From ec3e2c08b8d0b2c35a0bc60c8eef9c6ade7a632d Mon Sep 17 00:00:00 2001
From: Alex Antonov <alex@antonov.ws>
Date: Mon, 21 Aug 2017 10:46:03 +0200
Subject: [PATCH] Support multi-port service routing for containers running on
 Marathon

---
 docs/toml.md                       |  13 ++
 integration/marathon_test.go       |  30 +++-
 provider/docker/docker.go          |   2 +-
 provider/marathon/builder_test.go  |  13 ++
 provider/marathon/marathon.go      | 238 ++++++++++++++++++++++-------
 provider/marathon/marathon_test.go | 195 +++++++++++++++++++++--
 provider/provider.go               |  13 +-
 templates/marathon.tmpl            |  64 ++++----
 types/common_label.go              |  64 +++++---
 9 files changed, 498 insertions(+), 134 deletions(-)

diff --git a/docs/toml.md b/docs/toml.md
index bdcd0cd01..a5215bf32 100644
--- a/docs/toml.md
+++ b/docs/toml.md
@@ -1027,6 +1027,7 @@ Labels can be used on containers to override default behaviour:
 - `traefik.docker.network`: Set the docker network to use for connections to this container. If a container is linked to several networks, be sure to set the proper network name (you can check with docker inspect <container_id>) otherwise it will randomly pick one (depending on how docker is returning them). For instance when deploying docker `stack` from compose files, the compose defined networks will be prefixed with the `stack` name.
 
 If several ports need to be exposed from a container, the services labels can be used
+
 - `traefik.<service-name>.port=443`: create a service binding with frontend/backend using this port. Overrides `traefik.port`.
 - `traefik.<service-name>.protocol=https`: assign `https` protocol. Overrides `traefik.protocol`.
 - `traefik.<service-name>.weight=10`: assign this service weight. Overrides `traefik.weight`.
@@ -1192,6 +1193,18 @@ Labels can be used on containers to override default behaviour:
 - `traefik.frontend.entryPoints=http,https`: assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`.
 - `traefik.frontend.auth.basic=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0`: Sets basic authentication for that frontend with the usernames and passwords test:test and test2:test2, respectively
 
+If several ports need to be exposed from a container, the services labels can be used
+
+- `traefik.<service-name>.port=443`: create a service binding with frontend/backend using this port. Overrides `traefik.port`.
+- `traefik.<service-name>.portIndex=1`: create a service binding with frontend/backend using this port index. Overrides `traefik.portIndex`.
+- `traefik.<service-name>.protocol=https`: assign `https` protocol. Overrides `traefik.protocol`.
+- `traefik.<service-name>.weight=10`: assign this service weight. Overrides `traefik.weight`.
+- `traefik.<service-name>.frontend.backend=fooBackend`: assign this service frontend to `foobackend`. Default is to assign to the service backend.
+- `traefik.<service-name>.frontend.entryPoints=http`: assign this service entrypoints. Overrides `traefik.frontend.entrypoints`.
+- `traefik.<service-name>.frontend.auth.basic=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0` Sets a Basic Auth for that frontend with the users test:test and test2:test2.
+- `traefik.<service-name>.frontend.passHostHeader=true`: Forward client `Host` header to the backend. Overrides `traefik.frontend.passHostHeader`.
+- `traefik.<service-name>.frontend.priority=10`: assign the service frontend priority. Overrides `traefik.frontend.priority`.
+- `traefik.<service-name>.frontend.rule=Path:/foo`: assign the service frontend rule. Overrides `traefik.frontend.rule`.
 
 ## Mesos generic backend
 
diff --git a/integration/marathon_test.go b/integration/marathon_test.go
index c62e99e13..3e8cadba7 100644
--- a/integration/marathon_test.go
+++ b/integration/marathon_test.go
@@ -75,6 +75,13 @@ func (s *MarathonSuite) extendDockerHostsFile(host, ipAddr string) error {
 	return nil
 }
 
+func deployApplication(c *check.C, client marathon.Marathon, application *marathon.Application) {
+	deploy, err := client.UpdateApplication(application, false)
+	c.Assert(err, checker.IsNil)
+	// Wait for deployment to complete.
+	c.Assert(client.WaitOnDeployment(deploy.DeploymentID, 1*time.Minute), checker.IsNil)
+}
+
 func (s *MarathonSuite) TestConfigurationUpdate(c *check.C) {
 	// Start Traefik.
 	file := s.adaptFile(c, "fixtures/marathon/simple.toml", struct {
@@ -117,13 +124,28 @@ func (s *MarathonSuite) TestConfigurationUpdate(c *check.C) {
 		Container("emilevauge/whoami")
 
 	// Deploy the test application.
-	deploy, err := client.UpdateApplication(app, false)
-	c.Assert(err, checker.IsNil)
-	// Wait for deployment to complete.
-	c.Assert(client.WaitOnDeployment(deploy.DeploymentID, 1*time.Minute), checker.IsNil)
+	deployApplication(c, client, app)
 
 	// Query application via Traefik.
 	err = try.GetRequest("http://127.0.0.1:8000/service", 30*time.Second, try.StatusCodeIs(http.StatusOK))
 	c.Assert(err, checker.IsNil)
+
+	// Create test application with services to be deployed.
+	app = marathon.NewDockerApplication().
+		Name("/whoami").
+		CPU(0.1).
+		Memory(32).
+		AddLabel(types.ServiceLabel(types.LabelFrontendRule, "app"), "PathPrefix:/app")
+	app.Container.Docker.Bridged().
+		Expose(80).
+		Container("emilevauge/whoami")
+
+	// Deploy the test application.
+	deployApplication(c, client, app)
+
+	// Query application via Traefik.
+	err = try.GetRequest("http://127.0.0.1:8000/app", 30*time.Second, try.StatusCodeIs(http.StatusOK))
+	c.Assert(err, checker.IsNil)
+
 	showTraefikLog = false
 }
diff --git a/provider/docker/docker.go b/provider/docker/docker.go
index 71b66821d..725d206a7 100644
--- a/provider/docker/docker.go
+++ b/provider/docker/docker.go
@@ -336,7 +336,7 @@ func (p *Provider) hasCircuitBreakerLabel(container dockerData) bool {
 
 // Regexp used to extract the name of the service and the name of the property for this service
 // All properties are under the format traefik.<servicename>.frontent.*= except the port/weight/protocol directly after traefik.<servicename>.
-var servicesPropertiesRegexp = regexp.MustCompile(`^traefik\.(?P<service_name>.*?)\.(?P<property_name>port|weight|protocol|frontend\.(.*))$`)
+var servicesPropertiesRegexp = regexp.MustCompile(`^traefik\.(?P<service_name>.+?)\.(?P<property_name>port|weight|protocol|frontend\.(.*))$`)
 
 // Map of services properties
 // we can get it with label[serviceName][propertyName] and we got the propertyValue
diff --git a/provider/marathon/builder_test.go b/provider/marathon/builder_test.go
index aa993415a..e9a88eb96 100644
--- a/provider/marathon/builder_test.go
+++ b/provider/marathon/builder_test.go
@@ -1,8 +1,10 @@
 package marathon
 
 import (
+	"strings"
 	"time"
 
+	"github.com/containous/traefik/types"
 	"github.com/gambol99/go-marathon"
 )
 
@@ -42,6 +44,17 @@ func label(key, value string) func(*marathon.Application) {
 	}
 }
 
+func labelWithService(key, value string, serviceName string) func(*marathon.Application) {
+	if len(serviceName) == 0 {
+		panic("serviceName can not be empty")
+	}
+
+	property := strings.TrimPrefix(key, types.LabelPrefix)
+	return func(app *marathon.Application) {
+		app.AddLabel(types.LabelPrefix+serviceName+"."+property, value)
+	}
+}
+
 func healthChecks(checks ...*marathon.HealthCheck) func(*marathon.Application) {
 	return func(app *marathon.Application) {
 		for _, check := range checks {
diff --git a/provider/marathon/marathon.go b/provider/marathon/marathon.go
index c493a61e9..011f5e651 100644
--- a/provider/marathon/marathon.go
+++ b/provider/marathon/marathon.go
@@ -7,6 +7,7 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"regexp"
 	"strconv"
 	"strings"
 	"text/template"
@@ -45,6 +46,10 @@ const (
 
 var _ provider.Provider = (*Provider)(nil)
 
+// Regexp used to extract the name of the service and the name of the property for this service
+// All properties are under the format traefik.<servicename>.frontend.*= except the port/portIndex/weight/protocol/backend directly after traefik.<servicename>.
+var servicesPropertiesRegexp = regexp.MustCompile(`^traefik\.(?P<service_name>.+?)\.(?P<property_name>port|portIndex|weight|protocol|backend|frontend\.(.*))$`)
+
 // Provider holds configuration of the provider.
 type Provider struct {
 	provider.BaseProvider
@@ -175,6 +180,7 @@ func (p *Provider) loadMarathonConfig() *types.Configuration {
 		"getPriority":                 p.getPriority,
 		"getEntryPoints":              p.getEntryPoints,
 		"getFrontendRule":             p.getFrontendRule,
+		"getFrontendName":             p.getFrontendName,
 		"hasCircuitBreakerLabels":     p.hasCircuitBreakerLabels,
 		"hasLoadBalancerLabels":       p.hasLoadBalancerLabels,
 		"hasMaxConnLabels":            p.hasMaxConnLabels,
@@ -186,6 +192,9 @@ func (p *Provider) loadMarathonConfig() *types.Configuration {
 		"hasHealthCheckLabels":        p.hasHealthCheckLabels,
 		"getHealthCheckPath":          p.getHealthCheckPath,
 		"getHealthCheckInterval":      p.getHealthCheckInterval,
+		"hasServices":                 p.hasServices,
+		"getServiceNames":             p.getServiceNames,
+		"getServiceNameSuffix":        p.getServiceNameSuffix,
 		"getBasicAuth":                p.getBasicAuth,
 	}
 
@@ -202,7 +211,11 @@ func (p *Provider) loadMarathonConfig() *types.Configuration {
 	filteredApps := fun.Filter(p.applicationFilter, applications.Apps).([]marathon.Application)
 	for i, app := range filteredApps {
 		filteredApps[i].Tasks = fun.Filter(func(task *marathon.Task) bool {
-			return p.taskFilter(*task, app)
+			filtered := p.taskFilter(*task, app)
+			if filtered {
+				p.logIllegalServices(*task, app)
+			}
+			return filtered
 		}, app.Tasks).([]*marathon.Task)
 	}
 
@@ -229,10 +242,10 @@ func (p *Provider) applicationFilter(app marathon.Application) bool {
 	}
 
 	// Filter by constraints.
-	label, _ := p.getLabel(app, types.LabelTags)
+	label, _ := p.getAppLabel(app, types.LabelTags)
 	constraintTags := strings.Split(label, ",")
 	if p.MarathonLBCompatibility {
-		if label, ok := p.getLabel(app, "HAPROXY_GROUP"); ok {
+		if label, ok := p.getAppLabel(app, "HAPROXY_GROUP"); ok {
 			constraintTags = append(constraintTags, label)
 		}
 	}
@@ -251,19 +264,6 @@ func (p *Provider) taskFilter(task marathon.Task, application marathon.Applicati
 		return false
 	}
 
-	if _, err := processPorts(application, task); err != nil {
-		log.Errorf("Filtering Marathon task %s from application %s without port: %s", task.ID, application.ID, err)
-		return false
-	}
-
-	// Filter illegal port label specification.
-	_, hasPortIndexLabel := p.getLabel(application, types.LabelPortIndex)
-	_, hasPortLabel := p.getLabel(application, types.LabelPort)
-	if hasPortIndexLabel && hasPortLabel {
-		log.Debugf("Filtering Marathon task %s from application %s specifying both traefik.portIndex and traefik.port labels", task.ID, application.ID)
-		return false
-	}
-
 	// Filter task with existing, bad health check results.
 	if application.HasHealthChecks() {
 		if task.HasHealthCheckResults() {
@@ -288,7 +288,107 @@ func isApplicationEnabled(application marathon.Application, exposedByDefault boo
 	return exposedByDefault && (*application.Labels)[types.LabelEnable] != "false" || (*application.Labels)[types.LabelEnable] == "true"
 }
 
-func (p *Provider) getLabel(application marathon.Application, label string) (string, bool) {
+// logIllegalServices logs illegal service configurations.
+// While we cannot filter on the service level, they will eventually get
+// rejected once the server configuration is rendered.
+func (p *Provider) logIllegalServices(task marathon.Task, application marathon.Application) {
+	for _, serviceName := range p.getServiceNames(application) {
+		// Check for illegal/missing ports.
+		if _, err := p.processPorts(application, task, serviceName); err != nil {
+			log.Warnf("%s has an illegal configuration: no proper port available", identifier(application, task, serviceName))
+			continue
+		}
+
+		// Check for illegal port label combinations.
+		_, hasPortLabel := p.getLabel(application, types.LabelPort, serviceName)
+		_, hasPortIndexLabel := p.getLabel(application, types.LabelPortIndex, serviceName)
+		if hasPortLabel && hasPortIndexLabel {
+			log.Warnf("%s has both port and port index specified; port will take precedence", identifier(application, task, serviceName))
+		}
+	}
+}
+
+//servicePropertyValues is a map of services properties
+//an example value is: weight=42
+type servicePropertyValues map[string]string
+
+//serviceProperties is a map of service properties per service, which we can get with label[serviceName][propertyName]. It yields a property value.
+type serviceProperties map[string]servicePropertyValues
+
+//hasServices checks if there are service-defining labels for the given application
+func (p *Provider) hasServices(application marathon.Application) bool {
+	return len(extractServiceProperties(application.Labels)) > 0
+}
+
+//extractServiceProperties extracts the service labels for the given application
+func extractServiceProperties(labels *map[string]string) serviceProperties {
+	v := make(serviceProperties)
+
+	if labels != nil {
+		for label, value := range *labels {
+			matches := servicesPropertiesRegexp.FindStringSubmatch(label)
+			if matches == nil {
+				continue
+			}
+
+			// According to the regex, match index 1 is "service_name" and match index 2 is the "property_name"
+			serviceName := matches[1]
+			propertyName := matches[2]
+			if _, ok := v[serviceName]; !ok {
+				v[serviceName] = make(servicePropertyValues)
+			}
+			v[serviceName][propertyName] = value
+		}
+	}
+
+	return v
+}
+
+//getServiceProperty returns the property for a service label searching in all labels of the given application
+func getServiceProperty(application marathon.Application, serviceName string, property string) (string, bool) {
+	value, ok := extractServiceProperties(application.Labels)[serviceName][property]
+	return value, ok
+}
+
+//getServiceNames returns a list of service names for a given application
+//An empty name "" will be added if no service specific properties exist, as an indication that there are no sub-services, but only main application
+func (p *Provider) getServiceNames(application marathon.Application) []string {
+	labelServiceProperties := extractServiceProperties(application.Labels)
+	var names []string
+
+	for k := range labelServiceProperties {
+		names = append(names, k)
+	}
+	if len(names) == 0 {
+		names = append(names, "")
+	}
+	return names
+}
+
+func (p *Provider) getServiceNameSuffix(serviceName string) string {
+	if len(serviceName) > 0 {
+		serviceName = strings.Replace(serviceName, "/", "-", -1)
+		serviceName = strings.Replace(serviceName, ".", "-", -1)
+		return "-service-" + serviceName
+	}
+	return ""
+}
+
+//getAppLabel is a convenience function to get application label, when no serviceName is available
+//it is identical to calling getLabel(application, label, "")
+func (p *Provider) getAppLabel(application marathon.Application, label string) (string, bool) {
+	return p.getLabel(application, label, "")
+}
+
+//getLabel returns a string value of a corresponding `label` argument
+//  If serviceName is non-empty, we look for a service label. If none exists or serviceName is empty, we look for an application label.
+func (p *Provider) getLabel(application marathon.Application, label string, serviceName string) (string, bool) {
+	if len(serviceName) > 0 {
+		property := strings.TrimPrefix(label, types.LabelPrefix)
+		if value, ok := getServiceProperty(application, serviceName, property); ok {
+			return value, true
+		}
+	}
 	for key, value := range *application.Labels {
 		if key == label {
 			return value, true
@@ -297,84 +397,93 @@ func (p *Provider) getLabel(application marathon.Application, label string) (str
 	return "", false
 }
 
-func (p *Provider) getPort(task marathon.Task, application marathon.Application) string {
-	port, err := processPorts(application, task)
+func (p *Provider) getPort(task marathon.Task, application marathon.Application, serviceName string) string {
+	port, err := p.processPorts(application, task, serviceName)
 	if err != nil {
-		log.Errorf("Unable to process ports for Marathon application %s and task %s: %s", application.ID, task.ID, err)
+		log.Errorf("Unable to process ports for %s: %s", identifier(application, task, serviceName), err)
 		return ""
 	}
 
 	return strconv.Itoa(port)
 }
 
-func (p *Provider) getWeight(application marathon.Application) string {
-	if label, ok := p.getLabel(application, types.LabelWeight); ok {
+func (p *Provider) getWeight(application marathon.Application, serviceName string) string {
+	if label, ok := p.getLabel(application, types.LabelWeight, serviceName); ok {
 		return label
 	}
 	return "0"
 }
 
 func (p *Provider) getDomain(application marathon.Application) string {
-	if label, ok := p.getLabel(application, types.LabelDomain); ok {
+	if label, ok := p.getAppLabel(application, types.LabelDomain); ok {
 		return label
 	}
 	return p.Domain
 }
 
-func (p *Provider) getProtocol(application marathon.Application) string {
-	if label, ok := p.getLabel(application, types.LabelProtocol); ok {
+func (p *Provider) getProtocol(application marathon.Application, serviceName string) string {
+	if label, ok := p.getLabel(application, types.LabelProtocol, serviceName); ok {
 		return label
 	}
 	return "http"
 }
 
 func (p *Provider) getSticky(application marathon.Application) string {
-	if sticky, ok := p.getLabel(application, types.LabelBackendLoadbalancerSticky); ok {
+	if sticky, ok := p.getAppLabel(application, types.LabelBackendLoadbalancerSticky); ok {
 		return sticky
 	}
 	return "false"
 }
 
-func (p *Provider) getPassHostHeader(application marathon.Application) string {
-	if passHostHeader, ok := p.getLabel(application, types.LabelFrontendPassHostHeader); ok {
+func (p *Provider) getPassHostHeader(application marathon.Application, serviceName string) string {
+	if passHostHeader, ok := p.getLabel(application, types.LabelFrontendPassHostHeader, serviceName); ok {
 		return passHostHeader
 	}
 	return "true"
 }
 
-func (p *Provider) getPriority(application marathon.Application) string {
-	if priority, ok := p.getLabel(application, types.LabelFrontendPriority); ok {
+func (p *Provider) getPriority(application marathon.Application, serviceName string) string {
+	if priority, ok := p.getLabel(application, types.LabelFrontendPriority, serviceName); ok {
 		return priority
 	}
 	return "0"
 }
 
-func (p *Provider) getEntryPoints(application marathon.Application) []string {
-	if entryPoints, ok := p.getLabel(application, types.LabelFrontendEntryPoints); ok {
+func (p *Provider) getEntryPoints(application marathon.Application, serviceName string) []string {
+	if entryPoints, ok := p.getLabel(application, types.LabelFrontendEntryPoints, serviceName); ok {
 		return strings.Split(entryPoints, ",")
 	}
 	return []string{}
 }
 
 // getFrontendRule returns the frontend rule for the specified application, using
-// it's label. It returns a default one (Host) if the label is not present.
-func (p *Provider) getFrontendRule(application marathon.Application) string {
-	if label, ok := p.getLabel(application, types.LabelFrontendRule); ok {
+// its label. If service is provided, it will look for serviceName label before generic one.
+// It returns a default one (Host) if the label is not present.
+func (p *Provider) getFrontendRule(application marathon.Application, serviceName string) string {
+	if label, ok := p.getLabel(application, types.LabelFrontendRule, serviceName); ok {
 		return label
 	}
 	if p.MarathonLBCompatibility {
-		if label, ok := p.getLabel(application, "HAPROXY_0_VHOST"); ok {
+		if label, ok := p.getAppLabel(application, "HAPROXY_0_VHOST"); ok {
 			return "Host:" + label
 		}
 	}
+	if len(serviceName) > 0 {
+		return "Host:" + strings.ToLower(provider.Normalize(serviceName)) + "." + p.getSubDomain(application.ID) + "." + p.Domain
+	}
 	return "Host:" + p.getSubDomain(application.ID) + "." + p.Domain
 }
 
-func (p *Provider) getBackend(application marathon.Application) string {
-	if label, ok := p.getLabel(application, types.LabelBackend); ok {
+func (p *Provider) getBackend(application marathon.Application, serviceName string) string {
+	if label, ok := p.getLabel(application, types.LabelBackend, serviceName); ok {
 		return label
 	}
-	return strings.Replace(application.ID, "/", "-", -1)
+	return strings.Replace(application.ID, "/", "-", -1) + p.getServiceNameSuffix(serviceName)
+}
+
+func (p *Provider) getFrontendName(application marathon.Application, serviceName string) string {
+	appName := strings.Replace(application.ID, "/", "-", -1)
+	return "frontend" + appName + p.getServiceNameSuffix(serviceName)
 }
 
 func (p *Provider) getSubDomain(name string) string {
@@ -388,26 +497,26 @@ func (p *Provider) getSubDomain(name string) string {
 }
 
 func (p *Provider) hasCircuitBreakerLabels(application marathon.Application) bool {
-	_, ok := p.getLabel(application, types.LabelBackendCircuitbreakerExpression)
+	_, ok := p.getAppLabel(application, types.LabelBackendCircuitbreakerExpression)
 	return ok
 }
 
 func (p *Provider) hasLoadBalancerLabels(application marathon.Application) bool {
-	_, errMethod := p.getLabel(application, types.LabelBackendLoadbalancerMethod)
-	_, errSticky := p.getLabel(application, types.LabelBackendLoadbalancerSticky)
+	_, errMethod := p.getAppLabel(application, types.LabelBackendLoadbalancerMethod)
+	_, errSticky := p.getAppLabel(application, types.LabelBackendLoadbalancerSticky)
 	return errMethod || errSticky
 }
 
 func (p *Provider) hasMaxConnLabels(application marathon.Application) bool {
-	if _, ok := p.getLabel(application, types.LabelBackendMaxconnAmount); !ok {
+	if _, ok := p.getAppLabel(application, types.LabelBackendMaxconnAmount); !ok {
 		return false
 	}
-	_, ok := p.getLabel(application, types.LabelBackendMaxconnExtractorfunc)
+	_, ok := p.getAppLabel(application, types.LabelBackendMaxconnExtractorfunc)
 	return ok
 }
 
 func (p *Provider) getMaxConnAmount(application marathon.Application) int64 {
-	if label, ok := p.getLabel(application, types.LabelBackendMaxconnAmount); ok {
+	if label, ok := p.getAppLabel(application, types.LabelBackendMaxconnAmount); ok {
 		i, errConv := strconv.ParseInt(label, 10, 64)
 		if errConv != nil {
 			log.Errorf("Unable to parse traefik.backend.maxconn.amount %s", label)
@@ -419,21 +528,21 @@ func (p *Provider) getMaxConnAmount(application marathon.Application) int64 {
 }
 
 func (p *Provider) getMaxConnExtractorFunc(application marathon.Application) string {
-	if label, ok := p.getLabel(application, types.LabelBackendMaxconnExtractorfunc); ok {
+	if label, ok := p.getAppLabel(application, types.LabelBackendMaxconnExtractorfunc); ok {
 		return label
 	}
 	return "request.host"
 }
 
 func (p *Provider) getLoadBalancerMethod(application marathon.Application) string {
-	if label, ok := p.getLabel(application, types.LabelBackendLoadbalancerMethod); ok {
+	if label, ok := p.getAppLabel(application, types.LabelBackendLoadbalancerMethod); ok {
 		return label
 	}
 	return "wrr"
 }
 
 func (p *Provider) getCircuitBreakerExpression(application marathon.Application) string {
-	if label, ok := p.getLabel(application, types.LabelBackendCircuitbreakerExpression); ok {
+	if label, ok := p.getAppLabel(application, types.LabelBackendCircuitbreakerExpression); ok {
 		return label
 	}
 	return "NetworkErrorRatio() > 1"
@@ -444,33 +553,37 @@ func (p *Provider) hasHealthCheckLabels(application marathon.Application) bool {
 }
 
 func (p *Provider) getHealthCheckPath(application marathon.Application) string {
-	if label, ok := p.getLabel(application, types.LabelBackendHealthcheckPath); ok {
+	if label, ok := p.getAppLabel(application, types.LabelBackendHealthcheckPath); ok {
 		return label
 	}
 	return ""
 }
 
 func (p *Provider) getHealthCheckInterval(application marathon.Application) string {
-	if label, ok := p.getLabel(application, types.LabelBackendHealthcheckInterval); ok {
+	if label, ok := p.getAppLabel(application, types.LabelBackendHealthcheckInterval); ok {
 		return label
 	}
 	return ""
 }
 
-func (p *Provider) getBasicAuth(application marathon.Application) []string {
-	if basicAuth, ok := p.getLabel(application, types.LabelFrontendAuthBasic); ok {
+func (p *Provider) getBasicAuth(application marathon.Application, serviceName string) []string {
+	if basicAuth, ok := p.getLabel(application, types.LabelFrontendAuthBasic, serviceName); ok {
 		return strings.Split(basicAuth, ",")
 	}
 
 	return []string{}
 }
 
-func processPorts(application marathon.Application, task marathon.Task) (int, error) {
-	if portLabel, ok := (*application.Labels)[types.LabelPort]; ok {
+// processPorts returns the configured port.
+// An explicitly specified port is preferred. If none is specified, it selects
+// one of the available port. The first such found port is returned unless an
+// optional index is provided.
+func (p *Provider) processPorts(application marathon.Application, task marathon.Task, serviceName string) (int, error) {
+	if portLabel, ok := p.getLabel(application, types.LabelPort, serviceName); ok {
 		port, err := strconv.Atoi(portLabel)
 		switch {
 		case err != nil:
-			return 0, fmt.Errorf("failed to parse port label: %s", err)
+			return 0, fmt.Errorf("failed to parse port label %q: %s", portLabel, err)
 		case port <= 0:
 			return 0, fmt.Errorf("explicitly specified port %d must be larger than zero", port)
 		}
@@ -483,8 +596,7 @@ func processPorts(application marathon.Application, task marathon.Task) (int, er
 	}
 
 	portIndex := 0
-	portIndexLabel, ok := (*application.Labels)[types.LabelPortIndex]
-	if ok {
+	if portIndexLabel, ok := p.getLabel(application, types.LabelPortIndex, serviceName); ok {
 		var err error
 		portIndex, err = parseIndex(portIndexLabel, len(ports))
 		if err != nil {
@@ -533,7 +645,7 @@ func (p *Provider) getBackendServer(task marathon.Task, application marathon.App
 	case numTaskIPAddresses == 1:
 		return task.IPAddresses[0].IPAddress
 	default:
-		ipAddressIdxStr, ok := p.getLabel(application, "traefik.ipAddressIdx")
+		ipAddressIdxStr, ok := p.getAppLabel(application, "traefik.ipAddressIdx")
 		if !ok {
 			log.Errorf("Found %d task IP addresses but missing IP address index for Marathon application %s on task %s", numTaskIPAddresses, application.ID, task.ID)
 			return ""
@@ -553,10 +665,18 @@ func parseIndex(index string, length int) (int, error) {
 	parsed, err := strconv.Atoi(index)
 	switch {
 	case err != nil:
-		return 0, fmt.Errorf("failed to parse index '%s': %s", index, err)
+		return 0, fmt.Errorf("failed to parse index %q: %s", index, err)
 	case parsed < 0, parsed > length-1:
 		return 0, fmt.Errorf("index %d must be within range (0, %d)", parsed, length-1)
 	}
 
 	return parsed, nil
 }
+
+func identifier(app marathon.Application, task marathon.Task, serviceName string) string {
+	id := fmt.Sprintf("Marathon task %s from application %s", task.ID, app.ID)
+	if serviceName != "" {
+		id += fmt.Sprintf(" (service: %s)", serviceName)
+	}
+	return id
+}
diff --git a/provider/marathon/marathon_test.go b/provider/marathon/marathon_test.go
index cd7fee449..e5cc01e93 100644
--- a/provider/marathon/marathon_test.go
+++ b/provider/marathon/marathon_test.go
@@ -257,6 +257,95 @@ func TestMarathonLoadConfigNonAPIErrors(t *testing.T) {
 				},
 			},
 		},
+		{
+			desc: "multiple ports",
+			application: application(
+				appPorts(80, 81),
+			),
+			task: localhostTask(
+				taskPorts(80, 81),
+			),
+			expectedFrontends: map[string]*types.Frontend{
+				"frontend-app": {
+					Backend: "backend-app",
+					Routes: map[string]types.Route{
+						"route-host-app": {
+							Rule: "Host:app.docker.localhost",
+						},
+					},
+				},
+			},
+			expectedBackends: map[string]*types.Backend{
+				"backend-app": {
+					Servers: map[string]types.Server{
+						"server-task": {
+							URL:    "http://localhost:80",
+							Weight: 0,
+						},
+					},
+				},
+			},
+		},
+		{
+			desc: "multiple ports with services",
+			application: application(
+				appPorts(80, 81),
+				label(types.LabelBackendMaxconnAmount, "1000"),
+				label(types.LabelBackendMaxconnExtractorfunc, "client.ip"),
+				label("traefik.web.port", "80"),
+				label("traefik.admin.port", "81"),
+				label("traefik..port", "82"), // This should be ignored, as it fails to match the servicesPropertiesRegexp regex.
+				label("traefik.web.frontend.rule", "Host:web.app.docker.localhost"),
+				label("traefik.admin.frontend.rule", "Host:admin.app.docker.localhost"),
+			),
+			task: localhostTask(
+				taskPorts(80, 81),
+			),
+			expectedFrontends: map[string]*types.Frontend{
+				"frontend-app-service-web": {
+					Backend: "backend-app-service-web",
+					Routes: map[string]types.Route{
+						`route-host-app-service-web`: {
+							Rule: "Host:web.app.docker.localhost",
+						},
+					},
+				},
+				"frontend-app-service-admin": {
+					Backend: "backend-app-service-admin",
+					Routes: map[string]types.Route{
+						`route-host-app-service-admin`: {
+							Rule: "Host:admin.app.docker.localhost",
+						},
+					},
+				},
+			},
+			expectedBackends: map[string]*types.Backend{
+				"backend-app-service-web": {
+					Servers: map[string]types.Server{
+						"server-task-service-web": {
+							URL:    "http://localhost:80",
+							Weight: 0,
+						},
+					},
+					MaxConn: &types.MaxConn{
+						Amount:        1000,
+						ExtractorFunc: "client.ip",
+					},
+				},
+				"backend-app-service-admin": {
+					Servers: map[string]types.Server{
+						"server-task-service-admin": {
+							URL:    "http://localhost:81",
+							Weight: 0,
+						},
+					},
+					MaxConn: &types.MaxConn{
+						Amount:        1000,
+						ExtractorFunc: "client.ip",
+					},
+				},
+			},
+		},
 	}
 
 	for _, c := range cases {
@@ -308,7 +397,7 @@ func TestMarathonTaskFilter(t *testing.T) {
 			desc:        "missing port",
 			task:        task(),
 			application: application(),
-			expected:    false,
+			expected:    true,
 		},
 		{
 			desc: "task not running",
@@ -333,7 +422,26 @@ func TestMarathonTaskFilter(t *testing.T) {
 				label(types.LabelPort, "443"),
 				label(types.LabelPortIndex, "1"),
 			),
-			expected: false,
+			expected: true,
+		},
+		{
+			desc: "single service without port",
+			task: task(taskPorts(80, 81)),
+			application: application(
+				appPorts(80, 81),
+				labelWithService(types.LabelPort, "80", "web"),
+				labelWithService(types.LabelPort, "illegal", "admin"),
+			),
+			expected: true,
+		},
+		{
+			desc: "single service missing port",
+			task: task(taskPorts(80, 81)),
+			application: application(
+				appPorts(80, 81),
+				labelWithService(types.LabelPort, "81", "admin"),
+			),
+			expected: true,
 		},
 		{
 			desc: "healthcheck available",
@@ -523,6 +631,7 @@ func TestMarathonGetPort(t *testing.T) {
 		desc        string
 		application marathon.Application
 		task        marathon.Task
+		serviceName string
 		expected    string
 	}{
 		{
@@ -587,19 +696,49 @@ func TestMarathonGetPort(t *testing.T) {
 			task:        task(taskPorts(80)),
 			expected:    "",
 		},
+		{
+			desc: "port and port index specified",
+			application: application(
+				label(types.LabelPort, "80"),
+				label(types.LabelPortIndex, "1"),
+			),
+			task:     task(taskPorts(80, 443)),
+			expected: "80",
+		},
 		{
 			desc:        "task and application ports specified",
 			application: application(appPorts(9999)),
 			task:        task(taskPorts(7777)),
 			expected:    "7777",
 		},
+		{
+			desc:        "multiple task ports with service index available",
+			application: application(label(types.LabelPrefix+"http.portIndex", "0")),
+			task:        task(taskPorts(80, 443)),
+			serviceName: "http",
+			expected:    "80",
+		},
+		{
+			desc:        "multiple task ports with service port available",
+			application: application(label(types.LabelPrefix+"https.port", "443")),
+			task:        task(taskPorts(80, 443)),
+			serviceName: "https",
+			expected:    "443",
+		},
+		{
+			desc:        "multiple task ports with services but default port available",
+			application: application(label(types.LabelPrefix+"http.weight", "100")),
+			task:        task(taskPorts(80, 443)),
+			serviceName: "http",
+			expected:    "80",
+		},
 	}
 
 	for _, c := range cases {
 		c := c
 		t.Run(c.desc, func(t *testing.T) {
 			t.Parallel()
-			actual := provider.getPort(c.task, c.application)
+			actual := provider.getPort(c.task, c.application, c.serviceName)
 			if actual != c.expected {
 				t.Errorf("actual %q, expected %q", c.expected, actual)
 			}
@@ -611,6 +750,7 @@ func TestMarathonGetWeight(t *testing.T) {
 	cases := []struct {
 		desc        string
 		application marathon.Application
+		serviceName string
 		expected    string
 	}{
 		{
@@ -623,6 +763,12 @@ func TestMarathonGetWeight(t *testing.T) {
 			application: application(label(types.LabelWeight, "10")),
 			expected:    "10",
 		},
+		{
+			desc:        "service label existing",
+			application: application(labelWithService(types.LabelWeight, "10", "app")),
+			serviceName: "app",
+			expected:    "10",
+		},
 	}
 
 	for _, c := range cases {
@@ -630,7 +776,7 @@ func TestMarathonGetWeight(t *testing.T) {
 		t.Run(c.desc, func(t *testing.T) {
 			t.Parallel()
 			provider := &Provider{}
-			actual := provider.getWeight(c.application)
+			actual := provider.getWeight(c.application, c.serviceName)
 			if actual != c.expected {
 				t.Errorf("actual %q, expected %q", actual, c.expected)
 			}
@@ -675,6 +821,7 @@ func TestMarathonGetProtocol(t *testing.T) {
 	cases := []struct {
 		desc        string
 		application marathon.Application
+		serviceName string
 		expected    string
 	}{
 		{
@@ -687,6 +834,12 @@ func TestMarathonGetProtocol(t *testing.T) {
 			application: application(label(types.LabelProtocol, "https")),
 			expected:    "https",
 		},
+		{
+			desc:        "service label existing",
+			application: application(labelWithService(types.LabelProtocol, "https", "app")),
+			serviceName: "app",
+			expected:    "https",
+		},
 	}
 
 	for _, c := range cases {
@@ -694,7 +847,7 @@ func TestMarathonGetProtocol(t *testing.T) {
 		t.Run(c.desc, func(t *testing.T) {
 			t.Parallel()
 			provider := &Provider{}
-			actual := provider.getProtocol(c.application)
+			actual := provider.getProtocol(c.application, c.serviceName)
 			if actual != c.expected {
 				t.Errorf("actual %q, expected %q", actual, c.expected)
 			}
@@ -737,6 +890,7 @@ func TestMarathonGetPassHostHeader(t *testing.T) {
 	cases := []struct {
 		desc        string
 		application marathon.Application
+		serviceName string
 		expected    string
 	}{
 		{
@@ -749,6 +903,12 @@ func TestMarathonGetPassHostHeader(t *testing.T) {
 			application: application(label(types.LabelFrontendPassHostHeader, "false")),
 			expected:    "false",
 		},
+		{
+			desc:        "label existing",
+			application: application(labelWithService(types.LabelFrontendPassHostHeader, "false", "app")),
+			serviceName: "app",
+			expected:    "false",
+		},
 	}
 
 	for _, c := range cases {
@@ -756,7 +916,7 @@ func TestMarathonGetPassHostHeader(t *testing.T) {
 		t.Run(c.desc, func(t *testing.T) {
 			t.Parallel()
 			provider := &Provider{}
-			actual := provider.getPassHostHeader(c.application)
+			actual := provider.getPassHostHeader(c.application, c.serviceName)
 			if actual != c.expected {
 				t.Errorf("actual %q, expected %q", actual, c.expected)
 			}
@@ -916,7 +1076,7 @@ func TestMarathonGetEntryPoints(t *testing.T) {
 		t.Run(c.desc, func(t *testing.T) {
 			t.Parallel()
 			provider := &Provider{}
-			actual := provider.getEntryPoints(c.application)
+			actual := provider.getEntryPoints(c.application, "")
 			if !reflect.DeepEqual(actual, c.expected) {
 				t.Errorf("actual %#v, expected %#v", actual, c.expected)
 			}
@@ -928,6 +1088,7 @@ func TestMarathonGetFrontendRule(t *testing.T) {
 	cases := []struct {
 		desc                    string
 		application             marathon.Application
+		serviceName             string
 		expected                string
 		marathonLBCompatibility bool
 	}{
@@ -962,6 +1123,13 @@ func TestMarathonGetFrontendRule(t *testing.T) {
 			marathonLBCompatibility: true,
 			expected:                "Host:foo.bar",
 		},
+		{
+			desc:                    "service label existing",
+			application:             application(labelWithService(types.LabelFrontendRule, "Host:foo.bar", "app")),
+			serviceName:             "app",
+			marathonLBCompatibility: true,
+			expected:                "Host:foo.bar",
+		},
 	}
 
 	for _, c := range cases {
@@ -972,7 +1140,7 @@ func TestMarathonGetFrontendRule(t *testing.T) {
 				Domain:                  "docker.localhost",
 				MarathonLBCompatibility: c.marathonLBCompatibility,
 			}
-			actual := provider.getFrontendRule(c.application)
+			actual := provider.getFrontendRule(c.application, c.serviceName)
 			if actual != c.expected {
 				t.Errorf("actual %q, expected %q", actual, c.expected)
 			}
@@ -984,6 +1152,7 @@ func TestMarathonGetBackend(t *testing.T) {
 	cases := []struct {
 		desc        string
 		application marathon.Application
+		serviceName string
 		expected    string
 	}{
 		{
@@ -996,6 +1165,12 @@ func TestMarathonGetBackend(t *testing.T) {
 			application: application(label(types.LabelBackend, "bar")),
 			expected:    "bar",
 		},
+		{
+			desc:        "service label existing",
+			application: application(labelWithService(types.LabelBackend, "bar", "app")),
+			serviceName: "app",
+			expected:    "bar",
+		},
 	}
 
 	for _, c := range cases {
@@ -1003,7 +1178,7 @@ func TestMarathonGetBackend(t *testing.T) {
 		t.Run(c.desc, func(t *testing.T) {
 			t.Parallel()
 			provider := &Provider{}
-			actual := provider.getBackend(c.application)
+			actual := provider.getBackend(c.application, c.serviceName)
 			if actual != c.expected {
 				t.Errorf("actual %q, expected %q", actual, c.expected)
 			}
@@ -1303,7 +1478,7 @@ func TestMarathonGetBasicAuth(t *testing.T) {
 		t.Run(c.desc, func(t *testing.T) {
 			t.Parallel()
 			provider := &Provider{}
-			actual := provider.getBasicAuth(c.application)
+			actual := provider.getBasicAuth(c.application, "")
 			if !reflect.DeepEqual(actual, c.expected) {
 				t.Errorf("actual %q, expected %q", actual, c.expected)
 			}
diff --git a/provider/provider.go b/provider/provider.go
index 7a5396543..773e5f4df 100644
--- a/provider/provider.go
+++ b/provider/provider.go
@@ -28,10 +28,11 @@ type Provider interface {
 
 // BaseProvider should be inherited by providers
 type BaseProvider struct {
-	Watch       bool              `description:"Watch provider"`
-	Filename    string            `description:"Override default configuration template. For advanced users :)"`
-	Constraints types.Constraints `description:"Filter services by constraint, matching with Traefik tags."`
-	Trace       bool              `description:"Display additional provider logs (if available)."`
+	Watch                     bool              `description:"Watch provider"`
+	Filename                  string            `description:"Override default configuration template. For advanced users :)"`
+	Constraints               types.Constraints `description:"Filter services by constraint, matching with Traefik tags."`
+	Trace                     bool              `description:"Display additional provider logs (if available)."`
+	DebugLogGeneratedTemplate bool              `description:"Enable debug logging of generated configuration template."`
 }
 
 // MatchConstraints must match with EVERY single contraint
@@ -94,7 +95,9 @@ func (p *BaseProvider) GetConfiguration(defaultTemplateFile string, funcMap temp
 	}
 
 	var renderedTemplate = buffer.String()
-	//	log.Debugf("Rendering results of %s:\n%s", defaultTemplateFile, renderedTemplate)
+	if p.DebugLogGeneratedTemplate {
+		log.Debugf("Rendering results of %s:\n%s", defaultTemplateFile, renderedTemplate)
+	}
 	if _, err := toml.Decode(renderedTemplate, configuration); err != nil {
 		return nil, err
 	}
diff --git a/templates/marathon.tmpl b/templates/marathon.tmpl
index ac6ad0e2d..5292ebb37 100644
--- a/templates/marathon.tmpl
+++ b/templates/marathon.tmpl
@@ -1,46 +1,50 @@
 {{$apps := .Applications}}
 
 {{range $app := $apps}}
-{{range $app.Tasks}}
-    [backends."backend{{getBackend $app}}".servers."server-{{.ID | replace "." "-"}}"]
-    url = "{{getProtocol $app}}://{{getBackendServer . $app}}:{{getPort . $app}}"
-    weight = {{getWeight $app}}
+{{range $task := $app.Tasks}}
+{{range $serviceIndex, $serviceName := getServiceNames $app}}
+    [backends."backend{{getBackend $app $serviceName}}".servers."server-{{$task.ID | replace "." "-"}}{{getServiceNameSuffix $serviceName }}"]
+    url = "{{getProtocol $app $serviceName}}://{{getBackendServer $task $app}}:{{getPort $task $app $serviceName}}"
+    weight = {{getWeight $app $serviceName}}
+{{end}}
 {{end}}
 {{end}}
 
-{{range $apps}}
-{{ if hasMaxConnLabels . }}
-      [backends."backend{{getBackend . }}".maxconn]
-        amount = {{getMaxConnAmount . }}
-        extractorfunc = "{{getMaxConnExtractorFunc . }}"
+{{range $app := $apps}}
+{{range $serviceIndex, $serviceName := getServiceNames $app}}
+{{ if hasMaxConnLabels $app }}
+      [backends."backend{{getBackend $app $serviceName }}".maxconn]
+        amount = {{getMaxConnAmount $app }}
+        extractorfunc = "{{getMaxConnExtractorFunc $app }}"
 {{end}}
-{{ if hasLoadBalancerLabels . }}
-      [backends."backend{{getBackend . }}".loadbalancer]
-        method = "{{getLoadBalancerMethod . }}"
-        sticky = {{getSticky .}}
+{{ if hasLoadBalancerLabels $app }}
+      [backends."backend{{getBackend $app $serviceName }}".loadbalancer]
+        method = "{{getLoadBalancerMethod $app }}"
+        sticky = {{getSticky $app}}
 {{end}}
-{{ if hasCircuitBreakerLabels . }}
-      [backends."backend{{getBackend . }}".circuitbreaker]
-        expression = "{{getCircuitBreakerExpression . }}"
+{{ if hasCircuitBreakerLabels $app }}
+      [backends."backend{{getBackend $app $serviceName }}".circuitbreaker]
+        expression = "{{getCircuitBreakerExpression $app }}"
+{{end}}
+{{ if hasHealthCheckLabels $app }}
+      [backends."backend{{getBackend $app $serviceName }}".healthcheck]
+        path = "{{getHealthCheckPath $app }}"
+        interval = "{{getHealthCheckInterval $app }}"
 {{end}}
-{{ if hasHealthCheckLabels . }}
-      [backends."backend{{getBackend . }}".healthcheck]
-        path = "{{getHealthCheckPath . }}"
-        interval = "{{getHealthCheckInterval . }}"
 {{end}}
 {{end}}
 
-[frontends]{{range $apps}}
-  [frontends."frontend{{.ID | replace "/" "-"}}"]
-  backend = "backend{{getBackend .}}"
-  passHostHeader = {{getPassHostHeader .}}
-  priority = {{getPriority .}}
-  entryPoints = [{{range getEntryPoints .}}
+[frontends]{{range $app := $apps}}{{range $serviceIndex, $serviceName := getServiceNames .}}
+  [frontends."{{ getFrontendName $app $serviceName }}"]
+  backend = "backend{{getBackend $app $serviceName}}"
+  passHostHeader = {{getPassHostHeader $app $serviceName}}
+  priority = {{getPriority $app $serviceName}}
+  entryPoints = [{{range getEntryPoints $app $serviceName}}
     "{{.}}",
   {{end}}]
-  basicAuth = [{{range getBasicAuth .}}
+  basicAuth = [{{range getBasicAuth $app $serviceName}}
     "{{.}}",
   {{end}}]
-    [frontends."frontend{{.ID | replace "/" "-"}}".routes."route-host{{.ID | replace "/" "-"}}"]
-    rule = "{{getFrontendRule .}}"
-{{end}}
+    [frontends."{{ getFrontendName $app $serviceName }}".routes."route-host{{$app.ID | replace "/" "-"}}{{getServiceNameSuffix $serviceName }}"]
+    rule = "{{getFrontendRule $app $serviceName}}"
+{{end}}{{end}}
diff --git a/types/common_label.go b/types/common_label.go
index 7d9684f8a..e22f53c62 100644
--- a/types/common_label.go
+++ b/types/common_label.go
@@ -1,54 +1,68 @@
 package types
 
+import "strings"
+
 const (
+	// LabelPrefix Traefik label
+	LabelPrefix = "traefik."
 	// LabelDomain Traefik label
-	LabelDomain = "traefik.domain"
+	LabelDomain = LabelPrefix + "domain"
 	// LabelEnable Traefik label
-	LabelEnable = "traefik.enable"
+	LabelEnable = LabelPrefix + "enable"
 	// LabelPort Traefik label
-	LabelPort = "traefik.port"
+	LabelPort = LabelPrefix + "port"
 	// LabelPortIndex Traefik label
-	LabelPortIndex = "traefik.portIndex"
+	LabelPortIndex = LabelPrefix + "portIndex"
 	// LabelProtocol Traefik label
-	LabelProtocol = "traefik.protocol"
+	LabelProtocol = LabelPrefix + "protocol"
 	// LabelTags Traefik label
-	LabelTags = "traefik.tags"
+	LabelTags = LabelPrefix + "tags"
 	// LabelWeight Traefik label
-	LabelWeight = "traefik.weight"
+	LabelWeight = LabelPrefix + "weight"
 	// LabelFrontendAuthBasic Traefik label
-	LabelFrontendAuthBasic = "traefik.frontend.auth.basic"
+	LabelFrontendAuthBasic = LabelPrefix + "frontend.auth.basic"
 	// LabelFrontendEntryPoints Traefik label
-	LabelFrontendEntryPoints = "traefik.frontend.entryPoints"
+	LabelFrontendEntryPoints = LabelPrefix + "frontend.entryPoints"
 	// LabelFrontendPassHostHeader Traefik label
-	LabelFrontendPassHostHeader = "traefik.frontend.passHostHeader"
+	LabelFrontendPassHostHeader = LabelPrefix + "frontend.passHostHeader"
 	// LabelFrontendPriority Traefik label
-	LabelFrontendPriority = "traefik.frontend.priority"
+	LabelFrontendPriority = LabelPrefix + "frontend.priority"
 	// LabelFrontendRule Traefik label
-	LabelFrontendRule = "traefik.frontend.rule"
+	LabelFrontendRule = LabelPrefix + "frontend.rule"
 	// LabelFrontendRuleType Traefik label
-	LabelFrontendRuleType = "traefik.frontend.rule.type"
+	LabelFrontendRuleType = LabelPrefix + "frontend.rule.type"
 	// LabelTraefikFrontendValue Traefik label
-	LabelTraefikFrontendValue = "traefik.frontend.value"
+	LabelTraefikFrontendValue = LabelPrefix + "frontend.value"
 	// LabelTraefikFrontendWhitelistSourceRange Traefik label
-	LabelTraefikFrontendWhitelistSourceRange = "traefik.frontend.whitelistSourceRange"
+	LabelTraefikFrontendWhitelistSourceRange = LabelPrefix + "frontend.whitelistSourceRange"
 	// LabelBackend Traefik label
-	LabelBackend = "traefik.backend"
+	LabelBackend = LabelPrefix + "backend"
 	// LabelBackendID Traefik label
-	LabelBackendID = "traefik.backend.id"
+	LabelBackendID = LabelPrefix + "backend.id"
 	// LabelTraefikBackendCircuitbreaker Traefik label
-	LabelTraefikBackendCircuitbreaker = "traefik.backend.circuitbreaker"
+	LabelTraefikBackendCircuitbreaker = LabelPrefix + "backend.circuitbreaker"
 	// LabelBackendCircuitbreakerExpression Traefik label
-	LabelBackendCircuitbreakerExpression = "traefik.backend.circuitbreaker.expression"
+	LabelBackendCircuitbreakerExpression = LabelPrefix + "backend.circuitbreaker.expression"
 	// LabelBackendHealthcheckPath Traefik label
-	LabelBackendHealthcheckPath = "traefik.backend.healthcheck.path"
+	LabelBackendHealthcheckPath = LabelPrefix + "backend.healthcheck.path"
 	// LabelBackendHealthcheckInterval Traefik label
-	LabelBackendHealthcheckInterval = "traefik.backend.healthcheck.interval"
+	LabelBackendHealthcheckInterval = LabelPrefix + "backend.healthcheck.interval"
 	// LabelBackendLoadbalancerMethod Traefik label
-	LabelBackendLoadbalancerMethod = "traefik.backend.loadbalancer.method"
+	LabelBackendLoadbalancerMethod = LabelPrefix + "backend.loadbalancer.method"
 	// LabelBackendLoadbalancerSticky Traefik label
-	LabelBackendLoadbalancerSticky = "traefik.backend.loadbalancer.sticky"
+	LabelBackendLoadbalancerSticky = LabelPrefix + "backend.loadbalancer.sticky"
 	// LabelBackendMaxconnAmount Traefik label
-	LabelBackendMaxconnAmount = "traefik.backend.maxconn.amount"
+	LabelBackendMaxconnAmount = LabelPrefix + "backend.maxconn.amount"
 	// LabelBackendMaxconnExtractorfunc Traefik label
-	LabelBackendMaxconnExtractorfunc = "traefik.backend.maxconn.extractorfunc"
+	LabelBackendMaxconnExtractorfunc = LabelPrefix + "backend.maxconn.extractorfunc"
 )
+
+//ServiceLabel converts a key value of Label*, given a serviceName, into a pattern <LabelPrefix>.<serviceName>.<property>
+//    i.e. For LabelFrontendRule and serviceName=app it will return "traefik.app.frontend.rule"
+func ServiceLabel(key, serviceName string) string {
+	if len(serviceName) > 0 {
+		property := strings.TrimPrefix(key, LabelPrefix)
+		return LabelPrefix + serviceName + "." + property
+	}
+	return key
+}