helmchartconfig.yaml 3.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105
  1. apiVersion: helm.cattle.io/v1
  2. kind: HelmChartConfig
  3. metadata:
  4. name: traefik
  5. namespace: kube-system
  6. spec:
  7. valuesContent: |-
  8. additionalArguments:
  9. - "--entrypoints.websecure.proxyProtocol.trustedIPs=127.0.0.1/32,172.16.69.0/24"
  10. - "--entrypoints.web.http.redirections.entryPoint.to=:443"
  11. - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
  12. # Auto cert renewal via cloudflare
  13. - "--certificatesresolvers.letsencrypt.acme.email=joshbicking@comcast.net"
  14. - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
  15. - "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare"
  16. - "--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53"
  17. - "--entrypoints.websecure.http.tls.certResolver=letsencrypt"
  18. # Main
  19. - "--entrypoints.websecure.http.tls.domains[0].main=jibby.org"
  20. - "--entrypoints.websecure.http.tls.domains[0].sans=*.jibby.org"
  21. # LAN-only
  22. - "--entrypoints.websecure.http.tls.domains[1].main=lan.jibby.org"
  23. - "--entrypoints.websecure.http.tls.domains[1].sans=*.lan.jibby.org"
  24. # Configuration for extra routers
  25. - "--providers.file.directory=/config"
  26. - "--log.level=INFO"
  27. # debug, uncomment for testing
  28. #- "--log.level=DEBUG"
  29. #- "--certificatesresolvers.letsencrypt.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory"
  30. ports:
  31. metrics:
  32. expose: true
  33. exposedPort: 9101
  34. volumes:
  35. - name: traefik-config
  36. mountPath: "/config"
  37. type: configMap
  38. env:
  39. - name: CLOUDFLARE_EMAIL
  40. valueFrom:
  41. secretKeyRef:
  42. name: cloudflare-secrets
  43. key: email
  44. optional: false
  45. - name: CLOUDFLARE_API_KEY
  46. valueFrom:
  47. secretKeyRef:
  48. name: cloudflare-secrets
  49. key: api-key
  50. optional: false
  51. persistence:
  52. enabled: true
  53. storageClass: ceph-block
  54. # Fix for acme.json file being changed to 660 from 600
  55. # This can manifest as the incredibly unhelpful "the router <router name> uses a non-existent resolver: <resolver name>"
  56. # https://github.com/traefik/traefik/issues/10241
  57. podSecurityContext:
  58. fsGroup: 65532
  59. deployment:
  60. initContainers:
  61. # The "volume-permissions" init container is required if you run into permission issues.
  62. # Related issue: https://github.com/traefik/traefik-helm-chart/issues/396
  63. - name: volume-permissions
  64. image: busybox:latest
  65. command: ["sh", "-c", "touch /data/acme.json; chmod -v 600 /data/acme.json"]
  66. securityContext:
  67. runAsNonRoot: true
  68. runAsGroup: 65532
  69. runAsUser: 65532
  70. volumeMounts:
  71. - name: data
  72. mountPath: /data
  73. # ACME functionality is not supported when running Traefik as a DaemonSet
  74. #deployment:
  75. # kind: DaemonSet
  76. service:
  77. spec:
  78. # Required to show real IP to proxied services
  79. externalTrafficPolicy: Local
  80. providers:
  81. kubernetesCRD:
  82. # Allows IngressRoutes to use middleware from a different namespace
  83. allowCrossNamespace: true
  84. # pin pod to cluster-ingress node, so ServiceLB gives it the right external IP
  85. affinity:
  86. nodeAffinity:
  87. requiredDuringSchedulingIgnoredDuringExecution:
  88. nodeSelectorTerms:
  89. - matchExpressions:
  90. - key: cluster-ingress
  91. operator: In
  92. values:
  93. - "true"