traefik/values.yaml

# Helm values for Traefik, the ingress controller replacing ingress-nginx.
#
#   helm upgrade --install traefik traefik --repo https://traefik.github.io/charts \
#     --version 42.1.3 -n traefik --create-namespace -f traefik/values.yaml
#
# Traefik serves the existing Ingress objects of class "nginx" through its
# ingress-nginx compatibility provider, so the Ingresses need no changes.
# The CRD provider is enabled for routes that need Traefik middlewares
# (e.g., the cgit rate limit in git/git.yaml).
#
# Both entrypoints run the per-client-IP rate limit from
# traefik/middlewares.yaml, which must be applied before this release.

deployment:
  replicas: 1

# Single node with hostPorts: the old pod must release the ports before the
# new one can start.
updateStrategy:
  type: RollingUpdate
  rollingUpdate:
    maxSurge: 0
    maxUnavailable: 1

resources:
  requests:
    cpu: 100m
    memory: 100Mi

# ifirn is occasionally CPU-starved; the default 2s timeout caused liveness
# kills under load.
readinessProbe:
  timeoutSeconds: 5
livenessProbe:
  timeoutSeconds: 5

accessLog:
  enabled: true

ingressClass:
  # The "nginx" IngressClass (traefik/ingressclass.yaml) is kept instead.
  enabled: false

providers:
  kubernetesCRD:
    enabled: true
    allowCrossNamespace: false
  kubernetesIngress:
    enabled: false
  kubernetesIngressNGINX:
    enabled: true
    ingressClass: nginx
    controllerClass: k8s.io/ingress-nginx
    # Defaults carried over from the old ingress-nginx ConfigMap.
    proxyBufferSize: 65536
    proxyRequestBuffering: true

service:
  spec:
    type: NodePort

ports:
  web:
    hostPort: 80
    http:
      aliasHeadersStrategy: delete
      middlewares: &middlewares
      - traefik-ratelimit-per-ip@kubernetescrd
      encodedCharacters: &encodedCharacters
        allowEncodedBackSlash: true
        allowEncodedHash: true
        allowEncodedPercent: true
        allowEncodedQuestionMark: true
        allowEncodedSemicolon: true
        allowEncodedSlash: true
  websecure:
    hostPort: 443
    http:
      aliasHeadersStrategy: delete
      middlewares: *middlewares
      encodedCharacters: *encodedCharacters