traefik

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

# Default values for Traefik

# This is a YAML-formatted file.

# Declare variables to be passed into templates

image: # @schema additionalProperties: false

# -- Traefik image host registry. Defaults to `docker.io` for Traefik Proxy and `ghcr.io` for Traefik Hub (when `hub.enabled` is true).

registry: cgr.dev # @schema type:[string, null]

# -- Traefik image repository. Defaults to `traefik` for Traefik Proxy and `traefik/traefik-hub` for Traefik Hub (when `hub.enabled` is true).

repository: chainguard-private/traefik # @schema type:[string, null]

# -- defaults to appVersion. It's used for version checking, even prefixed with experimental- or latest-.

# To pin by digest, prefer `image.digest`. A `<version>@<digest>` combo is also accepted here; in that case the digest is what Kubernetes verifies and the version is informational (and can drift from the underlying image).

tag: 3.7.13@sha256:9a33b2de0ddfcbc27a98dbfec399e7cf1a56c47ed72f23c27f44195078adecdf # @schema type:[string, null]

# -- Traefik image digest (e.g. `sha256:abc...`). When set, takes precedence over `tag`. Set `versionOverride` alongside it so the chart's version-checking logic knows the version (it cannot be derived from the digest).

digest: # @schema type:[string, null]; pattern:^sha256:[a-f0-9]{64}$

# -- Traefik image pull policy

pullPolicy: IfNotPresent

# -- Add additional label to all resources

commonLabels: {}

deployment:

# -- Enable deployment

enabled: true

# -- Deployment or DaemonSet

kind: Deployment

# -- Number of pods of the deployment (only applies when kind == Deployment).

# Set to null to omit spec.replicas, e.g. when an external controller (HPA/KEDA) owns scaling.

replicas: 1 # @schema type:[integer, null];minimum:0

# -- (int) Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10)

revisionHistoryLimit: # @schema type:[integer, null];minimum:0

# -- Amount of time (in seconds) before Kubernetes will send the SIGKILL signal if Traefik does not shut down

terminationGracePeriodSeconds: 60

# -- The minimum number of seconds Traefik needs to be up and running before the DaemonSet/Deployment controller considers it available

minReadySeconds: 0

# -- (string/int) Override the liveness/readiness port. This is useful to integrate traefik

# with an external Load Balancer that performs healthchecks.

# @default -- `ports.traefik.port`

healthchecksPort: # @schema type:[string, integer, null]; minimum:0

# -- Override the liveness/readiness host. Useful for getting ping to respond on non-default entryPoint.

# @default -- `ports.traefik.hostIP` if set, otherwise Pod IP

healthchecksHost: ""

# -- Override the liveness/readiness scheme. Useful for getting ping to

# respond on websecure entryPoint.

healthchecksScheme: # @schema enum:[HTTP, HTTPS, null]; type:[string, null]; default: HTTP

# -- Override the readiness path.

# @default -- `/ping`

readinessPath: ""

# -- Override the liveness path.

# @default -- `/ping`

livenessPath: ""

# -- Additional deployment annotations (e.g. for jaeger-operator sidecar injection)

annotations: {}

# -- Additional deployment labels (e.g. for filtering deployment by custom labels)

labels: {}

# -- Additional pod annotations (e.g. for mesh injection or prometheus scraping)

# It supports templating. One can set it with values like traefik/name: '{{ template "traefik.name" . }}'

podAnnotations: {}

# -- Additional Pod labels (e.g. for filtering Pod by custom labels)

# It supports templating. One can set it with values like traefik/name: '{{ template "traefik.name" . }}'

podLabels: {}

# -- Additional containers (e.g. for metric offloading sidecars)

additionalContainers: []

# https://docs.datadoghq.com/developers/dogstatsd/unix_socket/?tab=host

# - name: socat-proxy

# image: alpine/socat:1.0.5

# args: ["-s", "-u", "udp-recv:8125", "unix-sendto:/socket/socket"]

# volumeMounts:

# - name: dsdsocket

# mountPath: /socket

# -- Additional volumes available for use with initContainers and additionalContainers

additionalVolumes: []

# - name: dsdsocket

# hostPath:

# path: /var/run/statsd-exporter

# -- Additional initContainers (e.g. for setting file permission as shown below)

initContainers: []

# The "volume-permissions" init container is required if you run into permission issues.

# Related issue: https://github.com/traefik/traefik-helm-chart/issues/396

# - name: volume-permissions

# image: busybox:latest

# command: ["sh", "-c", "touch /data/acme.json; chmod -v 600 /data/acme.json"]

# volumeMounts:

# - name: data

# mountPath: /data

# -- Use process namespace sharing

shareProcessNamespace: false

# -- (bool) Whether to use the host user namespace. Setting this to false enables user namespaces,

# which can improve security by isolating the pod's users from the host.

# See https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/

# @default -- unset (inherits cluster default)

hostUsers: # @schema type:[boolean, null]

# -- Custom pod DNS policy. Apply if `hostNetwork: true`

dnsPolicy: ""

# -- Custom pod [DNS config](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#poddnsconfig-v1-core)

dnsConfig: {}

# -- Custom [host aliases](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/)

hostAliases: []

# -- Pull secret for fetching traefik container image

imagePullSecrets: []

# -- Pod lifecycle actions

lifecycle: {}

100

# preStop:

101

# sleep:

102

# seconds: 20

103

# postStart:

104

# httpGet:

105

# path: /ping

106

# port: 8080

107

# host: localhost

108

# scheme: HTTP

109

# -- Set a runtimeClassName on pod

110

runtimeClassName: ""

111

# -- Percentage of memory limit to set for GOMEMLIMIT, set as decimal (0.9 = 90%, 0.95 = 95% etc). Only takes effect when resources.limits.memory is set. Set to 0 to disable (e.g. when using VPA or setting it via env)

112

goMemLimitPercentage: 0.9

113

tmpVolume:

114

# -- [EmptyDir](https://kubernetes.io/docs/concepts/storage/volumes/#emptydir) options for the tmp volume.

115

emptyDir: {}

116

# -- [Pod Disruption Budget](https://kubernetes.io/docs/reference/kubernetes-api/policy-resources/pod-disruption-budget-v1/)

117

# @default -- See _values.yaml_

118

podDisruptionBudget: # @schema additionalProperties: false

119

enabled: false

120

maxUnavailable: # @schema type:[string, integer, null];minimum:0

121

minAvailable: # @schema type:[string, integer, null];minimum:0

122

ingressClass: # @schema additionalProperties: false

123

# -- Create a default IngressClass for Traefik

124

enabled: true

125

isDefaultClass: true

126

127

core: # @schema additionalProperties: false

128

# -- Can be used to use globally v2 router syntax. Deprecated since v3.4 /!\.

129

# See https://doc.traefik.io/traefik/v3.0/migration/v2-to-v3/#new-v3-syntax-notable-changes

130

defaultRuleSyntax: ""

131

# -- Disables the unsafe fallback to default TLS options on conflict, mitigating [GHSA-g55h-rg46-x9c5](https://github.com/traefik/traefik/security/advisories/GHSA-g55h-rg46-x9c5). Requires traefik v3.7.11+.

132

strictTLSOptions: false

133

# Traefik experimental features

134

experimental:

135

# -- Defines whether all plugins must be loaded successfully for Traefik to start

136

abortOnPluginFailure: false

137

fastProxy:

138

# -- Enables the FastProxy implementation.

139

enabled: false

140

# -- Enable debug mode for the FastProxy implementation.

141

debug: false

142

kubernetesGateway:

143

# -- Enable traefik experimental GatewayClass CRD

144

enabled: false

145

# -- Enable experimental plugins

146

plugins: {}

147

# -- Enable experimental local plugins

148

localPlugins: {}

149

# -- Enable OTLP logging experimental feature.

150

otlpLogs: false

151

# -- Enable Knative provider experimental feature.

152

knative: false

153

gateway:

154

# -- When providers.kubernetesGateway.enabled, deploy a default gateway

155

enabled: true

156

# -- Set a custom name to gateway

157

158

# -- By default, Gateway is created in the same `Namespace` as Traefik.

159

namespace: ""

160

# -- Additional gateway annotations (e.g. for cert-manager.io/issuer)

161

annotations: {}

162

# -- [Infrastructure](https://kubernetes.io/blog/2023/11/28/gateway-api-ga/#gateway-infrastructure-labels)

163

infrastructure: {}

164

# -- Configure this Gateway as a [Default Gateway](https://kubernetes.io/blog/2025/11/06/gateway-api-v1-4/#introducing-default-gateways)

165

# by setting the `defaultScope` field (e.g. `All` or `Namespace`).

166

defaultScope: null # @schema enum:["All", "None", null]; type:[string, null]; default: null

167

listeners:

168

web:

169

# -- Port is the network port. Multiple listeners may use the same port, subject to the Listener compatibility rules.

170

# The port must match a port declared in ports section.

171

port: 8000

172

# -- Optional hostname. See [Hostname](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Hostname)

173

hostname: ""

174

# Specify expected protocol on this listener. See [ProtocolType](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.ProtocolType)

175

protocol: HTTP

176

# -- (object) Routes are restricted to namespace of the gateway [by default](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.FromNamespaces

177

namespacePolicy: # @schema type:[object, null]

178

# websecure listener is disabled by default because certificateRefs needs to be added,

179

# or you may specify TLS protocol with Passthrough mode and add "--providers.kubernetesGateway.experimentalChannel=true" in additionalArguments section.

180

# websecure:

181

# # -- Port is the network port. Multiple listeners may use the same port, subject to the Listener compatibility rules.

182

# # The port must match a port declared in ports section.

183

# port: 8443

184

# # -- Optional hostname. See [Hostname](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Hostname)

185

# hostname:

186

# # Specify expected protocol on this listener See [ProtocolType](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.ProtocolType)

187

# protocol: HTTPS

188

# # -- Routes are restricted to namespace of the gateway [by default](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.FromNamespaces)

189

# namespacePolicy:

190

# # -- Add certificates for TLS or HTTPS protocols. See [GatewayTLSConfig](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io%2fv1.GatewayTLSConfig)

191

# certificateRefs:

192

# # -- TLS behavior for the TLS session initiated by the client. See [TLSModeType](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.TLSModeType).

193

# mode:

194

gatewayClass: # @schema additionalProperties: false

195

# -- When providers.kubernetesGateway.enabled and gateway.enabled, deploy a default gatewayClass

196

enabled: true

197

# -- Set a custom name to GatewayClass

198

199

# -- Additional gatewayClass labels (e.g. for filtering gateway objects by custom labels)

200

labels: {}

201

api: # @schema additionalProperties: false

202

# -- Enable the dashboard

203

dashboard: true

204

# -- Custom name for the dashboard (v3.7+).

205

dashboardName: "" # @schema type:[string, null]

206

# -- (bool) Disable the advertisement from the dashboard.

207

disableDashboardAd: # @schema type:[boolean, null]

208

# -- (bool) Enable the insecure API (HTTP)

209

insecure: # @schema type:[boolean, null]

210

# -- (bool) Enable the debug API

211

debug: # @schema type:[boolean, null]

212

# -- Configure API basePath

213

basePath: "" # @schema type:[string, null]; default: "/"

214

# -- Only dashboard & healthcheck IngressRoute are supported.

215

# It's recommended to create workloads CR outside of this Chart.

216

# @default -- See _values.yaml_

217

ingressRoute:

218

dashboard:

219

# -- Create an IngressRoute for the dashboard

220

enabled: false

221

# -- Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class)

222

annotations: {}

223

# -- Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels)

224

labels: {}

225

# -- The router match rule used for the dashboard ingressRoute

226

matchRule: PathPrefix(`/dashboard`) || PathPrefix(`/api`)

227

# -- The internal service used for the dashboard ingressRoute

228

# @default -- api@internal

229

services:

230

- name: api@internal

231

kind: TraefikService

232

# -- Specify the allowed entrypoints to use for the dashboard ingress route, (e.g. traefik, web, websecure).

233

# By default, it's using traefik entrypoint, which is not exposed.

234

# /!\ Do not expose your dashboard without any protection over the internet /!\

235

entryPoints: ["traefik"]

236

# -- Additional ingressRoute middlewares (e.g. for authentication)

237

middlewares: []

238

# -- TLS options (e.g. secret containing certificate)

239

tls: {}

240

healthcheck:

241

# -- Create an IngressRoute for the healthcheck probe

242

enabled: false

243

# -- Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class)

244

annotations: {}

245

# -- Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels)

246

labels: {}

247

# -- The router match rule used for the healthcheck ingressRoute

248

matchRule: PathPrefix(`/ping`)

249

# -- The internal service used for the healthcheck ingressRoute

250

# @default -- ping@internal

251

services:

252

- name: ping@internal

253

kind: TraefikService

254

# -- Specify the allowed entrypoints to use for the healthcheck ingress route, (e.g. traefik, web, websecure).

255

# By default, it's using traefik entrypoint, which is not exposed.

256

entryPoints: ["traefik"]

257

# -- Additional ingressRoute middlewares (e.g. for authentication)

258

middlewares: []

259

# -- TLS options (e.g. secret containing certificate)

260

tls: {}

261

updateStrategy: # @schema additionalProperties: false

262

# -- Customize updateStrategy of Deployment or DaemonSet

263

type: RollingUpdate

264

rollingUpdate:

265

maxUnavailable: 0 # @schema type:[integer, string, null]

266

maxSurge: 1 # @schema type:[integer, string, null]

267

readinessProbe: # @schema additionalProperties: false

268

# -- The number of consecutive failures allowed before considering the probe as failed.

269

failureThreshold: 1

270

# -- The number of seconds to wait before starting the first probe.

271

initialDelaySeconds: 2

272

# -- The number of seconds to wait between consecutive probes.

273

periodSeconds: 10

274

# -- The minimum consecutive successes required to consider the probe successful.

275

successThreshold: 1

276

# -- The number of seconds to wait for a probe response before considering it as failed.

277

timeoutSeconds: 2

278

livenessProbe: # @schema additionalProperties: false

279

# -- The number of consecutive failures allowed before considering the probe as failed.

280

failureThreshold: 3

281

# -- The number of seconds to wait before starting the first probe.

282

initialDelaySeconds: 2

283

# -- The number of seconds to wait between consecutive probes.

284

periodSeconds: 10

285

# -- The minimum consecutive successes required to consider the probe successful.

286

successThreshold: 1

287

# -- The number of seconds to wait for a probe response before considering it as failed.

288

timeoutSeconds: 2

289

# -- Define [Startup Probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes)

290

startupProbe: {}

291

# @schema additionalProperties: false

292

providers:

293

# -- Defines the routing precedence between providers. See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/providers/overview/#routing-precedence) for the default order.

294

precedence: []

295

# @schema additionalProperties: false

296

kubernetesCRD:

297

# -- Load Kubernetes IngressRoute provider

298

enabled: true

299

# -- Allows IngressRoute to reference resources in namespace other than theirs

300

allowCrossNamespace: false

301

# -- Allows to reference ExternalName services in IngressRoute

302

allowExternalNameServices: false

303

# -- Allows to return 503 when there are no endpoints available

304

allowEmptyServices: true

305

# -- List of namespaces from which IngressRoute, IngressRouteTCP, IngressRouteUDP, and TraefikService are allowed to declare cross-provider references. Requires traefik v3.7.1+.

306

crossProviderNamespaces: []

307

# -- Restricts the namespace where the cluster-wide TLSOption and TLSStore named `default` can be defined. When empty, any namespace is allowed. Requires traefik v3.7.11+.

308

defaultTLSResourcesNamespace: ""

309

# -- When the parameter is set, only resources containing an annotation with the same value are processed. Otherwise, resources missing the annotation, having an empty value, or the value traefik are processed. It will also set required annotation on Dashboard and Healthcheck IngressRoute when enabled.

310

ingressClass: ""

311

# -- See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-ingress/#opt-providers-kubernetesIngress-labelselector)

312

labelSelector: ""

313

# -- Array of namespaces to watch. If left empty, Traefik watches all namespaces. . When using `rbac.namespaced`, it will watch helm release namespace and namespaces listed in this array.

314

namespaces: []

315

# -- Defines whether to use Native Kubernetes load-balancing mode by default.

316

nativeLBByDefault: false

317

# -- Enables collision-safe naming. ⚠️ It can be breaking, see [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-crd/#safenaming). Requires traefik v3.7.11+.

318

safeNaming: false

319

# @schema additionalProperties: false

320

kubernetesIngress:

321

# -- Load Kubernetes Ingress provider

322

enabled: true

323

# -- Allows to reference ExternalName services in Ingress

324

allowExternalNameServices: false

325

# -- Allows to return 503 when there are no endpoints available

326

allowEmptyServices: true

327

# -- List of namespaces from which Ingresses or Services are allowed to declare Middlewares, TLSOptions, or ServersTransport references. Requires traefik v3.7.1+.

328

crossProviderNamespaces: []

329

# -- Only for Traefik v3.0, Deprecated since v3.1. See [upstream documentation](https://doc.traefik.io/traefik/v3.0/providers/kubernetes-ingress/#disableingressclasslookup)

330

disableIngressClassLookup: false

331

# -- When ingressClass is set, only Ingresses containing an annotation with the same value are processed. Otherwise, Ingresses missing the annotation, having an empty value, or the value traefik are processed.

332

ingressClass: # @schema type:[string, null]

333

labelSelector: # @schema type:[string, null]

334

# -- Array of namespaces to watch. If left empty, Traefik watches all namespaces. . When using `rbac.namespaced`, it will watch helm release namespace and namespaces listed in this array.

335

namespaces: []

336

# IP used for Kubernetes Ingress endpoints

337

publishedService:

338

# -- Enable [publishedService](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-ingress/#ingressendpointpublishedservice),

339

# usually with the Service provided by this Chart. It's possible to use it with an external Service using pathOverride.

340

enabled: true

341

# -- Override path of Kubernetes Service used to copy status from. Format: namespace/servicename.

342

# Default to Service deployed with this Chart.

343

pathOverride: ""

344

# @schema additionalProperties: false

345

ingressEndpoint:

346

# -- Hostname used for Kubernetes Ingress endpoints

347

hostname: "" # @schema type:[string, null]

348

# -- IP used for Kubernetes Ingress endpoints

349

ip: "" # @schema type:[string, null]

350

# -- Defines whether to use Native Kubernetes load-balancing mode by default.

351

nativeLBByDefault: false

352

# -- Defines whether to make prefix matching strictly comply with the Kubernetes Ingress specification.

353

strictPrefixMatching: false

354

# @schema additionalProperties: false

355

kubernetesGateway:

356

# -- Enable Traefik Gateway provider for Gateway API

357

enabled: false

358

# -- List of namespaces from which Gateway API routes are allowed to declare TraefikService backendRef references. Requires traefik v3.7.1+.

359

crossProviderNamespaces: []

360

# -- Toggles support for the Experimental Channel resources (Gateway API release channels documentation).

361

# This option currently enables support for TCPRoute and TLSRoute.

362

experimentalChannel: false

363

# -- Array of namespaces to watch. If left empty, Traefik watches all namespaces. kubernetesGateway provider requires ClusterRole and as a consequence `rbac.namespaced` is not supported.

364

namespaces: []

365

# -- A label selector can be defined to filter on specific GatewayClass objects only.

366

labelSelector: ""

367

# -- Defines whether to use Native Kubernetes load-balancing mode by default.

368

nativeLBByDefault: false

369

# -- (int) Maximum QPS to the Kubernetes API server. A negative value disables client-side ratelimiting (v3.7.3+). Defaults to 50.

370

qps: # @schema type:[integer, null]

371

# -- (int) Maximum burst of requests to the Kubernetes API server (v3.7.3+). Defaults to 100.

372

burst: # @schema type:[integer, null]

373

statusAddress:

374

# -- This IP will get copied to the Gateway status.addresses, and currently only supports one IP value (IPv4 or IPv6).

375

ip: ""

376

# -- This Hostname will get copied to the Gateway status.addresses.

377

hostname: ""

378

service:

379

# -- The Kubernetes service to copy status addresses from. When using third parties tools like External-DNS, this option can be used to copy the service loadbalancer.status (containing the service's endpoints IPs) to the gateways. Default to Service of this Chart.

380

enabled: true

381

382

namespace: ""

383

# @schema additionalProperties: false

384

file:

385

# -- Create a file provider

386

enabled: false

387

# -- Allows Traefik to automatically watch for file changes

388

watch: true

389

# -- File content as an object (will be YAML-formatted, go template supported) (see https://doc.traefik.io/traefik/reference/install-configuration/providers/others/file/)

390

content: {}

391

# @schema additionalProperties: false

392

kubernetesIngressNGINX:

393

# -- Enable Kubernetes Ingress NGINX provider

394

enabled: false

395

# -- Ingress Class Controller value this controller satisfies

396

controllerClass: "k8s.io/ingress-nginx"

397

# -- Name of the ingress class this controller satisfies

398

ingressClass: "nginx"

399

# -- Define if Ingress Controller should watch for Ingress Class by Name together with Controller Class

400

ingressClassByName: false

401

# -- Define if Ingress Controller should also watch for Ingresses without an IngressClass or the annotation specified

402

watchIngressWithoutClass: false

403

# -- Single namespace the controller watches for updates to Kubernetes objects. Mutually exclusive with watchNamespaceSelector.

404

watchNamespace: ""

405

# -- Select namespaces the controller watches for updates to Kubernetes objects. Mutually exclusive with watchNamespace.

406

# It requires a ClusterRole to list and watch namespaces, and is therefore incompatible with `rbac.namespaced`.

407

watchNamespaceSelector: ""

408

publishService:

409

# -- Enable publishService. Service fronting the Ingress controller, used to set the load-balancer status of Ingress objects.

410

# Usually the Service provided by this Chart. It's possible to use it with an external Service using pathOverride.

411

enabled: false

412

# -- Override path of Kubernetes Service used to copy status from. Format: namespace/servicename.

413

# Default to Service deployed with this Chart.

414

pathOverride: ""

415

# -- Customized address (or addresses, separated by comma) to set as the load-balancer status of Ingress objects this controller satisfies

416

publishStatusAddress: ""

417

# -- Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form 'namespace/name'

418

defaultBackendService: ""

419

# -- Disable support for Services of type ExternalName

420

disableSvcExternalName: false

421

# -- Ingress refresh throttle duration

422

throttleDuration: ""

423

# -- Kubernetes certificate authority file path (not needed for in-cluster client)

424

certAuthFilePath: ""

425

# -- Kubernetes server endpoint (required for external cluster client)

426

endpoint: ""

427

# -- Kubernetes bearer token (not needed for in-cluster client). It accepts either a token value or a file path to the token

428

token: ""

429

# -- (bool) Defines whether to enable request buffering (default: false)

430

proxyRequestBuffering: null # @schema type:[boolean, null]

431

# -- (int) Default buffer size for reading client request body in bytes (default: 16384)

432

clientBodyBufferSize: # @schema type:[integer, null]

433

# -- (int) Default maximum size of a client request body in bytes (default: 1048576)

434

proxyBodySize: # @schema type:[integer, null]

435

# -- (bool) Defines whether to enable response buffering (default: false)

436

proxyBuffering: null # @schema type:[boolean, null]

437

# -- (int) Default buffer size for reading the response body in bytes (default: 8192)

438

proxyBufferSize: # @schema type:[integer, null]

439

# -- (int) Default number of buffers for reading a response (default: 4)

440

proxyBuffersNumber: # @schema type:[integer, null]

441

# -- (int) Amount of time to wait until a connection to a server can be established. Unitless, in seconds (default: 60)

442

proxyConnectTimeout: # @schema type:[integer, null]

443

# -- (int) Amount of time between two successive read operations. Unitless, in seconds (default: 60)

444

proxyReadTimeout: # @schema type:[integer, null]

445

# -- (int) Amount of time between two successive write operations. Unitless, in seconds (default: 60)

446

proxySendTimeout: # @schema type:[integer, null]

447

# -- Defines in which cases a request should be retried (default: "error timeout")

448

proxyNextUpstream: ""

449

# -- (int) Limits the number of possible tries if the backend server does not reply (default: 3)

450

proxyNextUpstreamTries: # @schema type:[integer, null]

451

# -- (int) Limits the total elapsed time to retry the request. Unitless, in seconds (default: 0)

452

proxyNextUpstreamTimeout: # @schema type:[integer, null]

453

# -- Defines which HTTP status codes should result in calling the default backend to return an error page

454

customHTTPErrors: []

455

# -- (int) Defines the idle timeout for keep-alive connections to upstream servers. Unitless, in seconds (default: 60)

456

upstreamKeepaliveTimeout: # @schema type:[integer, null]

457

# -- (bool) Allow Ingress to reference resources (e.g. ConfigMaps, Secrets) in different namespaces (default: false)

458

allowCrossNamespaceResources: null # @schema type:[boolean, null]

459

# -- List of allowed response headers inside the custom headers annotations

460

globalAllowedResponseHeaders: []

461

# -- URL to the service that provides authentication for all the locations. Per ingress auth-url annotation has precedence over this option.

462

globalAuthUrl: ""

463

# -- When set, the strategy is applied to every generated IPAllowList middleware.

464

# @default -- See below

465

ipAllowListStrategy:

466

# -- Number of trusted proxy hops to skip when extracting the client IP from the X-Forwarded-For header. 0 disables depth-based extraction. (default: 0)

467

depth: 0

468

# -- List of IPs to exclude when scanning the X-Forwarded-For header to find the client IP.

469

excludedIPS: []

470

# -- IPv6 subnet size used to group IPv6 addresses when checking the allow list. 0 disables subnet grouping.

471

ipv6Subnet: 0

472

# -- (bool) Enables parsing and adding -snippet annotations/directives (default: false)

473

allowSnippetAnnotations: null # @schema type:[boolean, null]

474

# -- (bool) Defines whether to reject the entire ingress when any path contains regex characters and pathType is Prefix or Exact (default: true)

475

strictValidatePathType: null # @schema type:[boolean, null]

476

# -- Defines the EntryPoint to use for HTTP requests

477

httpEntryPoint: "web"

478

# -- Defines the EntryPoint to use for HTTPS requests

479

httpsEntryPoint: "websecure"

480

# @schema additionalProperties: false

481

modsec:

482

# -- Enable ModSec engine. Requires Traefik Hub >= v3.20.0-ea.8.

483

enabled: false

484

# -- Enable OWASP Core Rules.

485

owaspCoreRules: false

486

# -- Custom ModSec rules snippet.

487

snippet: ""

488

# @schema additionalProperties: false

489

knative:

490

# -- Enable Knative provider

491

enabled: false

492

# -- Array of namespaces to watch. If left empty, Traefik watches all namespaces. . When using `rbac.namespaced`, it will watch helm release namespace and namespaces listed in this array.

493

namespaces: []

494

# -- Allow filtering Knative Ingress objects

495

labelSelector: ""

496

# -- Add volumes to the traefik pod. The volume name will be passed to tpl.

497

# This can be used to mount a cert pair or a configmap that holds a config.toml file.

498

# After the volume has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg:

499

# `additionalArguments:

500

# - "--providers.file.filename=/config/dynamic.toml"

501

# - "--ping"

502

# - "--ping.entrypoint=web"`

503

volumes: []

504

# - name: public-cert

505

# mountPath: "/certs"

506

# type: secret

507

# - name: '{{ printf "%s-configs" .Release.Name }}'

508

# mountPath: "/config"

509

# type: configMap

510

511

# -- Additional volumeMounts to add to the Traefik container

512

additionalVolumeMounts: []

513

# -- For instance when using a logshipper for access logs

514

# - name: traefik-logs

515

# mountPath: /var/log/traefik

516

517

# -- See [logs reference](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/)

518

log:

519

# -- Set [logs format](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/#opt-log-format)

520

format: # @schema enum:["common", "json", null]; type:[string, null]; default: "common"

521

# By default, the level is set to INFO.

522

# -- Alternative logging levels are TRACE, DEBUG, INFO, WARN, ERROR, FATAL, and PANIC.

523

level: "INFO" # @schema enum:[TRACE,DEBUG,INFO,WARN,ERROR,FATAL,PANIC]; default: "INFO"

524

# -- To write the logs into a log file, use the filePath option.

525

filePath: ""

526

# -- When set to true and format is common, it disables the colorized output.

527

noColor: false

528

otlp:

529

# -- Set to true in order to enable OpenTelemetry on logs. Note that experimental.otlpLogs needs to be enabled.

530

enabled: false

531

# -- Service name used in OTLP backend. Default: traefik.

532

serviceName: # @schema type:[string, null]

533

http:

534

# -- Set to true in order to send logs to the OpenTelemetry Collector using HTTP.

535

enabled: false

536

# -- Format: <scheme>://<host>:<port><path>. Default: https://localhost:4318/v1/logs

537

endpoint: ""

538

# -- Additional headers sent with logs by the reporter to the OpenTelemetry Collector.

539

headers: {}

540

## Defines the TLS configuration used by the reporter to send logs to the OpenTelemetry Collector.

541

tls:

542

# -- The path to the certificate authority, it defaults to the system bundle.

543

ca: ""

544

# -- The path to the public certificate. When using this option, setting the key option is required.

545

cert: ""

546

# -- The path to the private key. When using this option, setting the cert option is required.

547

key: ""

548

# -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

549

insecureSkipVerify: # @schema type:[boolean, null]

550

grpc:

551

# -- Set to true in order to send logs to the OpenTelemetry Collector using gRPC

552

enabled: false

553

# -- Format: <host>:<port>. Default: "localhost:4317"

554

endpoint: ""

555

# -- Allows reporter to send logs to the OpenTelemetry Collector without using a secured protocol.

556

insecure: false

557

## Defines the TLS configuration used by the reporter to send logs to the OpenTelemetry Collector.

558

tls:

559

# -- The path to the certificate authority, it defaults to the system bundle.

560

ca: ""

561

# -- The path to the public certificate. When using this option, setting the key option is required.

562

cert: ""

563

# -- The path to the private key. When using this option, setting the cert option is required.

564

key: ""

565

# -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

566

insecureSkipVerify: # @schema type:[boolean, null]

567

# -- Defines additional resource attributes to be sent to the collector.

568

resourceAttributes: {}

569

# -- See [access logs reference](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/)

570

accessLog:

571

# -- To enable access logs

572

enabled: false

573

# -- Set [access log format](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/#opt-accesslog-format)

574

format: # @schema enum:["common", "genericCLF", "json", null]; type:[string, null]; default: "common"

575

# filePath: "/var/log/traefik/access.log

576

# -- (int) Set [bufferingSize](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/#opt-accesslog-bufferingSize)

577

bufferingSize: # @schema type:[integer, null]

578

# -- Set [timezone](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/#time-zones)

579

timezone: ""

580

# -- Set [filtering](https://doc.traefik.io/traefik/observe/logs-and-access-logs/#access-log-filters)

581

# @default -- See below

582

filters: # @schema additionalProperties: false

583

# -- Set statusCodes, to limit the access logs to requests with a status codes in the specified range

584

statusCodes: ""

585

# -- Set retryAttempts, to keep the access logs when at least one retry has happened

586

retryAttempts: false

587

# -- Set minDuration, to keep access logs when requests take longer than the specified duration

588

minDuration: ""

589

# -- Enables accessLogs for internal resources. Default: false.

590

addInternals: false

591

# -- Enables access log output alongside OTLP (v3.7+).

592

dualOutput: false

593

fields:

594

# -- Set default mode for fields.names

595

defaultMode: keep # @schema enum:[keep, drop, redact]; default: keep

596

# -- Names of the fields to limit.

597

names: {}

598

headers:

599

# -- [Limit logged fields or headers](https://doc.traefik.io/traefik/observe/logs-and-access-logs/#log-fields-customization)

600

defaultMode: drop # @schema enum:[keep, drop, redact]; default: drop

601

names: {}

602

queryParameters:

603

# -- Keep or drop all query parameters in the RequestPath access log field (v3.7.3+).

604

defaultMode: # @schema enum:[keep, drop, null]; type:[string, null]; default: null

605

otlp:

606

# -- Set to true in order to enable OpenTelemetry on access logs. Note that experimental.otlpLogs needs to be enabled.

607

enabled: false

608

# -- Service name used in OTLP backend. Default: traefik.

609

serviceName: # @schema type:[string, null]

610

http:

611

# -- Set to true in order to send access logs to the OpenTelemetry Collector using HTTP.

612

enabled: false

613

# -- Format: <scheme>://<host>:<port><path>. Default: https://localhost:4318/v1/logs

614

endpoint: ""

615

# -- Additional headers sent with access logs by the reporter to the OpenTelemetry Collector.

616

headers: {}

617

## Defines the TLS configuration used by the reporter to send access logs to the OpenTelemetry Collector.

618

tls:

619

# -- The path to the certificate authority, it defaults to the system bundle.

620

ca: ""

621

# -- The path to the public certificate. When using this option, setting the key option is required.

622

cert: ""

623

# -- The path to the private key. When using this option, setting the cert option is required.

624

key: ""

625

# -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

626

insecureSkipVerify: # @schema type:[boolean, null]

627

grpc:

628

# -- Set to true in order to send access logs to the OpenTelemetry Collector using gRPC

629

enabled: false

630

# -- Format: <host>:<port>. Default: "localhost:4317"

631

endpoint: ""

632

# -- Allows reporter to send access logs to the OpenTelemetry Collector without using a secured protocol.

633

insecure: false

634

## Defines the TLS configuration used by the reporter to send access logs to the OpenTelemetry Collector.

635

tls:

636

# -- The path to the certificate authority, it defaults to the system bundle.

637

ca: ""

638

# -- The path to the public certificate. When using this option, setting the key option is required.

639

cert: ""

640

# -- The path to the private key. When using this option, setting the cert option is required.

641

key: ""

642

# -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

643

insecureSkipVerify: # @schema type:[boolean, null]

644

# -- Defines additional resource attributes to be sent to the collector.

645

resourceAttributes: {}

646

metrics:

647

# -- Enable metrics for internal resources. Default: false

648

addInternals: false

649

## Prometheus is enabled by default.

650

## It can be disabled by setting "prometheus: null"

651

prometheus:

652

# -- Entry point used to expose metrics.

653

entryPoint: metrics

654

# -- (bool) Enable metrics on entry points. Default: true

655

addEntryPointsLabels: # @schema type:[boolean, null]

656

# -- (bool) Enable metrics on routers. Default: false

657

addRoutersLabels: # @schema type:[boolean, null]

658

# -- (bool) Enable metrics on services. Default: true

659

addServicesLabels: # @schema type:[boolean, null]

660

# -- Buckets for latency metrics. Default="0.1,0.3,1.2,5.0"

661

buckets: ""

662

# -- When manualRouting is true, it disables the default internal router in

663

## order to allow creating a custom router for prometheus@internal service.

664

manualRouting: false

665

# -- Add HTTP header labels to metrics. See EXAMPLES.md or upstream doc for usage.

666

headerLabels: {} # @schema type:[object, null]

667

service:

668

# -- Create a dedicated metrics service to use with ServiceMonitor

669

enabled: false

670

labels: {}

671

annotations: {}

672

# -- (bool) When set to true, it won't check if Prometheus Operator CRDs are deployed

673

disableAPICheck: # @schema type:[boolean, null]

674

serviceMonitor:

675

# -- Enable optional CR for Prometheus Operator. See EXAMPLES.md for more details.

676

enabled: false

677

apiVersion: "monitoring.coreos.com/v1"

678

metricRelabelings: []

679

relabelings: []

680

jobLabel: ""

681

interval: ""

682

honorLabels: false

683

scrapeTimeout: ""

684

honorTimestamps: false

685

enableHttp2: false

686

followRedirects: false

687

additionalLabels: {}

688

namespace: ""

689

namespaceSelector: {}

690

prometheusRule:

691

# -- Enable optional CR for Prometheus Operator. See EXAMPLES.md for more details.

692

enabled: false

693

apiVersion: "monitoring.coreos.com/v1"

694

additionalLabels: {}

695

namespace: ""

696

# datadog:

697

# ## Address instructs exporter to send metrics to datadog-agent at this address.

698

# address: "127.0.0.1:8125"

699

# ## The interval used by the exporter to push metrics to datadog-agent. Default=10s

700

# # pushInterval: 30s

701

# ## The prefix to use for metrics collection. Default="traefik"

702

# # prefix: traefik

703

# ## Enable metrics on entry points. Default=true

704

# # addEntryPointsLabels: false

705

# ## Enable metrics on routers. Default=false

706

# # addRoutersLabels: true

707

# ## Enable metrics on services. Default=true

708

# # addServicesLabels: false

709

# influxdb2:

710

# ## Address instructs exporter to send metrics to influxdb v2 at this address.

711

# address: localhost:8086

712

# ## Token with which to connect to InfluxDB v2.

713

# token: xxx

714

# ## Organisation where metrics will be stored.

715

# org: ""

716

# ## Bucket where metrics will be stored.

717

# bucket: ""

718

# ## The interval used by the exporter to push metrics to influxdb. Default=10s

719

# # pushInterval: 30s

720

# ## Additional labels (influxdb tags) on all metrics.

721

# # additionalLabels:

722

# # env: production

723

# # foo: bar

724

# ## Enable metrics on entry points. Default=true

725

# # addEntryPointsLabels: false

726

# ## Enable metrics on routers. Default=false

727

# # addRoutersLabels: true

728

# ## Enable metrics on services. Default=true

729

# # addServicesLabels: false

730

# statsd:

731

# ## Address instructs exporter to send metrics to statsd at this address.

732

# address: localhost:8125

733

# ## The interval used by the exporter to push metrics to influxdb. Default=10s

734

# # pushInterval: 30s

735

# ## The prefix to use for metrics collection. Default="traefik"

736

# # prefix: traefik

737

# ## Enable metrics on entry points. Default=true

738

# # addEntryPointsLabels: false

739

# ## Enable metrics on routers. Default=false

740

# # addRoutersLabels: true

741

# ## Enable metrics on services. Default=true

742

# # addServicesLabels: false

743

otlp:

744

# -- Set to true in order to enable the OpenTelemetry metrics

745

enabled: false

746

# -- (bool) Enable metrics on entry points. Default: true

747

addEntryPointsLabels: # @schema type:[boolean, null]

748

# -- (bool) Enable metrics on routers. Default: false

749

addRoutersLabels: # @schema type:[boolean, null]

750

# -- (bool) Enable metrics on services. Default: true

751

addServicesLabels: # @schema type:[boolean, null]

752

# -- Explicit boundaries for Histogram data points. Default: [.005, .01, .025, .05, .1, .25, .5, 1, 2.5, 5, 10]

753

explicitBoundaries: []

754

# -- Interval at which metrics are sent to the OpenTelemetry Collector. Default: 10s

755

pushInterval: ""

756

# -- Service name used in OTLP backend. Default: traefik.

757

serviceName: # @schema type:[string, null]

758

http:

759

# -- Set to true in order to send metrics to the OpenTelemetry Collector using HTTP.

760

enabled: false

761

# -- Format: <scheme>://<host>:<port><path>. Default: https://localhost:4318/v1/metrics

762

endpoint: ""

763

# -- Additional headers sent with metrics by the reporter to the OpenTelemetry Collector.

764

headers: {}

765

## Defines the TLS configuration used by the reporter to send metrics to the OpenTelemetry Collector.

766

tls:

767

# -- The path to the certificate authority, it defaults to the system bundle.

768

ca: ""

769

# -- The path to the public certificate. When using this option, setting the key option is required.

770

cert: ""

771

# -- The path to the private key. When using this option, setting the cert option is required.

772

key: ""

773

# -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

774

insecureSkipVerify: # @schema type:[boolean, null]

775

grpc:

776

# -- Set to true in order to send metrics to the OpenTelemetry Collector using gRPC

777

enabled: false

778

# -- Format: <host>:<port>. Default: "localhost:4317"

779

endpoint: ""

780

# -- Allows reporter to send metrics to the OpenTelemetry Collector without using a secured protocol.

781

insecure: false

782

## Defines the TLS configuration used by the reporter to send metrics to the OpenTelemetry Collector.

783

tls:

784

# -- The path to the certificate authority, it defaults to the system bundle.

785

ca: ""

786

# -- The path to the public certificate. When using this option, setting the key option is required.

787

cert: ""

788

# -- The path to the private key. When using this option, setting the cert option is required.

789

key: ""

790

# -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

791

insecureSkipVerify: # @schema type:[boolean, null]

792

# -- Defines additional resource attributes to be sent to the collector.

793

resourceAttributes: {}

794

ocsp:

795

# -- Enable OCSP stapling support.

796

# See https://doc.traefik.io/traefik/reference/install-configuration/tls/ocsp/

797

enabled: false

798

# -- Defines the OCSP responder URLs to use instead of the one provided by the certificate.

799

responderOverrides: {}

800

## Tracing

801

# -- https://doc.traefik.io/traefik/reference/install-configuration/observability/tracing/

802

# @default -- See _values.yaml_

803

tracing: # @schema additionalProperties: false

804

# -- Enables tracing for internal resources. Default: false.

805

addInternals: false

806

# -- Service name used in selected backend. Default: traefik.

807

serviceName: # @schema type:[string, null]

808

# -- Defines additional resource attributes to be sent to the collector.

809

resourceAttributes: {}

810

# -- Defines the list of request headers to add as attributes. It applies to client and server kind spans.

811

capturedRequestHeaders: []

812

# -- Defines the list of response headers to add as attributes. It applies to client and server kind spans.

813

capturedResponseHeaders: []

814

# -- By default, all query parameters are redacted. Defines the list of query parameters to not redact.

815

safeQueryParams: []

816

# -- (float) The proportion of requests to trace, specified between 0.0 and 1.0. Default: 1.0.

817

sampleRate: # @schema type:[number, null]; minimum:0; maximum:1

818

otlp:

819

# -- See https://doc.traefik.io/traefik/reference/install-configuration/observability/tracing/#configuration-options

820

enabled: false

821

http:

822

# -- Set to true in order to send metrics to the OpenTelemetry Collector using HTTP.

823

enabled: false

824

# -- Format: <scheme>://<host>:<port><path>. Default: https://localhost:4318/v1/tracing

825

endpoint: ""

826

# -- Additional headers sent with metrics by the reporter to the OpenTelemetry Collector.

827

headers: {}

828

## Defines the TLS configuration used by the reporter to send metrics to the OpenTelemetry Collector.

829

tls:

830

# -- The path to the certificate authority, it defaults to the system bundle.

831

ca: ""

832

# -- The path to the public certificate. When using this option, setting the key option is required.

833

cert: ""

834

# -- The path to the private key. When using this option, setting the cert option is required.

835

key: ""

836

# -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

837

insecureSkipVerify: # @schema type:[boolean, null]

838

grpc:

839

# -- Set to true in order to send metrics to the OpenTelemetry Collector using gRPC

840

enabled: false

841

# -- Format: <host>:<port>. Default: "localhost:4317"

842

endpoint: ""

843

# -- Allows reporter to send metrics to the OpenTelemetry Collector without using a secured protocol.

844

insecure: false

845

## Defines the TLS configuration used by the reporter to send metrics to the OpenTelemetry Collector.

846

tls:

847

# -- The path to the certificate authority, it defaults to the system bundle.

848

ca: ""

849

# -- The path to the public certificate. When using this option, setting the key option is required.

850

cert: ""

851

# -- The path to the private key. When using this option, setting the cert option is required.

852

key: ""

853

# -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

854

insecureSkipVerify: # @schema type:[boolean, null]

855

global:

856

checkNewVersion: true

857

# -- Please take time to consider whether or not you wish to share anonymous data with us

858

# See https://doc.traefik.io/traefik/contributing/data-collection/

859

sendAnonymousUsage: false

860

# -- Disable appending RemoteAddr to X-Forwarded-For header globally (v3.7+).

861

notAppendXForwardedFor: false

862

# -- Required for Azure Marketplace integration.

863

# See https://learn.microsoft.com/en-us/partner-center/marketplace-offers/azure-container-technical-assets-kubernetes?tabs=linux,linux2#update-the-helm-chart

864

# @default -- See _values.yaml_

865

azure:

866

enabled: false

867

images:

868

proxy:

869

image: chainguard-private/traefik

870

tag: 3.7.13@sha256:9a33b2de0ddfcbc27a98dbfec399e7cf1a56c47ed72f23c27f44195078adecdf

871

registry: cgr.dev

872

hub:

873

image: chainguard-private/traefik

874

tag: 3.7.13@sha256:9a33b2de0ddfcbc27a98dbfec399e7cf1a56c47ed72f23c27f44195078adecdf

875

registry: cgr.dev

876

# -- Additional arguments to be passed at Traefik's binary

877

# See [CLI Reference](https://docs.traefik.io/reference/static-configuration/cli/)

878

# Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"`

879

additionalArguments: []

880

# - "--providers.kubernetesingress.ingressclass=traefik-internal"

881

# - "--log.level=DEBUG"

882

883

# -- Additional Environment variables to be passed to Traefik's binary

884

env: []

885

# -- Environment variables to be passed to Traefik's binary from configMaps or secrets

886

envFrom: []

887

# @schema mergeProperties: true

888

ports:

889

# @schema additionalProperties: false

890

traefik:

891

port: 8080

892

# -- (int) Use hostPort if set.

893

hostPort: # @schema type:[integer, null]; minimum:0

894

# -- Use hostIP if set. If not set, Kubernetes will default to 0.0.0.0, which

895

# means it's listening on all your interfaces and all your IPs. You may want

896

# to set this value if you need traefik to listen on specific interface

897

# only.

898

hostIP: # @schema type:[string, null]

899

# Defines whether the port is exposed if service.type is LoadBalancer or

900

# NodePort.

901

902

# -- You SHOULD NOT expose the traefik port on production deployments.

903

# If you want to access it from outside your cluster,

904

# use `kubectl port-forward` or create a secure ingress

905

expose:

906

default: false

907

# -- The exposed port for this service

908

exposedPort: 8080

909

# -- The port protocol (TCP/UDP)

910

protocol: TCP

911

observability: # @schema additionalProperties: false

912

# -- (bool) Defines whether a router attached to this EntryPoint produces metrics by default.

913

metrics: # @schema type:[boolean, null]; default: true

914

# -- (bool) Defines whether a router attached to this EntryPoint produces access-logs by default.

915

accessLogs: # @schema type:[boolean, null]; default: true

916

# -- (bool) Defines whether a router attached to this EntryPoint produces traces by default.

917

tracing: # @schema type:[boolean, null]; default: true

918

# -- Defines the tracing verbosity level for routers attached to this EntryPoint.

919

traceVerbosity: # @schema enum:[minimal, detailed, null]; type:[string, null]; default: minimal

920

web:

921

# -- (bool) Enable this entrypoint as a default entrypoint. When a service doesn't explicitly set an entrypoint it will only use this entrypoint.

922

asDefault: # @schema type: [boolean, null]; default: null

923

port: 8000

924

# hostPort: 8000

925

# containerPort: 8000

926

expose:

927

default: true

928

exposedPort: 80

929

# -- (string/int) Different target traefik port on the cluster, useful for IP type LB

930

targetPort: # @schema type:[string, integer, null]; minimum:0

931

# -- The port protocol (TCP/UDP)

932

protocol: TCP

933

# -- (int) See [upstream documentation](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport)

934

nodePort: # @schema type:[integer, null]; minimum:0

935

# -- See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#allowacmebypass)

936

allowACMEByPass: false

937

http:

938

redirections:

939

# -- Port Redirections

940

# Added in 2.2, one can make permanent redirects via entrypoints.

941

# Same sets of parameters: to, scheme, permanent and priority.

942

# https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#configuration-example

943

entryPoint: {}

944

forwardedHeaders:

945

# -- Trust forwarded headers information (X-Forwarded-*).

946

trustedIPs: []

947

insecure: false

948

# -- Disable appending RemoteAddr to X-Forwarded-For header (v3.7+).

949

notAppendXForwardedFor: false

950

proxyProtocol:

951

# -- Enable the Proxy Protocol header parsing for the entry point

952

trustedIPs: []

953

insecure: false

954

# -- Set transport settings for the entrypoint

955

# @default -- nil

956

transport:

957

respondingTimeouts:

958

readTimeout: # @schema type:[string, integer, null]

959

writeTimeout: # @schema type:[string, integer, null]

960

idleTimeout: # @schema type:[string, integer, null]

961

lifeCycle:

962

requestAcceptGraceTimeout: # @schema type:[string, integer, null]

963

graceTimeOut: # @schema type:[string, integer, null]

964

keepAliveMaxRequests: # @schema type:[integer, null]; minimum:0

965

keepAliveMaxTime: # @schema type:[string, integer, null]

966

# -- (bool) Enable this port as an uplink for multi cluster.

967

# ⚠️ This feature is experimental and requires Traefik Hub with a specific subscription.

968

uplink: # @schema type: [boolean, null]; default: null

969

observability: # @schema additionalProperties: false

970

# -- (bool) Enables metrics for this entryPoint.

971

metrics: # @schema type:[boolean, null]; default: true

972

# -- (bool) Enables access-logs for this entryPoint.

973

accessLogs: # @schema type:[boolean, null]; default: true

974

# -- (bool) Enables tracing for this entryPoint.

975

tracing: # @schema type:[boolean, null]; default: true

976

# -- Defines the tracing verbosity level for this entryPoint.

977

traceVerbosity: # @schema enum:[minimal, detailed, null]; type:[string, null]; default: minimal

978

websecure:

979

## -- Enable this entrypoint as a default entrypoint. When a service doesn't explicitly set an entrypoint it will only use this entrypoint.

980

# asDefault: true

981

port: 8443

982

# -- (int) Use hostPort if set.

983

hostPort: # @schema type:[integer, null]; minimum:0

984

# -- (int) Use containerPort if set.

985

containerPort: # @schema type:[integer, null]; minimum:0

986

expose:

987

default: true

988

exposedPort: 443

989

# -- (string/int) Different target traefik port on the cluster, useful for IP type LB

990

targetPort: # @schema type:[string, integer, null]; minimum:0

991

# -- The port protocol (TCP/UDP)

992

protocol: TCP

993

# -- (int) See [upstream documentation](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport)

994

nodePort: # @schema type:[integer, null]; minimum:0

995

# -- See [upstream documentation](https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol)

996

appProtocol: # @schema type:[string, null]

997

# -- See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#allowacmebypass)

998

allowACMEByPass: false

999

http:

1000

# -- See [upstream documentation](https://doc.traefik.io/traefik/security/request-path/#encoded-character-filtering)

1001

# @default -- nil

1002

encodedCharacters: # @schema additionalProperties: false

1003

allowEncodedSlash: # @schema type:[boolean, null]

1004

allowEncodedBackSlash: # @schema type:[boolean, null]

1005

allowEncodedNullCharacter: # @schema type:[boolean, null]

1006

allowEncodedSemicolon: # @schema type:[boolean, null]

1007

allowEncodedPercent: # @schema type:[boolean, null]

1008

allowEncodedQuestionMark: # @schema type:[boolean, null]

1009

allowEncodedHash: # @schema type:[boolean, null]

1010

# -- (int) Maximum size of request headers in bytes. Default: 1048576 (1 MB)

1011

maxHeaderBytes: # @schema type:[integer, null]; minimum:0

1012

# -- See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#httpmiddlewares)

1013

middlewares: [] # @schema type: [array, null]

1014

# -- (bool) See [upstream documentation](https://doc.traefik.io/traefik/security/request-path/#path-sanitization)

1015

sanitizePath: # @schema type:[boolean, null]

1016

# -- Defines how request headers with non-alphanumeric characters in their names are handled (v3.7.12+).

1017

# See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#aliasheadersstrategy)

1018

aliasHeadersStrategy: # @schema enum:[keep, delete, reject, null]; type:[string, null]

1019

# -- Defines how request headers with underscores in their names are handled (v3.7.6-v3.7.11).

1020

# Replaced by the aliasHeadersStrategy option for Traefik v3.7.12+.

1021

# See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#underscoreheadersstrategy)

1022

underscoreHeadersStrategy: # @schema deprecated; enum:[keep, delete, reject, null]; type:[string, null]

1023

tls:

1024

# -- See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-http-tls)

1025

# @default -- true

1026

enabled: true

1027

options: ""

1028

certResolver: ""

1029

domains: []

1030

http3:

1031

# -- Enable HTTP/3 on the entrypoint. It also enables the http3 experimental feature.

1032

# See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-http3).

1033

# There are known limitations when trying to listen on same ports for TCP & UDP ([kubernetes#47249](https://github.com/kubernetes/kubernetes/issues/47249#issuecomment-587960741)): this chart works around it using a dual Service.

1034

enabled: false

1035

# -- (int) Defines the UDP port to advertise as the HTTP/3 authority.

1036

advertisedPort: # @schema type:[integer, null]; minimum:0

1037

forwardedHeaders:

1038

# -- Trust forwarded headers information (X-Forwarded-*).

1039

trustedIPs: []

1040

insecure: false

1041

# -- Disable appending RemoteAddr to X-Forwarded-For header (v3.7+).

1042

notAppendXForwardedFor: false

1043

proxyProtocol:

1044

# -- Enable the Proxy Protocol header parsing for the entry point

1045

trustedIPs: []

1046

insecure: false

1047

# -- Set transport settings for the entrypoint

1048

# @default -- nil

1049

transport:

1050

respondingTimeouts:

1051

readTimeout: # @schema type:[string, integer, null]

1052

writeTimeout: # @schema type:[string, integer, null]

1053

idleTimeout: # @schema type:[string, integer, null]

1054

lifeCycle:

1055

requestAcceptGraceTimeout: # @schema type:[string, integer, null]

1056

graceTimeOut: # @schema type:[string, integer, null]

1057

keepAliveMaxRequests: # @schema type:[integer, null]; minimum:0

1058

keepAliveMaxTime: # @schema type:[string, integer, null]

1059

observability: # @schema additionalProperties: false

1060

# -- (bool) Enables metrics for this entryPoint.

1061

metrics: # @schema type:[boolean, null]; default: true

1062

# -- (bool) Enables access-logs for this entryPoint.

1063

accessLogs: # @schema type:[boolean, null]; default: true

1064

# -- (bool) Enables tracing for this entryPoint.

1065

tracing: # @schema type:[boolean, null]; default: true

1066

# -- Defines the tracing verbosity level for this entryPoint.

1067

traceVerbosity: # @schema enum:[minimal, detailed, null]; type:[string, null]; default: minimal

1068

metrics:

1069

# -- When using hostNetwork, use another port to avoid conflict with node exporter:

1070

# https://github.com/prometheus/prometheus/wiki/Default-port-allocations

1071

port: 9100

1072

# -- You may not want to expose the metrics port on production deployments.

1073

# If you want to access it from outside your cluster,

1074

# use `kubectl port-forward` or create a secure ingress

1075

expose:

1076

default: false

1077

# -- The exposed port for this service

1078

exposedPort: 9100

1079

# -- The port protocol (TCP/UDP)

1080

protocol: TCP

1081

observability: # @schema additionalProperties: false

1082

# -- (bool) Enables metrics for this entryPoint.

1083

metrics: # @schema type:[boolean, null]; default: true

1084

# -- (bool) Enables access-logs for this entryPoint.

1085

accessLogs: # @schema type:[boolean, null]; default: true

1086

# -- (bool) Enables tracing for this entryPoint.

1087

tracing: # @schema type:[boolean, null]; default: true

1088

# -- Defines the tracing verbosity level for this entryPoint.

1089

traceVerbosity: # @schema enum:[minimal, detailed, null]; type:[string, null]; default: minimal

1090

# -- TLS Options are created as [TLSOption CRDs](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/crd/tls/tlsoption/)

1091

# When using `labelSelector`, you'll need to set labels on tlsOption accordingly.

1092

# See EXAMPLE.md for details.

1093

tlsOptions: {}

1094

# -- TLS Store are created as [TLSStore CRDs](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/crd/tls/tlsstore/).

1095

# This is useful if you want to set a default certificate. See EXAMPLE.md for details.

1096

tlsStore: {}

1097

service:

1098

enabled: true

1099

# -- Override the default Service name. Useful for adopting an existing Service (e.g., during migration from another ingress controller).

1100

nameOverride: "" # @schema type:[string, null]

1101

# -- Single service is using `MixedProtocolLBService` feature gate.

1102

# When set to false, it will create two Service, one for TCP and one for UDP.

1103

single: true

1104

# -- Additional annotations applied to both TCP and UDP services (e.g. for cloud provider specific config)

1105

annotations: {}

1106

# -- Additional annotations for TCP service only

1107

annotationsTCP: {}

1108

# -- Additional annotations for UDP service only

1109

annotationsUDP: {}

1110

# -- Additional service labels (e.g. for filtering Service by custom labels)

1111

labels: {}

1112

# -- Additional entries here will be added to the Service [spec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#servicespec-v1-core).

1113

# Cannot contain selector or ports entries.

1114

spec:

1115

type: LoadBalancer

1116

# -- Can be used to create multiple Service.

1117

# See EXAMPLES.md for more details.

1118

additionalServices: {}

1119

autoscaling: # @schema additionalProperties: false

1120

# -- Create HorizontalPodAutoscaler object.

1121

# See EXAMPLES.md for more details.

1122

enabled: false

1123

# -- (int) minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod.

1124

minReplicas: # @schema type:[integer, null]; minimum:0

1125

# -- (int) maxReplicas is the upper limit for the number of pods that can be set by the autoscaler; cannot be smaller than MinReplicas.

1126

maxReplicas: # @schema type:[integer, null]; minimum:0

1127

# -- metrics contains the specifications for which to use to calculate the desired replica count (the maximum replica count across all metrics will be used).

1128

metrics: []

1129

# -- behavior configures the scaling behavior of the target in both Up and Down directions (scaleUp and scaleDown fields respectively).

1130

behavior: {}

1131

# -- scaleTargetRef points to the target resource to scale, and is used for the pods for which metrics should be collected, as well as to actually change the replica count.

1132

# @default -- Traefik Deployment

1133

scaleTargetRef:

1134

apiVersion: apps/v1

1135

kind: Deployment

1136

1137

persistence:

1138

# -- Enable persistence using Persistent Volume Claims

1139

# ref: http://kubernetes.io/docs/user-guide/persistent-volumes/.

1140

# It can be used to store TLS certificates along with `certificatesResolvers.<name>.acme.storage` option

1141

enabled: false

1142

1143

existingClaim: ""

1144

accessMode: ReadWriteOnce

1145

size: 128Mi

1146

storageClass: # @schema type:[string, null]

1147

volumeName: ""

1148

path: /data

1149

annotations: {}

1150

# -- Only mount a subpath of the Volume into the pod

1151

subPath: ""

1152

# -- [EmptyDir](https://kubernetes.io/docs/concepts/storage/volumes/#emptydir) options when persistence is disabled

1153

emptyDir: {}

1154

# -- Certificates resolvers configuration.

1155

# Ref: https://doc.traefik.io/traefik/reference/install-configuration/tls/certificate-resolvers/acme/

1156

# See EXAMPLES.md for more details.

1157

certificatesResolvers: {}

1158

# -- If hostNetwork is true, runs traefik in the host network namespace

1159

# To prevent unschedulable pods due to port collisions, if hostNetwork=true

1160

# and replicas>1, a pod anti-affinity is recommended and will be set if the

1161

# affinity is left as default.

1162

hostNetwork: false

1163

rbac: # @schema additionalProperties: false

1164

# -- Whether Role Based Access Control objects like roles and rolebindings should be created

1165

enabled: true

1166

# -- When set to true: <br />

1167

# 1. It switches respectively the use of `ClusterRole` and `ClusterRoleBinding` to `Role` and `RoleBinding`.<br />

1168

# 2. It adds `disableClusterScopeResources` on Ingress and CRD (Kubernetes) providers<br />

1169

# **NOTE**: `IngressClass`, `NodePortLB` and **Gateway** provider cannot be used with namespaced RBAC. <br />

1170

# See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-ingress/#opt-providers-kubernetesIngress-disableClusterScopeResources) for more details.

1171

namespaced: false

1172

# -- Enable user-facing roles

1173

# https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles

1174

aggregateTo: []

1175

# -- List of Kubernetes secrets that are accessible for Traefik when `rbac.namespaced` is true. If empty, then access is granted to every secret. Ignored when `rbac.namespaced` is false (ClusterRole), since Kubernetes RBAC does not support `resourceNames` on cluster-scoped list/watch rules.

1176

secretResourceNames: []

1177

# -- The service account the pods will use to interact with the Kubernetes API

1178

serviceAccount: # @schema additionalProperties: false

1179

# If set, an existing service account is used

1180

# If not set, a service account is created automatically using the fullname template

1181

1182

# -- Additional serviceAccount annotations (e.g. for oidc authentication)

1183

serviceAccountAnnotations: {}

1184

# -- [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for `traefik` container.

1185

resources: {}

1186

# -- This example pod anti-affinity forces the scheduler to put traefik pods

1187

# -- on nodes where no other traefik pods are scheduled.

1188

# It should be used when hostNetwork: true to prevent port conflicts

1189

affinity: {}

1190

# podAntiAffinity:

1191

# requiredDuringSchedulingIgnoredDuringExecution:

1192

# - labelSelector:

1193

# matchLabels:

1194

# app.kubernetes.io/name: '{{ template "traefik.name" . }}'

1195

# app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'

1196

# topologyKey: kubernetes.io/hostname

1197

1198

# -- nodeSelector is the simplest recommended form of node selection constraint.

1199

nodeSelector: {}

1200

# -- Tolerations allow the scheduler to schedule pods with matching taints.

1201

tolerations: []

1202

# -- You can use topology spread constraints to control

1203

# how Pods are spread across your cluster among failure-domains.

1204

topologySpreadConstraints: []

1205

# This example topologySpreadConstraints forces the scheduler to put traefik pods

1206

# on nodes where no other traefik pods are scheduled.

1207

# - labelSelector:

1208

# matchLabels:

1209

# app.kubernetes.io/name: '{{ template "traefik.name" . }}'

1210

# maxSkew: 1

1211

# topologyKey: kubernetes.io/hostname

1212

# whenUnsatisfiable: DoNotSchedule

1213

1214

# -- [Pod Priority and Preemption](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/)

1215

priorityClassName: ""

1216

# -- [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)

1217

# @default -- See _values.yaml_

1218

securityContext:

1219

allowPrivilegeEscalation: false

1220

capabilities:

1221

drop: [ALL]

1222

readOnlyRootFilesystem: true

1223

# -- [Pod Security Context](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context)

1224

# @default -- See _values.yaml_

1225

podSecurityContext:

1226

runAsGroup: 65532

1227

runAsNonRoot: true

1228

runAsUser: 65532

1229

seccompProfile:

1230

type: RuntimeDefault

1231

1232

# -- Extra objects to deploy (value evaluated as a template)

1233

1234

# In some cases, it can avoid the need for additional, extended or adhoc deployments.

1235

# See #595 for more details and traefik/tests/values/extra.yaml for example.

1236

extraObjects: []

1237

# -- This field overrides the default Release Namespace for Helm.

1238

# It will not affect optional CRDs such as `ServiceMonitor` and `PrometheusRules`

1239

namespaceOverride: ""

1240

# -- This field overrides the default app.kubernetes.io/instance label for all Objects.

1241

instanceLabelOverride: ""

1242

# -- This field overrides the default version extracted from image.tag. Required when pinning by `image.digest`, since the version cannot be derived from a digest.

1243

versionOverride: ""

1244

# -- overrides the app.kubernetes.io/name label

1245

nameOverride: ""

1246

# -- Overrides the resource name for templates (i.e deployment, service, etc..)

1247

fullnameOverride: ""

1248

# Traefik Hub configuration. See https://doc.traefik.io/traefik-hub/

1249

hub: # @schema additionalProperties: false

1250

# -- (bool) Install Traefik Hub. Without `hub.token`, it runs in proxy mode: a drop-in Traefik

1251

# Proxy, which requires Traefik Hub >= v3.21.0-ea.

1252

# @default -- `true` when `hub.token` is set

1253

enabled: # @schema type:[boolean, null]

1254

# -- Name of `Secret` with key 'token' set to a valid license token.

1255

# It enables API Gateway.

1256

token: ""

1257

# -- Mount path for token secret.

1258

tokenMountPath: "/etc/secrets"

1259

# -- Use the hardened image variant. It appends `-hardened` to the tag and defaults the image

1260

# to `registry.traefik.io/traefik-hub`. Requires `hub.enabled` and Traefik Hub >= v3.21.0-ea.

1261

hardened: false

1262

# -- (bool) Disables all external network connections.

1263

offline: # @schema type:[boolean, null]

1264

# -- By default, Traefik Hub provider watches all namespaces. When using `rbac.namespaced`, it will watch helm release namespace and namespaces listed in this array.

1265

namespaces: [] # @schema required:true

1266

apimanagement:

1267

# -- Set to true in order to enable API Management. Requires a valid license token.

1268

enabled: false

1269

admission:

1270

# -- WebHook admission server listen address. Default: "0.0.0.0:9943".

1271

listenAddr: ""

1272

# -- Certificate name of the WebHook admission server. Default: "hub-agent-cert".

1273

secretName: "hub-agent-cert"

1274

# -- By default, this chart handles directly the tls certificate required for the admission webhook. It's possible to disable this behavior and handle it outside of the chart. See EXAMPLES.md for more details.

1275

selfManagedCertificate: false

1276

# -- Set custom certificate for the WebHook admission server. The certificate should be specified with _tls.crt_ and _tls.key_ in base64 encoding.

1277

customWebhookCertificate: {}

1278

# -- Set it to false if you need to disable Traefik Hub pod restart when mutating webhook certificate is updated. It's done with a label update.

1279

restartOnCertificateChange: true

1280

# -- Set custom annotations.

1281

annotations: {}

1282

openApi:

1283

# -- When set to true, it will only accept paths and methods that are explicitly defined in its OpenAPI specification

1284

validateRequestMethodAndPath: false

1285

# -- Interval to refresh the OpenAPI specification, as a Go duration. Must be at least `1m`.

1286

# @default -- `1m` when unset

1287

refreshInterval: ""

1288

mcpgateway:

1289

# -- Set to true in order to enable AI MCP Gateway. Requires a valid license token.

1290

enabled: false

1291

# -- (int) Hard limit for the size of request bodies inspected by the gateway. Accepts a plain integer representing **bytes**. The default value is `1048576` (1 MiB).

1292

maxRequestBodySize: # @schema type:[integer, null]; minimum:0

1293

aigateway:

1294

# -- Set to true in order to enable AI Gateway. Requires a valid license token.

1295

enabled: false

1296

# -- (int) Hard limit for the size of request bodies inspected by the gateway. Accepts a plain integer representing **bytes**. The default value is `1048576` (1 MiB).

1297

maxRequestBodySize: # @schema type:[integer, null]; minimum:0

1298

providers:

1299

consulCatalogEnterprise:

1300

# -- Enable Consul Catalog Enterprise backend with default settings.

1301

enabled: false

1302

# -- Use local agent caching for catalog reads.

1303

cache: false

1304

# -- Enable Consul Connect support.

1305

connectAware: false

1306

# -- Consider every service as Connect capable by default.

1307

connectByDefault: false

1308

# -- Constraints is an expression that Traefik matches against the container's labels

1309

constraints: ""

1310

# -- Default rule.

1311

defaultRule: "Host(`{{ normalize .Name }}`)"

1312

endpoint:

1313

# -- The address of the Consul server

1314

address: ""

1315

# -- Data center to use. If not provided, the default agent data center is used

1316

datacenter: ""

1317

# -- (int) WaitTime limits how long a Watch will block. If not provided, the agent default

1318

endpointWaitTime: # @schema type:[integer, null]

1319

httpauth:

1320

# -- Basic Auth password

1321

password: ""

1322

# -- Basic Auth username

1323

username: ""

1324

# -- The URI scheme for the Consul server

1325

scheme: ""

1326

tls:

1327

# -- TLS CA

1328

ca: ""

1329

# -- TLS cert

1330

cert: ""

1331

# -- TLS insecure skip verify

1332

insecureSkipVerify: false

1333

# -- TLS key

1334

key: ""

1335

# -- Token is used to provide a per-request ACL token which overrides the agent's

1336

token: ""

1337

# -- Expose containers by default.

1338

exposedByDefault: true

1339

# -- Sets the namespaces used to discover services (Consul Enterprise only).

1340

namespaces: ""

1341

# -- Sets the partition used to discover services (Consul Enterprise only).

1342

partition: ""

1343

# -- Prefix for consul service tags.

1344

prefix: "traefik"

1345

# -- Interval for checking Consul API.

1346

refreshInterval: 15

1347

# -- Forces the read to be fully consistent.

1348

requireConsistent: false

1349

# -- Name of the Traefik service in Consul Catalog (needs to be registered via the

1350

serviceName: "traefik"

1351

# -- Use stale consistency for catalog reads.

1352

stale: false

1353

# -- A list of service health statuses to allow taking traffic.

1354

strictChecks: "passing, warning"

1355

# -- Watch Consul API events.

1356

watch: false

1357

# @schema additionalProperties: false

1358

ec2:

1359

# -- Enable AWS EC2 provider.

1360

enabled: false

1361

# -- AWS region used for EC2 API requests. When empty, the region is retrieved from the EC2 Instance Metadata Service.

1362

region: ""

1363

# -- AWS access key ID, set together with secretAccessKey. Readable from the Pod spec: prefer IRSA, the instance role or `env`.

1364

accessKeyID: ""

1365

# -- AWS secret access key, set together with accessKeyID. Readable from the Pod spec: prefer IRSA, the instance role or `env`.

1366

secretAccessKey: ""

1367

# -- Expose instances by default. When false, only instances with the `traefik.enable=true` tag are exposed.

1368

exposedByDefault: true

1369

# -- Polling interval, in seconds, for the EC2 API.

1370

refreshSeconds: 15

1371

# -- Default rule applied to instances that do not define a router rule tag.

1372

defaultRule: ""

1373

# -- Expression matched against instance tags to determine whether to create routes for an instance.

1374

constraints: ""

1375

# -- Default backend IP mode: private, public or ipv6. Overridable per instance with the `traefik.ec2.ipmode` tag.

1376

ipMode: "" # @schema enum:["", "private", "public", "ipv6"]

1377

# -- EC2 API filters used to scope instance discovery. List of `{ name: "<filter>", values: ["<value>"] }` entries.

1378

filters: [] # @schema item:object

1379

# @schema additionalProperties: false

1380

securityGroupPortDiscovery:

1381

# -- Derive the backend port from the instance security-group rules when no port tag is set.

1382

enabled: false

1383

# -- Ports excluded from security-group port discovery. When empty, the provider excludes privileged ports except 80 and 443.

1384

excludedPorts: []

1385

microcks:

1386

# -- Enable Microcks provider.

1387

enabled: false

1388

auth:

1389

# -- Microcks API client ID.

1390

clientId: ""

1391

# -- Microcks API client secret.

1392

clientSecret: ""

1393

# -- Microcks API endpoint.

1394

endpoint: ""

1395

# -- Microcks API token.

1396

token: ""

1397

# -- Microcks API endpoint.

1398

endpoint: ""

1399

# -- Polling interval for Microcks API.

1400

pollInterval: 30

1401

# -- Polling timeout for Microcks API.

1402

pollTimeout: 5

1403

tls:

1404

# -- TLS CA

1405

ca: ""

1406

# -- TLS cert

1407

cert: ""

1408

# -- TLS insecure skip verify

1409

insecureSkipVerify: false

1410

# -- TLS key

1411

key: ""

1412

multicluster:

1413

# -- Enable Multi-cluster provider.

1414

enabled: false

1415

# -- Polling interval for Multi-cluster.

1416

pollInterval: 5

1417

# -- Polling timeout for Multi-cluster.

1418

pollTimeout: 5

1419

# @schema mergeProperties: true

1420

# -- Child cluster configurations, keyed by a unique name.

1421

# @default -- {}

1422

children:

1423

# @schema additionalProperties: false

1424

cluster-1:

1425

# -- URL of the child cluster's uplink entrypoint.

1426

address: ""

1427

# -- TLS and transport configuration for connecting to this child.

1428

# @default -- {}

1429

serversTransport:

1430

# -- (bool) Disable TLS certificate verification. **Not recommended for production.**

1431

# @default -- false

1432

insecureSkipVerify: # @schema type:[boolean, null]

1433

# -- Server name used for SNI and certificate verification.

1434

serverName: ""

1435

rootCAs: []

1436

certificates: []

1437

# -- (int) Maximum idle connections per host.

1438

# @default -- 200

1439

maxIdleConnsPerHost: # @schema type:[integer, null]

1440

# -- (bool) Disable HTTP/2 for connections to this child.

1441

# @default -- false

1442

disableHTTP2: # @schema type:[boolean, null]

1443

# -- Minimum TLS version (e.g. `VersionTLS12`, `VersionTLS13`).

1444

minVersion: ""

1445

# -- Maximum TLS version (e.g. `VersionTLS12`, `VersionTLS13`).

1446

maxVersion: ""

1447

# -- List of supported cipher suites for TLS versions up to 1.2.

1448

cipherSuites: []

1449

# -- URI used to match against SAN URIs during the server's certificate verification.

1450

peerCertURI: ""

1451

forwardingTimeouts:

1452

# @schema type:[string, integer, null]

1453

# -- Timeout for establishing connections.

1454

# @default -- 30s

1455

dialTimeout:

1456

# @schema type:[string, integer, null]

1457

# -- Timeout for reading response headers.

1458

# @default -- 0s

1459

responseHeaderTimeout:

1460

# @schema type:[string, integer, null]

1461

# -- Timeout for idle connections.

1462

# @default -- 90s

1463

idleConnTimeout:

1464

# @schema type:[string, integer, null]

1465

# -- Timeout for HTTP/2 server ping frames.

1466

# @default -- 15s

1467

pingTimeout:

1468

# @schema type:[string, integer, null]

1469

# -- Timeout for HTTP/2 connection idle reads.

1470

# @default -- 0s

1471

readIdleTimeout:

1472

# @schema type:[string, integer, null]

1473

# -- Timeout for reading the request body.

1474

# @default -- 0s

1475

readTimeout:

1476

# @schema type:[string, integer, null]

1477

# -- Timeout for writing the response.

1478

# @default -- 0s

1479

writeTimeout:

1480

spiffe:

1481

ids: []

1482

# @schema type:[string, integer, null]

1483

# -- SPIFFE trust domain.

1484

trustDomain: ""

1485

# @schema additionalProperties: false

1486

nutanixPrismCentral:

1487

# -- Enable Nutanix Prism Central provider.

1488

enabled: false

1489

# -- Prism Central endpoint.

1490

endpoint: ""

1491

# -- Prism Central username.

1492

username: ""

1493

# -- Prism Central password.

1494

password: ""

1495

# -- Prism Central API key.

1496

apiKey: ""

1497

# -- Base configuration file path.

1498

filename: ""

1499

# -- Polling interval for Nutanix Prism Central API.

1500

pollInterval: 30

1501

# -- Polling timeout for Nutanix Prism Central API.

1502

pollTimeout: 5

1503

# -- Category key used to derive the service name.

1504

serviceNameCategoryKey: "TraefikServiceName"

1505

# -- Filter VMs by VPCs. List of `{ uuid: "<vpc-uuid>" }` entries.

1506

allowedVpcs: []

1507

tls:

1508

# -- TLS CA

1509

ca: ""

1510

# -- TLS cert

1511

cert: ""

1512

# -- TLS key

1513

key: ""

1514

# -- TLS insecure skip verify

1515

insecureSkipVerify: false

1516

redis:

1517

# -- (bool) Enable Redis Cluster. Default: true.

1518

cluster: # @schema type:[boolean, null]

1519

# -- (int) Database used to store information. Default: 0.

1520

database: # @schema type:[integer, null]

1521

# -- Endpoints of the Redis instances to connect to. Default: "".

1522

endpoints: ""

1523

# -- The username to use when connecting to Redis endpoints. Default: "".

1524

username: ""

1525

# -- The password to use when connecting to Redis endpoints. Default: "".

1526

password: ""

1527

sentinel:

1528

# -- Name of the set of main nodes to use for main selection. Required when using Sentinel. Default: "".

1529

masterset: ""

1530

# -- Username to use for sentinel authentication (can be different from endpoint username). Default: "".

1531

username: ""

1532

# -- Password to use for sentinel authentication (can be different from endpoint password). Default: "".

1533

password: ""

1534

# -- Timeout applied on connection with redis. Default: "0s".

1535

timeout: ""

1536

tls:

1537

# -- Path to the certificate authority used for the secured connection.

1538

ca: ""

1539

# -- Path to the public certificate used for the secure connection.

1540

cert: ""

1541

# -- Path to the private key used for the secure connection.

1542

key: ""

1543

# -- When insecureSkipVerify is set to true, the TLS connection accepts any certificate presented by the server. Default: false.

1544

insecureSkipVerify: false

1545

# -- (bool) Enable export of error logs to the platform. Default: true.

1546

sendlogs: # @schema type:[boolean, null]

1547

tracing:

1548

additionalTraceHeaders:

1549

# -- Tracing headers to duplicate.

1550

# To configure the following, tracing.otlp.enabled needs to be set to true.

1551

# @default -- See below

1552

enabled: false

1553

traceContext:

1554

# -- Name of the header that will contain the parent-id header copy.

1555

parentId: ""

1556

# -- Name of the header that will contain the trace-id copy.

1557

traceId: ""

1558

# -- Name of the header that will contain the traceparent copy.

1559

traceParent: ""

1560

# -- Name of the header that will contain the tracestate copy.

1561

traceState: ""

1562

# Define private plugin sources

1563

pluginRegistry:

1564

sources: {}

1565

# -- Required for OCI Marketplace integration.

1566

# See https://docs.public.content.oci.oraclecloud.com/en-us/iaas/Content/Marketplace/understanding-helm-charts.htm

1567

# @default -- See _values.yaml_

1568

oci_meta:

1569

# -- Enable specific values for Oracle Cloud Infrastructure

1570

enabled: false

1571

# -- It needs to be an ocir repo

1572

repo: cgr.dev

1573

images:

1574

proxy:

1575

image: chainguard-private/traefik

1576

tag: 3.7.13@sha256:9a33b2de0ddfcbc27a98dbfec399e7cf1a56c47ed72f23c27f44195078adecdf

1577

hub:

1578

image: chainguard-private/traefik

1579

tag: 3.7.13@sha256:9a33b2de0ddfcbc27a98dbfec399e7cf1a56c47ed72f23c27f44195078adecdf

1580

# -- Required for IBM Cloud Marketplace integration.

1581

# Injected by IBM Cloud Catalog when deploying via IBM Cloud Schematics. This value is not used by the chart.

1582

offering_version: "" # @schema type:[string, null]

1583

# -- Allow the Helm chart to be used as optional subchart.

1584

enabled: true # @schema type:boolean; const:true

1585

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

traefik

The trusted source for open source

Product

Solutions

Customers

Resources

Company