k3s-cluster/cluster/core/networking/traefik/helm-release.yaml

101 lines
2.5 KiB
YAML

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: traefik
namespace: traefik
spec:
interval: 5m
chart:
spec:
chart: traefik
version: '22.0.0'
sourceRef:
kind: HelmRepository
name: traefik-charts
namespace: flux-system
interval: 1m
# valuesFiles:
# - ./traefik-values.yaml
values:
additionalArguments:
- --api.insecure
logs:
general:
level: DEBUG
providers:
kubernetesCRD:
enabled: true
allowCrossNamespace: false
allowExternalNameServices: false
allowEmptyServices: false
# ingressClass: traefik-internal
# labelSelector: environment=production,method=traefik
namespaces: []
# - "default"
kubernetesIngress:
enabled: true
allowExternalNameServices: false
allowEmptyServices: false
# ingressClass: traefik-internal
# labelSelector: environment=production,method=traefik
namespaces: []
# - "default"
# IP used for Kubernetes Ingress endpoints
publishedService:
enabled: false
# Published Kubernetes Service to copy status from. Format: namespace/servicename
# By default this Traefik service
# pathOverride: ""
ports:
traefik:
port: 9000
expose: true
exposedPort: 9000
# The port protocol (TCP/UDP)
protocol: TCP
web:
port: 8000
expose: true
exposedPort: 80
redirectTo: websecure
protocol: TCP
websecure:
port: 8443
expose: true
exposedPort: 443
protocol: TCP
tls:
enabled: true
certResolver: cloudflare
metrics:
port: 9100
expose: true
exposedPort: 9100
protocol: TCP
# Disable Dashboard
ingressRoute:
dashboard:
enabled: true
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-production"
traefik.ingress.kubernetes.io/router.middlewares: "traefik-authentik@kubernetescrd"
entryPoints: [ "websecure" ]
matchRule: Host(`k3st.${SECRET_DOMAIN}`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
# Set Traefik as your default Ingress Controller, according to Kubernetes 1.19+ changes.
ingressClass:
enabled: true
isDefaultClass: true
metrics:
prometheus:
entryPoint: metrics
namespaceOverride: traefik