From b020810001517e048914b8600886630fb200cd35 Mon Sep 17 00:00:00 2001 From: Vargha Csongor Date: Sun, 7 Apr 2024 19:19:45 +0200 Subject: [PATCH] remove default values for traefik --- oci-managed/traefik-values.tfpl.yaml | 588 +-------------------------- 1 file changed, 2 insertions(+), 586 deletions(-) diff --git a/oci-managed/traefik-values.tfpl.yaml b/oci-managed/traefik-values.tfpl.yaml index e96aea8..2c28029 100644 --- a/oci-managed/traefik-values.tfpl.yaml +++ b/oci-managed/traefik-values.tfpl.yaml @@ -1,151 +1,3 @@ -# Default values for Traefik -image: - # -- Traefik image host registry - registry: docker.io - # -- Traefik image repository - repository: traefik - # -- defaults to appVersion - tag: "" - # -- Traefik image pull policy - pullPolicy: IfNotPresent - -# -- Add additional label to all resources -commonLabels: {} - -# -# Configure the deployment -# -deployment: - # -- Enable deployment - enabled: true - # -- Deployment or DaemonSet - kind: Deployment - # -- Number of pods of the deployment (only applies when kind == Deployment) - replicas: 1 - # -- Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10) - # revisionHistoryLimit: 1 - # -- Amount of time (in seconds) before Kubernetes will send the SIGKILL signal if Traefik does not shut down - terminationGracePeriodSeconds: 60 - # -- The minimum number of seconds Traefik needs to be up and running before the DaemonSet/Deployment controller considers it available - minReadySeconds: 0 - ## Override the liveness/readiness port. This is useful to integrate traefik - ## with an external Load Balancer that performs healthchecks. - ## Default: ports.traefik.port - # healthchecksPort: 9000 - ## Override the liveness/readiness scheme. Useful for getting ping to - ## respond on websecure entryPoint. - # healthchecksScheme: HTTPS - # -- Additional deployment annotations (e.g. for jaeger-operator sidecar injection) - annotations: {} - # -- Additional deployment labels (e.g. for filtering deployment by custom labels) - labels: {} - # -- Additional pod annotations (e.g. for mesh injection or prometheus scraping) - # It supports templating. One can set it with values like traefik/name: '{{ template "traefik.name" . }}' - podAnnotations: {} - # -- Additional Pod labels (e.g. for filtering Pod by custom labels) - podLabels: {} - # -- Additional containers (e.g. for metric offloading sidecars) - additionalContainers: [] - # https://docs.datadoghq.com/developers/dogstatsd/unix_socket/?tab=host - # - name: socat-proxy - # image: alpine/socat:1.0.5 - # args: ["-s", "-u", "udp-recv:8125", "unix-sendto:/socket/socket"] - # volumeMounts: - # - name: dsdsocket - # mountPath: /socket - # -- Additional volumes available for use with initContainers and additionalContainers - additionalVolumes: [] - # - name: dsdsocket - # hostPath: - # path: /var/run/statsd-exporter - # -- Additional initContainers (e.g. for setting file permission as shown below) -# initContainers: -# # The "volume-permissions" init container is required if you run into permission issues. -# # Related issue: https://github.com/traefik/traefik-helm-chart/issues/396 -# - name: volume-permissions -# image: busybox:latest -# command: ["sh", "-c", "touch /data/acme.json; chmod -v 600 /data/acme.json"] -# securityContext: -# runAsNonRoot: true -# runAsGroup: 65532 -# runAsUser: 65532 -# volumeMounts: -# - name: data -# mountPath: /data - # -- Use process namespace sharing - shareProcessNamespace: false - # -- Custom pod DNS policy. Apply if `hostNetwork: true` - # dnsPolicy: ClusterFirstWithHostNet - dnsConfig: {} - # nameservers: - # - 192.0.2.1 # this is an example - # searches: - # - ns1.svc.cluster-domain.example - # - my.dns.search.suffix - # options: - # - name: ndots - # value: "2" - # - name: edns0 - # -- Additional imagePullSecrets - imagePullSecrets: [] - # - name: myRegistryKeySecretName - # -- Pod lifecycle actions - lifecycle: {} - # preStop: - # exec: - # command: ["/bin/sh", "-c", "sleep 40"] - # postStart: - # httpGet: - # path: /ping - # port: 9000 - # host: localhost - # scheme: HTTP - # -- Set a runtimeClassName on pod - runtimeClassName: - -# -- Pod disruption budget -podDisruptionBudget: - enabled: false - # maxUnavailable: 1 - # maxUnavailable: 33% - # minAvailable: 0 - # minAvailable: 25% - -# -- Create a default IngressClass for Traefik -ingressClass: - enabled: true - isDefaultClass: true - # name: my-custom-class - -# Traefik experimental features -experimental: - # This value is no longer used, set the image.tag to a semver higher than 3.0, e.g. "v3.0.0-beta3" - # v3: - # -- Enable traefik version 3 - - # -- Enable traefik experimental plugins - plugins: {} - # demo: - # moduleName: github.com/traefik/plugindemo - # version: v0.2.1 - kubernetesGateway: - # -- Enable traefik experimental GatewayClass CRD - enabled: false - ## Routes are restricted to namespace of the gateway by default. - ## https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1beta1.FromNamespaces - # namespacePolicy: All - # certificate: - # group: "core" - # kind: "Secret" - # name: "mysecret" - # -- By default, Gateway would be created to the Namespace you are deploying Traefik to. - # You may create that Gateway in another namespace, setting its name below: - # namespace: default - # Additional gateway annotations (e.g. for cert-manager.io/issuer) - # annotations: - # cert-manager.io/issuer: letsencrypt - -## Create an IngressRoute for the dashboard ingressRoute: dashboard: # -- Create an IngressRoute for the dashboard @@ -161,9 +13,9 @@ ingressRoute: # /!\ Do not expose your dashboard without any protection over the internet /!\ entryPoints: ["websecure"] # -- Additional ingressRoute middlewares (e.g. for authentication) - middlewares: + middlewares: - name: traefik-dashboard-auth - + # -- TLS options (e.g. secret containing certificate) tls: {} healthcheck: @@ -183,443 +35,14 @@ ingressRoute: # -- TLS options (e.g. secret containing certificate) tls: {} -updateStrategy: - # -- Customize updateStrategy: RollingUpdate or OnDelete - type: RollingUpdate - rollingUpdate: - maxUnavailable: 0 - maxSurge: 1 - -readinessProbe: - # -- The number of consecutive failures allowed before considering the probe as failed. - failureThreshold: 1 - # -- The number of seconds to wait before starting the first probe. - initialDelaySeconds: 2 - # -- The number of seconds to wait between consecutive probes. - periodSeconds: 10 - # -- The minimum consecutive successes required to consider the probe successful. - successThreshold: 1 - # -- The number of seconds to wait for a probe response before considering it as failed. - timeoutSeconds: 2 -livenessProbe: - # -- The number of consecutive failures allowed before considering the probe as failed. - failureThreshold: 3 - # -- The number of seconds to wait before starting the first probe. - initialDelaySeconds: 2 - # -- The number of seconds to wait between consecutive probes. - periodSeconds: 10 - # -- The minimum consecutive successes required to consider the probe successful. - successThreshold: 1 - # -- The number of seconds to wait for a probe response before considering it as failed. - timeoutSeconds: 2 - -# -- Define Startup Probe for container: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes -# eg. -# `startupProbe: -# exec: -# command: -# - mycommand -# - foo -# initialDelaySeconds: 5 -# periodSeconds: 5` -startupProbe: - providers: kubernetesCRD: - # -- Load Kubernetes IngressRoute provider - enabled: true - # -- Allows IngressRoute to reference resources in namespace other than theirs allowCrossNamespace: true - # -- Allows to reference ExternalName services in IngressRoute - allowExternalNameServices: false - # -- Allows to return 503 when there is no endpoints available - allowEmptyServices: false - # ingressClass: traefik-internal - # labelSelector: environment=production,method=traefik - # -- Array of namespaces to watch. If left empty, Traefik watches all namespaces. - namespaces: [] - # - "default" - - kubernetesIngress: - # -- Load Kubernetes Ingress provider - enabled: true - # -- Allows to reference ExternalName services in Ingress - allowExternalNameServices: false - # -- Allows to return 503 when there is no endpoints available - allowEmptyServices: false - # ingressClass: traefik-internal - # labelSelector: environment=production,method=traefik - # -- Array of namespaces to watch. If left empty, Traefik watches all namespaces. - namespaces: [] - # - "default" - # IP used for Kubernetes Ingress endpoints - publishedService: - enabled: false - # Published Kubernetes Service to copy status from. Format: namespace/servicename - # By default this Traefik service - # pathOverride: "" - - file: - # -- Create a file provider - enabled: false - # -- Allows Traefik to automatically watch for file changes - watch: true - # -- File content (YAML format, go template supported) (see https://doc.traefik.io/traefik/providers/file/) - content: "" - # http: - # routers: - # router0: - # entryPoints: - # - web - # middlewares: - # - my-basic-auth - # service: service-foo - # rule: Path(`/foo`) - -# -# -- Add volumes to the traefik pod. The volume name will be passed to tpl. -# This can be used to mount a cert pair or a configmap that holds a config.toml file. -# After the volume has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg: -# `additionalArguments: -# - "--providers.file.filename=/config/dynamic.toml" -# - "--ping" -# - "--ping.entrypoint=web"` -volumes: [] -# - name: public-cert -# mountPath: "/certs" -# type: secret -# - name: '{{ printf "%s-configs" .Release.Name }}' -# mountPath: "/config" -# type: configMap - -# -- Additional volumeMounts to add to the Traefik container -additionalVolumeMounts: [] -# -- For instance when using a logshipper for access logs -# - name: traefik-logs -# mountPath: /var/log/traefik - -logs: - general: - # -- By default, the logs use a text format (common), but you can - # also ask for the json format in the format option - # format: json - # By default, the level is set to ERROR. - # -- Alternative logging levels are DEBUG, PANIC, FATAL, ERROR, WARN, and INFO. - level: ERROR - access: - # -- To enable access logs - enabled: false - ## By default, logs are written using the Common Log Format (CLF) on stdout. - ## To write logs in JSON, use json in the format option. - ## If the given format is unsupported, the default (CLF) is used instead. - # format: json - # filePath: "/var/log/traefik/access.log - ## To write the logs in an asynchronous fashion, specify a bufferingSize option. - ## This option represents the number of log lines Traefik will keep in memory before writing - ## them to the selected output. In some cases, this option can greatly help performances. - # bufferingSize: 100 - ## Filtering - # -- https://docs.traefik.io/observability/access-logs/#filtering - filters: {} - # statuscodes: "200,300-302" - # retryattempts: true - # minduration: 10ms - fields: - general: - # -- Available modes: keep, drop, redact. - defaultmode: keep - # -- Names of the fields to limit. - names: {} - ## Examples: - # ClientUsername: drop - headers: - # -- Available modes: keep, drop, redact. - defaultmode: drop - # -- Names of the headers to limit. - names: {} - ## Examples: - # User-Agent: redact - # Authorization: drop - # Content-Type: keep - -metrics: - ## -- Prometheus is enabled by default. - ## -- It can be disabled by setting "prometheus: null" - prometheus: - # -- Entry point used to expose metrics. - entryPoint: metrics -## Tracing -# -- https://doc.traefik.io/traefik/observability/tracing/overview/ -tracing: {} - -# -- Global command arguments to be passed to all traefik's pods -globalArguments: -- "--global.checknewversion" -- "--global.sendanonymoususage" - -# -# Configure Traefik static configuration -# -- Additional arguments to be passed at Traefik's binary -# All available options available on https://docs.traefik.io/reference/static-configuration/cli/ -## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"` -additionalArguments: [] -# - "--providers.kubernetesingress.ingressclass=traefik-internal" -# - "--log.level=DEBUG" - -# -- Environment variables to be passed to Traefik's binary -env: -- name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name -- name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - -# - name: SOME_VAR -# value: some-var-value -# - name: SOME_VAR_FROM_CONFIG_MAP -# valueFrom: -# configMapRef: -# name: configmap-name -# key: config-key -# - name: SOME_SECRET -# valueFrom: -# secretKeyRef: -# name: secret-name -# key: secret-key - -# -- Environment variables to be passed to Traefik's binary from configMaps or secrets -envFrom: [] -# - configMapRef: -# name: config-map-name -# - secretRef: -# name: secret-name - -ports: - traefik: - port: 9000 - # -- Use hostPort if set. - # hostPort: 9000 - # - # -- Use hostIP if set. If not set, Kubernetes will default to 0.0.0.0, which - # means it's listening on all your interfaces and all your IPs. You may want - # to set this value if you need traefik to listen on specific interface - # only. - # hostIP: 192.168.100.10 - - # Defines whether the port is exposed if service.type is LoadBalancer or - # NodePort. - # - # -- You SHOULD NOT expose the traefik port on production deployments. - # If you want to access it from outside your cluster, - # use `kubectl port-forward` or create a secure ingress - expose: false - # -- The exposed port for this service - exposedPort: 9000 - # -- The port protocol (TCP/UDP) - protocol: TCP - # -- Defines whether the port is exposed on the internal service; - # note that ports exposed on the default service are exposed on the internal - # service by default as well. - exposeInternal: false - web: - ## -- Enable this entrypoint as a default entrypoint. When a service doesn't explicitly set an entrypoint it will only use this entrypoint. - # asDefault: true - port: 8000 - # hostPort: 8000 - # containerPort: 8000 - expose: true - exposedPort: 80 - ## -- Different target traefik port on the cluster, useful for IP type LB - # targetPort: 80 - # The port protocol (TCP/UDP) - protocol: TCP - # -- Use nodeport if set. This is useful if you have configured Traefik in a - # LoadBalancer. - # nodePort: 32080 - # -- Defines whether the port is exposed on the internal service; - # note that ports exposed on the default service are exposed on the internal - # service by default as well. - exposeInternal: false - # Port Redirections - # Added in 2.2, you can make permanent redirects via entrypoints. - # https://docs.traefik.io/routing/entrypoints/#redirection - # redirectTo: - # port: websecure - # (Optional) - # priority: 10 - # - # Trust forwarded headers information (X-Forwarded-*). - # forwardedHeaders: - # trustedIPs: [] - # insecure: false - # - # Enable the Proxy Protocol header parsing for the entry point - # proxyProtocol: - # trustedIPs: [] - # insecure: false - websecure: - ## -- Enable this entrypoint as a default entrypoint. When a service doesn't explicitly set an entrypoint it will only use this entrypoint. - # asDefault: true - port: 8443 - # hostPort: 8443 - # containerPort: 8443 - expose: true - exposedPort: 443 - ## -- Different target traefik port on the cluster, useful for IP type LB - # targetPort: 80 - ## -- The port protocol (TCP/UDP) - protocol: TCP - # nodePort: 32443 - # -- Defines whether the port is exposed on the internal service; - # note that ports exposed on the default service are exposed on the internal - # service by default as well. - exposeInternal: false - ## -- Specify an application protocol. This may be used as a hint for a Layer 7 load balancer. - # appProtocol: https - # - ## -- Enable HTTP/3 on the entrypoint - ## Enabling it will also enable http3 experimental feature - ## https://doc.traefik.io/traefik/routing/entrypoints/#http3 - ## There are known limitations when trying to listen on same ports for - ## TCP & UDP (Http3). There is a workaround in this chart using dual Service. - ## https://github.com/kubernetes/kubernetes/issues/47249#issuecomment-587960741 - http3: - enabled: false - # advertisedPort: 4443 - # - ## -- Trust forwarded headers information (X-Forwarded-*). - # forwardedHeaders: - # trustedIPs: [] - # insecure: false - # - ## -- Enable the Proxy Protocol header parsing for the entry point - # proxyProtocol: - # trustedIPs: [] - # insecure: false - # - ## Set TLS at the entrypoint - ## https://doc.traefik.io/traefik/routing/entrypoints/#tls - tls: - enabled: true - - middlewares: [] - metrics: - # -- When using hostNetwork, use another port to avoid conflict with node exporter: - # https://github.com/prometheus/prometheus/wiki/Default-port-allocations - port: 9100 - # hostPort: 9100 - # Defines whether the port is exposed if service.type is LoadBalancer or - # NodePort. - # - # -- You may not want to expose the metrics port on production deployments. - # If you want to access it from outside your cluster, - # use `kubectl port-forward` or create a secure ingress - expose: false - # -- The exposed port for this service - exposedPort: 9100 - # -- The port protocol (TCP/UDP) - protocol: TCP - # -- Defines whether the port is exposed on the internal service; - # note that ports exposed on the default service are exposed on the internal - # service by default as well. - exposeInternal: false service: - enabled: true - ## -- Single service is using `MixedProtocolLBService` feature gate. - ## -- When set to false, it will create two Service, one for TCP and one for UDP. - single: true - type: LoadBalancer - # -- Additional annotations applied to both TCP and UDP services (e.g. for cloud provider specific config) annotations: oci.oraclecloud.com/load-balancer-type: "nlb" - # -- Additional annotations for TCP service only - annotationsTCP: {} - # -- Additional annotations for UDP service only - annotationsUDP: {} - # -- Additional service labels (e.g. for filtering Service by custom labels) - labels: {} - # -- Additional entries here will be added to the service spec. - # -- Cannot contain type, selector or ports entries. - spec: {} - # externalTrafficPolicy: Cluster - # loadBalancerIP: "1.2.3.4" - # clusterIP: "2.3.4.5" - loadBalancerSourceRanges: [] - # - 192.168.0.1/32 - # - 172.16.0.0/16 - ## -- Class of the load balancer implementation - # loadBalancerClass: service.k8s.aws/nlb - externalIPs: [] -autoscaling: - enabled: false - -persistence: - # -- Enable persistence using Persistent Volume Claims - # ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ - # It can be used to store TLS certificates, see `storage` in certResolvers - enabled: true - name: data - # existingClaim: "" - accessMode: ReadWriteOnce - size: 128Mi - # storageClass: "" - # volumeName: "" - path: /data - annotations: {} - # -- Only mount a subpath of the Volume into the pod - # subPath: "" - - -# -- If hostNetwork is true, runs traefik in the host network namespace -# To prevent unschedulabel pods due to port collisions, if hostNetwork=true -# and replicas>1, a pod anti-affinity is recommended and will be set if the -# affinity is left as default. -hostNetwork: false - -# -- Whether Role Based Access Control objects like roles and rolebindings should be created -rbac: - enabled: true - # If set to false, installs ClusterRole and ClusterRoleBinding so Traefik can be used across namespaces. - # If set to true, installs Role and RoleBinding. Providers will only watch target namespace. - namespaced: false - # Enable user-facing roles - # https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles - # aggregateTo: [ "admin" ] - -# -- Enable to create a PodSecurityPolicy and assign it to the Service Account via RoleBinding or ClusterRoleBinding -podSecurityPolicy: - enabled: false - -securityContext: - capabilities: - drop: [ALL] - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - -podSecurityContext: - # /!\ When setting fsGroup, Kubernetes will recursively change ownership and - # permissions for the contents of each volume to match the fsGroup. This can - # be an issue when storing sensitive content like TLS Certificates /!\ - fsGroup: 65532 - # -- Specifies the policy for changing ownership and permissions of volume contents to match the fsGroup. - fsGroupChangePolicy: "OnRootMismatch" - # -- The ID of the group for all containers in the pod to run as. - runAsGroup: 65532 - # -- Specifies whether the containers should run as a non-root user. - runAsNonRoot: true - # -- The ID of the user for all containers in the pod to run as. - runAsUser: 65532 - -# -# -- Extra objects to deploy (value evaluated as a template) -# -# In some cases, it can avoid the need for additional, extended or adhoc deployments. -# See #595 for more details and traefik/tests/values/extra.yaml for example. extraObjects: - apiVersion: v1 kind: Secret @@ -658,10 +81,3 @@ extraObjects: spec: basicAuth: secret: dashboard-authsecret - -# This will override the default Release Namespace for Helm. -# It will not affect optional CRDs such as `ServiceMonitor` and `PrometheusRules` -# namespaceOverride: traefik -# -## -- This will override the default app.kubernetes.io/instance label for all Objects. -# instanceLabelOverride: traefik \ No newline at end of file