrics,
		ReverseSourcePredicate:             c.ReverseSourcePredicate,
		SourcePollTimeout:                  time.Duration(c.SourcePollTimeout) * time.Millisecond,
		WaitForHealthcheckInterval:         c.WaitForHealthcheckInterval,
		WhitelistedHealthCheckCIDR:         whitelistCIDRS,
	}
}

func (c *Config) ToOptions() skipper.Options {
	var eus []string
	if len(c.EtcdUrls) > 0 {
		eus = strings.Split(c.EtcdUrls, ",")
	}

	var whitelistCIDRS []string
	if len(c.WhitelistedHealthCheckCIDR) > 0 {
		whitelistCIDRS = strings.Split(c.WhitelistedHealthCheckCIDR, ",")
	}

	options := skipper.Options{
		// generic:
		Address:                         c.Address,
		StatusChecks:                    c.StatusChecks.values,
		EnableTCPQueue:                  c.EnableTCPQueue,
		ExpectedBytesPerRequest:         c.ExpectedBytesPerRequest,
		MaxTCPListenerConcurrency:       c.MaxTCPListenerConcurrency,
		MaxTCPListenerQueue:             c.MaxTCPListenerQueue,
		IgnoreTrailingSlash:             c.IgnoreTrailingSlash,
		DevMode:                         c.DevMode,
		SupportListener:                 c.SupportListener,
		DebugListener:                   c.DebugListener,
		CertPathTLS:                     c.CertPathTLS,
		KeyPathTLS:                      c.KeyPathTLS,
		MaxLoopbacks:                    c.MaxLoopbacks,
		DefaultHTTPStatus:               c.DefaultHTTPStatus,
		LoadBalancerHealthCheckInterval: c.LoadBalancerHealthCheckInterval,
		ReverseSourcePredicate:          c.ReverseSourcePredicate,
		MaxAuditBody:                    c.MaxAuditBody,
		EnableBreakers:                  c.EnableBreakers,
		BreakerSettings:                 c.Breakers,
		EnableRatelimiters:              c.EnableRatelimiters,
		RatelimitSettings:               c.Ratelimits,
		EnableRouteLIFOMetrics:          c.EnableRouteLIFOMetrics,
		MetricsFlavours:                 c.MetricsFlavour.values,
		FilterPlugins:                   c.FilterPlugins.values,
		PredicatePlugins:                c.PredicatePlugins.values,
		DataClientPlugins:               c.DataclientPlugins.values,
		Plugins:                         c.MultiPlugins.values,
		PluginDirs:                      []string{skipper.DefaultPluginDir},

		// logging, metrics, tracing:
		EnablePrometheusMetrics:             c.EnablePrometheusMetrics,
		OpenTracing:                         strings.Split(c.OpenTracing, " "),
		OpenTracingInitialSpan:              c.OpenTracingInitialSpan,
		OpenTracingExcludedProxyTags:        strings.Split(c.OpenTracingExcludedProxyTags, ","),
		OpenTracingLogStreamEvents:          c.OpentracingLogStreamEvents,
		OpenTracingLogFilterLifecycleEvents: c.OpentracingLogFilterLifecycleEvents,
		MetricsListener:                     c.MetricsListener,
		MetricsPrefix:                       c.MetricsPrefix,
		EnableProfile:                       c.EnableProfile,
		EnableDebugGcMetrics:                c.DebugGcMetrics,
		EnableRuntimeMetrics:                c.RuntimeMetrics,
		EnableServeRouteMetrics:             c.ServeRouteMetrics,
		EnableServeRouteCounter:             c.ServeRouteCounter,
		EnableServeHostMetrics:              c.ServeHostMetrics,
		EnableServeHostCounter:              c.ServeHostCounter,
		EnableServeMethodMetric:             c.ServeMethodMetric,
		EnableServeStatusCodeMetric:         c.ServeStatusCodeMetric,
		EnableBackendHostMetrics:            c.BackendHostMetrics,
		EnableAllFiltersMetrics:             c.AllFiltersMetrics,
		EnableCombinedResponseMetrics:       c.CombinedResponseMetrics,
		EnableRouteResponseMetrics:          c.RouteResponseMetrics,
		EnableRouteBackendErrorsCounters:    c.RouteBackendErrorCounters,
		EnableRouteStreamingErrorsCounters:  c.RouteStreamErrorCounters,
		EnableRouteBackendMetrics:           c.RouteBackendMetrics,
		EnableRouteCreationMetrics:          c.RouteCreationMetrics,
		MetricsUseExpDecaySample:            c.MetricsUseExpDecaySample,
		HistogramMetricBuckets:              c.HistogramMetricBuckets,
		DisableMetricsCompatibilityDefaults: c.DisableMetricsCompat,
		ApplicationLogOutput:                c.ApplicationLog,
		ApplicationLogPrefix:                c.ApplicationLogPrefix,
		ApplicationLogJSONEnabled:           c.ApplicationLogJSONEnabled,
		AccessLogOutput:                     c.AccessLog,
		AccessLogDisabled:                   c.AccessLogDisabled,
		AccessLogJSONEnabled:                c.AccessLogJSONEnabled,
		AccessLogStripQuery:                 c.AccessLogStripQuery,
		SuppressRouteUpdateLogs:             c.SuppressRouteUpdateLogs,

		// route sources:
		EtcdUrls:                  eus,
		EtcdPrefix:                c.EtcdPrefix,
		EtcdWaitTimeout:           c.EtcdTimeout,
		EtcdInsecure:              c.EtcdInsecure,
		EtcdOAuthToken:            c.EtcdOAuthToken,
		EtcdUsername:              c.EtcdUsername,
		EtcdPassword:              c.EtcdPassword,
		InnkeeperUrl:              c.InnkeeperURL,
		InnkeeperAuthToken:        c.InnkeeperAuthToken,
		InnkeeperPreRouteFilters:  c.InnkeeperPreRouteFilters,
		InnkeeperPostRouteFilters: c.InnkeeperPostRouteFilters,
		WatchRoutesFile:           c.RoutesFile,
		RoutesURLs:                c.RoutesURLs.values,
		InlineRoutes:              c.InlineRoutes,
		DefaultFilters: &eskip.DefaultFilters{
			Prepend: c.PrependFilters.filters,
			Append:  c.AppendFilters.filters,
		},
		CloneRoute:         eskip.NewClone(c.CloneRoute.Reg, c.CloneRoute.Repl),
		EditRoute:          eskip.NewEditor(c.EditRoute.Reg, c.EditRoute.Repl),
		SourcePollTimeout:  time.Duration(c.SourcePollTimeout) * time.Millisecond,
		WaitFirstRouteLoad: c.WaitFirstRouteLoad,

		// Kubernetes:
		Kubernetes:                         c.KubernetesIngress,
		KubernetesInCluster:                c.KubernetesInCluster,
		KubernetesURL:                      c.KubernetesURL,
		KubernetesHealthcheck:              c.KubernetesHealthcheck,
		KubernetesHTTPSRedirect:            c.KubernetesHTTPSRedirect,
		KubernetesHTTPSRedirectCode:        c.KubernetesHTTPSRedirectCode,
		KubernetesIngressV1:                c.KubernetesIngressV1,
		KubernetesIngressClass:             c.KubernetesIngressClass,
		KubernetesRouteGroupClass:          c.KubernetesRouteGroupClass,
		WhitelistedHealthCheckCIDR:         whitelistCIDRS,
		KubernetesPathMode:                 c.KubernetesPathMode,
		KubernetesNamespace:                c.KubernetesNamespace,
		KubernetesEnableEastWest:           c.KubernetesEnableEastWest,
		KubernetesEastWestDomain:           c.KubernetesEastWestDomain,
		KubernetesEastWestRangeDomains:     c.KubernetesEastWestRangeDomains.values,
		KubernetesEastWestRangePredicates:  c.KubernetesEastWestRangePredicates,
		KubernetesOnlyAllowedExternalNames: c.KubernetesOnlyAllowedExternalNames,
		KubernetesAllowedExternalNames:     c.KubernetesAllowedExternalNames,

		// API Monitoring:
		ApiUsageMonitoringEnable:                c.ApiUsageMonitoringEnable,
		ApiUsageMonitoringRealmKeys:             c.ApiUsageMonitoringRealmKeys,
		ApiUsageMonitoringClientKeys:            c.ApiUsageMonitoringClientKeys,
		ApiUsageMonitoringRealmsTrackingPattern: c.ApiUsageMonitoringRealmsTrackingPattern,

		// Default filters:
		DefaultFiltersDir: c.DefaultFiltersDir,

		// Auth:
		EnableOAuth2GrantFlow:          c.EnableOAuth2GrantFlow,
		OAuthUrl:                       c.OauthURL,
		OAuthScope:                     c.OauthScope,
		OAuthCredentialsDir:            c.OauthCredentialsDir,
		OAuth2AuthURL:                  c.Oauth2AuthURL,
		OAuth2TokenURL:                 c.Oauth2TokenURL,
		OAuth2RevokeTokenURL:           c.Oauth2RevokeTokenURL,
		OAuthTokeninfoURL:              c.Oauth2TokeninfoURL,
		OAuthTokeninfoTimeout:          c.Oauth2TokeninfoTimeout,
		OAuth2SecretFile:               c.Oauth2SecretFile,
		OAuth2ClientID:                 c.Oauth2ClientID,
		OAuth2ClientSecret:             c.Oauth2ClientSecret,
		OAuth2ClientIDFile:             c.Oauth2ClientIDFile,
		OAuth2ClientSecretFile:         c.Oauth2ClientSecretFile,
		OAuth2CallbackPath:             c.Oauth2CallbackPath,
		OAuthTokenintrospectionTimeout: c.Oauth2TokenintrospectionTimeout,
		OAuth2AuthURLParameters:        c.Oauth2AuthURLParameters.values,
		OAuth2AccessTokenHeaderName:    c.Oauth2AccessTokenHeaderName,
		OAuth2TokeninfoSubjectKey:      c.Oauth2TokeninfoSubjectKey,
		OAuth2TokenCookieName:          c.Oauth2TokenCookieName,
		WebhookTimeout:                 c.WebhookTimeout,
		OIDCSecretsFile:                c.OidcSecretsFile,
		CredentialsPaths:               c.CredentialPaths.values,
		CredentialsUpdateInterval:      c.CredentialsUpdateInterval,

		// connections, timeouts:
		WaitForHealthcheckInterval:   c.WaitForHealthcheckInterval,
		IdleConnectionsPerHost:       c.IdleConnsPerHost,
		CloseIdleConnsPeriod:         c.CloseIdleConnsPeriod,
		BackendFlushInterval:         c.BackendFlushInterval,
		ExperimentalUpgrade:          c.ExperimentalUpgrade,
		ExperimentalUpgradeAudit:     c.ExperimentalUpgradeAudit,
		ReadTimeoutServer:            c.ReadTimeoutServer,
		ReadHeaderTimeoutServer:      c.ReadHeaderTimeoutServer,
		WriteTimeoutServer:           c.WriteTimeoutServer,
		IdleTimeoutServer:            c.IdleTimeoutServer,
		MaxHeaderBytes:               c.MaxHeaderBytes,
		EnableConnMetricsServer:      c.EnableConnMetricsServer,
		TimeoutBackend:               c.TimeoutBackend,
		KeepAliveBackend:             c.KeepaliveBackend,
		DualStackBackend:             c.EnableDualstackBackend,
		TLSHandshakeTimeoutBackend:   c.TlsHandshakeTimeoutBackend,
		ResponseHeaderTimeoutBackend: c.ResponseHeaderTimeoutBackend,
		ExpectContinueTimeoutBackend: c.ExpectContinueTimeoutBackend,
		MaxIdleConnsBackend:          c.MaxIdleConnsBackend,
		DisableHTTPKeepalives:        c.DisableHTTPKeepalives,

		// swarm:
		EnableSwarm: c.EnableSwarm,
		// redis based
		SwarmRedisURLs:          c.SwarmRedisURLs.values,
		SwarmRedisPassword:      c.SwarmRedisPassword,
		SwarmRedisHashAlgorithm: c.SwarmRedisHashAlgorithm,
		SwarmRedisDialTimeout:   c.SwarmRedisDialTimeout,
		SwarmRedisReadTimeout:   c.SwarmRedisReadTimeout,
		SwarmRedisWriteTimeout:  c.SwarmRedisWriteTimeout,
		SwarmRedisPoolTimeout:   c.SwarmRedisPoolTimeout,
		SwarmRedisMinIdleConns:  c.SwarmRedisMinConns,
		SwarmRedisMaxIdleConns:  c.SwarmRedisMaxConns,
		// swim based
		SwarmKubernetesNamespace:          c.SwarmKubernetesNamespace,
		SwarmKubernetesLabelSelectorKey:   c.SwarmKubernetesLabelSelectorKey,
		SwarmKubernetesLabelSelectorValue: c.SwarmKubernetesLabelSelectorValue,
		SwarmPort:                         c.SwarmPort,
		SwarmMaxMessageBuffer:             c.SwarmMaxMessageBuffer,
		SwarmLeaveTimeout:                 c.SwarmLeaveTimeout,
		// swim on localhost for testing
		SwarmStaticSelf:  c.SwarmStaticSelf,
		SwarmStaticOther: c.SwarmStaticOther,

		ClusterRatelimitMaxGroupShards: c.ClusterRatelimitMaxGroupShards,
	}

	if c.PluginDir != "" {
		options.PluginDirs = append(options.PluginDirs, c.PluginDir)
	}

	if c.Insecure {
		options.ProxyFlags |= proxy.Insecure
	}

	if c.ProxyPreserveHost {
		options.ProxyFlags |= proxy.PreserveHost
	}

	if c.RemoveHopHeaders {
		options.ProxyFlags |= proxy.HopHeadersRemoval
	}

	if c.RfcPatchPath {
		options.ProxyFlags |= proxy.PatchPath
	}

	if c.Certificates != nil && len(c.Certificates) > 0 {
		options.ClientTLS = &tls.Config{
			Certificates: c.Certificates,
			MinVersion:   c.getMinTLSVersion(),
		}
	}

	var wrappers []func(handler http.Handler) http.Handler
	options.CustomHttpHandlerWrap = func(handler http.Handler) http.Handler {
		for _, wrapper := range wrappers {
			handler = wrapper(handler)
		}
		return handler
	}

	if c.ForwardedHeaders != (net.ForwardedHeaders{}) {
		wrappers = append(wrappers, func(handler http.Handler) http.Handler {
			return &net.ForwardedHeadersHandler{
				Headers: c.ForwardedHeaders,
				Exclude: c.ForwardedHeadersExcludeCIDRs,
				Handler: handler,
			}
		})
	}

	if c.HostPatch != (net.HostPatch{}) {
		wrappers = append(wrappers, func(handler http.Handler) http.Handler {
			return &net.HostPatchHandler{
				Patch:   c.HostPatch,
				Handler: handler,
			}
		})
	}

	return options
}

func (c *Config) getMinTLSVersion() uint16 {
	tlsVersionTable := map[string]uint16{
		"1.3": tls.VersionTLS13,
		"13":  tls.VersionTLS13,
		"1.2": tls.VersionTLS12,
		"12":  tls.VersionTLS12,
		"1.1": tls.VersionTLS11,
		"11":  tls.VersionTLS11,
		"1.0": tls.VersionTLS10,
		"10":  tls.VersionTLS10,
	}
	if v, ok := tlsVersionTable[c.TLSMinVersion]; ok {
		return v
	}
	log.Infof("No valid minimal TLS version confiured (set to '%s'), fallback to default: %s", c.TLSMinVersion, defaultMinTLSVersion)
	return tlsVersionTable[defaultMinTLSVersion]
}

func (c *Config) parseHistogramBuckets() ([]float64, error) {
	if c.HistogramMetricBucketsString == "" {
		return prometheus.DefBuckets, nil
	}

	var result []float64
	thresholds := strings.Split(c.HistogramMetricBucketsString, ",")
	for _, v := range thresholds {
		bucket, err := strconv.ParseFloat(strings.TrimSpace(v), 64)
		if err != nil {
			return nil, fmt.Errorf("unable to parse histogram-metric-buckets: %v", err)
		}
		result = append(result, bucket)
	}
	sort.Float64s(result)
	return result, nil
}

func (c *Config) parseForwardedHeaders() error {
	for _, header := range c.ForwardedHeadersList.values {
		switch {
		case header == "X-Forwarded-For":
			c.ForwardedHeaders.For = true
		case header == "X-Forwarded-Host":
			c.ForwardedHeaders.Host = true
		case strings.HasPrefix(header, "X-Forwarded-Port="):
			c.ForwardedHeaders.Port = strings.TrimPrefix(header, "X-Forwarded-Port=")
		case header == "X-Forwarded-Proto=http":
			c.ForwardedHeaders.Proto = "http"
		case header == "X-Forwarded-Proto=https":
			c.ForwardedHeaders.Proto = "https"
		default:
			return fmt.Errorf("invalid forwarded header: %s", header)
		}
	}

	cidrs, err := net.ParseCIDRs(c.ForwardedHeadersExcludeCIDRList.values)
	if err != nil {
		return fmt.Errorf("invalid forwarded headers exclude CIDRs: %v", err)
	}
	c.ForwardedHeadersExcludeCIDRs = cidrs

	return nil
}

func (c *Config) parseEnv() {
	// Set Redis password from environment variable if not set earlier (configuration file)
	if c.SwarmRedisPassword == "" {
		c.SwarmRedisPassword = os.Getenv(redisPasswordEnv)
	}
}

func checkDeprecated(configKeys map[string]interface{}, options ...string) {
	flagKeys := make(map[string]bool)
	flag.Visit(func(f *flag.Flag) { flagKeys[f.Name] = true })

	for _, name := range options {
		_, ck := configKeys[name]
		_, fk := flagKeys[name]
		if ck || fk {
			f := flag.Lookup(name)
			log.Warnf("%s: %s", f.Name, f.Usage)
		}
	}
}