remove default values for traefik

oci-managed/traefik-values.tfpl.yaml

@@ -1,151 +1,3 @@
-# Default values for Traefik
-image:
-  # -- Traefik image host registry
-  registry: docker.io
-  # -- Traefik image repository
-  repository: traefik
-  # -- defaults to appVersion
-  tag: ""
-  # -- Traefik image pull policy
-  pullPolicy: IfNotPresent
-
-# -- Add additional label to all resources
-commonLabels: {}
-
-#
-# Configure the deployment
-#
-deployment:
-  # -- Enable deployment
-  enabled: true
-  # -- Deployment or DaemonSet
-  kind: Deployment
-  # -- Number of pods of the deployment (only applies when kind == Deployment)
-  replicas: 1
-  # -- Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10)
-  # revisionHistoryLimit: 1
-  # -- Amount of time (in seconds) before Kubernetes will send the SIGKILL signal if Traefik does not shut down
-  terminationGracePeriodSeconds: 60
-  # -- The minimum number of seconds Traefik needs to be up and running before the DaemonSet/Deployment controller considers it available
-  minReadySeconds: 0
-  ## Override the liveness/readiness port. This is useful to integrate traefik
-  ## with an external Load Balancer that performs healthchecks.
-  ## Default: ports.traefik.port
-  # healthchecksPort: 9000
-  ## Override the liveness/readiness scheme. Useful for getting ping to
-  ## respond on websecure entryPoint.
-  # healthchecksScheme: HTTPS
-  # -- Additional deployment annotations (e.g. for jaeger-operator sidecar injection)
-  annotations: {}
-  # -- Additional deployment labels (e.g. for filtering deployment by custom labels)
-  labels: {}
-  # -- Additional pod annotations (e.g. for mesh injection or prometheus scraping)
-  # It supports templating. One can set it with values like traefik/name: '{{ template "traefik.name" . }}'
-  podAnnotations: {}
-  # -- Additional Pod labels (e.g. for filtering Pod by custom labels)
-  podLabels: {}
-  # -- Additional containers (e.g. for metric offloading sidecars)
-  additionalContainers: []
-  # https://docs.datadoghq.com/developers/dogstatsd/unix_socket/?tab=host
-  # - name: socat-proxy
-  #   image: alpine/socat:1.0.5
-  #   args: ["-s", "-u", "udp-recv:8125", "unix-sendto:/socket/socket"]
-  #   volumeMounts:
-  #     - name: dsdsocket
-  #       mountPath: /socket
-  # -- Additional volumes available for use with initContainers and additionalContainers
-  additionalVolumes: []
-  # - name: dsdsocket
-  #   hostPath:
-  #     path: /var/run/statsd-exporter
-  # -- Additional initContainers (e.g. for setting file permission as shown below)
-#  initContainers:
-#  # The "volume-permissions" init container is required if you run into permission issues.
-#  # Related issue: https://github.com/traefik/traefik-helm-chart/issues/396
-#    - name: volume-permissions
-#      image: busybox:latest
-#      command: ["sh", "-c", "touch /data/acme.json; chmod -v 600 /data/acme.json"]
-#      securityContext:
-#        runAsNonRoot: true
-#        runAsGroup: 65532
-#        runAsUser: 65532
-#      volumeMounts:
-#        - name: data
-#          mountPath: /data
-  # -- Use process namespace sharing
-  shareProcessNamespace: false
-  # -- Custom pod DNS policy. Apply if `hostNetwork: true`
-  # dnsPolicy: ClusterFirstWithHostNet
-  dnsConfig: {}
-  # nameservers:
-  #   - 192.0.2.1 # this is an example
-  # searches:
-  #   - ns1.svc.cluster-domain.example
-  #   - my.dns.search.suffix
-  # options:
-  #   - name: ndots
-  #     value: "2"
-  #   - name: edns0
-  # -- Additional imagePullSecrets
-  imagePullSecrets: []
-  # - name: myRegistryKeySecretName
-  # -- Pod lifecycle actions
-  lifecycle: {}
-  # preStop:
-  #   exec:
-  #     command: ["/bin/sh", "-c", "sleep 40"]
-  # postStart:
-  #   httpGet:
-  #     path: /ping
-  #     port: 9000
-  #     host: localhost
-  #     scheme: HTTP
-  # -- Set a runtimeClassName on pod
-  runtimeClassName:
-
-# -- Pod disruption budget
-podDisruptionBudget:
-  enabled: false
-  # maxUnavailable: 1
-  # maxUnavailable: 33%
-  # minAvailable: 0
-  # minAvailable: 25%
-
-# -- Create a default IngressClass for Traefik
-ingressClass:
-  enabled: true
-  isDefaultClass: true
-  # name: my-custom-class
-
-# Traefik experimental features
-experimental:
-  # This value is no longer used, set the image.tag to a semver higher than 3.0, e.g. "v3.0.0-beta3"
-  # v3:
-  # -- Enable traefik version 3
-
-  # -- Enable traefik experimental plugins
-  plugins: {}
-  # demo:
-  #   moduleName: github.com/traefik/plugindemo
-  #   version: v0.2.1
-  kubernetesGateway:
-    # -- Enable traefik experimental GatewayClass CRD
-    enabled: false
-    ## Routes are restricted to namespace of the gateway by default.
-    ## https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1beta1.FromNamespaces
-    # namespacePolicy: All
-    # certificate:
-    #   group: "core"
-    #   kind: "Secret"
-    #   name: "mysecret"
-    # -- By default, Gateway would be created to the Namespace you are deploying Traefik to.
-    # You may create that Gateway in another namespace, setting its name below:
-    # namespace: default
-    # Additional gateway annotations (e.g. for cert-manager.io/issuer)
-    # annotations:
-    #   cert-manager.io/issuer: letsencrypt
-
-## Create an IngressRoute for the dashboard
 ingressRoute:
   dashboard:
     # -- Create an IngressRoute for the dashboard
@@ -161,9 +13,9 @@ ingressRoute:
     # /!\ Do not expose your dashboard without any protection over the internet /!\
     entryPoints: ["websecure"]
     # -- Additional ingressRoute middlewares (e.g. for authentication)
-    middlewares: 
+    middlewares:
       - name: traefik-dashboard-auth 
-    
+    # -- TLS options (e.g. secret containing certificate)
     tls: {}
 
   healthcheck:
@@ -183,443 +35,14 @@ ingressRoute:
     # -- TLS options (e.g. secret containing certificate)
     tls: {}
 
-updateStrategy:
-  # -- Customize updateStrategy: RollingUpdate or OnDelete
-  type: RollingUpdate
-  rollingUpdate:
-    maxUnavailable: 0
-    maxSurge: 1
-
-readinessProbe:
-  # -- The number of consecutive failures allowed before considering the probe as failed.
-  failureThreshold: 1
-  # -- The number of seconds to wait before starting the first probe.
-  initialDelaySeconds: 2
-  # -- The number of seconds to wait between consecutive probes.
-  periodSeconds: 10
-  # -- The minimum consecutive successes required to consider the probe successful.
-  successThreshold: 1
-  # -- The number of seconds to wait for a probe response before considering it as failed.
-  timeoutSeconds: 2
-livenessProbe:
-  # -- The number of consecutive failures allowed before considering the probe as failed.
-  failureThreshold: 3
-  # -- The number of seconds to wait before starting the first probe.
-  initialDelaySeconds: 2
-  # -- The number of seconds to wait between consecutive probes.
-  periodSeconds: 10
-  # -- The minimum consecutive successes required to consider the probe successful.
-  successThreshold: 1
-  # -- The number of seconds to wait for a probe response before considering it as failed.
-  timeoutSeconds: 2
-
-# -- Define Startup Probe for container: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes
-# eg.
-# `startupProbe:
-#   exec:
-#     command:
-#       - mycommand
-#       - foo
-#   initialDelaySeconds: 5
-#   periodSeconds: 5`
-startupProbe:
-
 providers:
   kubernetesCRD:
-    # -- Load Kubernetes IngressRoute provider
-    enabled: true
-    # -- Allows IngressRoute to reference resources in namespace other than theirs
     allowCrossNamespace: true
-    # -- Allows to reference ExternalName services in IngressRoute
-    allowExternalNameServices: false
-    # -- Allows to return 503 when there is no endpoints available
-    allowEmptyServices: false
-    # ingressClass: traefik-internal
-    # labelSelector: environment=production,method=traefik
-    # -- Array of namespaces to watch. If left empty, Traefik watches all namespaces.
-    namespaces: []
-    # - "default"
-
-  kubernetesIngress:
-    # -- Load Kubernetes Ingress provider
-    enabled: true
-    # -- Allows to reference ExternalName services in Ingress
-    allowExternalNameServices: false
-    # -- Allows to return 503 when there is no endpoints available
-    allowEmptyServices: false
-    # ingressClass: traefik-internal
-    # labelSelector: environment=production,method=traefik
-    # -- Array of namespaces to watch. If left empty, Traefik watches all namespaces.
-    namespaces: []
-    # - "default"
-    # IP used for Kubernetes Ingress endpoints
-    publishedService:
-      enabled: false
-      # Published Kubernetes Service to copy status from. Format: namespace/servicename
-      # By default this Traefik service
-      # pathOverride: ""
-
-  file:
-    # -- Create a file provider
-    enabled: false
-    # -- Allows Traefik to automatically watch for file changes
-    watch: true
-    # -- File content (YAML format, go template supported) (see https://doc.traefik.io/traefik/providers/file/)
-    content: ""
-      # http:
-      #   routers:
-      #     router0:
-      #       entryPoints:
-      #       - web
-      #       middlewares:
-      #       - my-basic-auth
-      #       service: service-foo
-      #       rule: Path(`/foo`)
-
-#
-# -- Add volumes to the traefik pod. The volume name will be passed to tpl.
-# This can be used to mount a cert pair or a configmap that holds a config.toml file.
-# After the volume has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg:
-# `additionalArguments:
-# - "--providers.file.filename=/config/dynamic.toml"
-# - "--ping"
-# - "--ping.entrypoint=web"`
-volumes: []
-# - name: public-cert
-#   mountPath: "/certs"
-#   type: secret
-# - name: '{{ printf "%s-configs" .Release.Name }}'
-#   mountPath: "/config"
-#   type: configMap
-
-# -- Additional volumeMounts to add to the Traefik container
-additionalVolumeMounts: []
-# -- For instance when using a logshipper for access logs
-# - name: traefik-logs
-#   mountPath: /var/log/traefik
-
-logs:
-  general:
-    # -- By default, the logs use a text format (common), but you can
-    # also ask for the json format in the format option
-    # format: json
-    # By default, the level is set to ERROR.
-    # -- Alternative logging levels are DEBUG, PANIC, FATAL, ERROR, WARN, and INFO.
-    level: ERROR
-  access:
-    # -- To enable access logs
-    enabled: false
-    ## By default, logs are written using the Common Log Format (CLF) on stdout.
-    ## To write logs in JSON, use json in the format option.
-    ## If the given format is unsupported, the default (CLF) is used instead.
-    # format: json
-    # filePath: "/var/log/traefik/access.log
-    ## To write the logs in an asynchronous fashion, specify a bufferingSize option.
-    ## This option represents the number of log lines Traefik will keep in memory before writing
-    ## them to the selected output. In some cases, this option can greatly help performances.
-    # bufferingSize: 100
-    ## Filtering
-    # -- https://docs.traefik.io/observability/access-logs/#filtering
-    filters: {}
-    # statuscodes: "200,300-302"
-    # retryattempts: true
-    # minduration: 10ms
-    fields:
-      general:
-        # -- Available modes: keep, drop, redact.
-        defaultmode: keep
-        # -- Names of the fields to limit.
-        names: {}
-        ## Examples:
-        # ClientUsername: drop
-      headers:
-        # -- Available modes: keep, drop, redact.
-        defaultmode: drop
-        # -- Names of the headers to limit.
-        names: {}
-        ## Examples:
-        # User-Agent: redact
-        # Authorization: drop
-        # Content-Type: keep
-
-metrics:
-  ## -- Prometheus is enabled by default.
-  ## -- It can be disabled by setting "prometheus: null"
-  prometheus:
-    # -- Entry point used to expose metrics.
-    entryPoint: metrics
-## Tracing
-# -- https://doc.traefik.io/traefik/observability/tracing/overview/
-tracing: {}
-
-# -- Global command arguments to be passed to all traefik's pods
-globalArguments:
-- "--global.checknewversion"
-- "--global.sendanonymoususage"
-
-#
-# Configure Traefik static configuration
-# -- Additional arguments to be passed at Traefik's binary
-# All available options available on https://docs.traefik.io/reference/static-configuration/cli/
-## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"`
-additionalArguments: []
-#  - "--providers.kubernetesingress.ingressclass=traefik-internal"
-#  - "--log.level=DEBUG"
-
-# -- Environment variables to be passed to Traefik's binary
-env:
-- name: POD_NAME
-  valueFrom:
-    fieldRef:
-      fieldPath: metadata.name
-- name: POD_NAMESPACE
-  valueFrom:
-    fieldRef:
-      fieldPath: metadata.namespace
-
-# - name: SOME_VAR
-#   value: some-var-value
-# - name: SOME_VAR_FROM_CONFIG_MAP
-#   valueFrom:
-#     configMapRef:
-#       name: configmap-name
-#       key: config-key
-# - name: SOME_SECRET
-#   valueFrom:
-#     secretKeyRef:
-#       name: secret-name
-#       key: secret-key
-
-# -- Environment variables to be passed to Traefik's binary from configMaps or secrets
-envFrom: []
-# - configMapRef:
-#     name: config-map-name
-# - secretRef:
-#     name: secret-name
-
-ports:
-  traefik:
-    port: 9000
-    # -- Use hostPort if set.
-    # hostPort: 9000
-    #
-    # -- Use hostIP if set. If not set, Kubernetes will default to 0.0.0.0, which
-    # means it's listening on all your interfaces and all your IPs. You may want
-    # to set this value if you need traefik to listen on specific interface
-    # only.
-    # hostIP: 192.168.100.10
-
-    # Defines whether the port is exposed if service.type is LoadBalancer or
-    # NodePort.
-    #
-    # -- You SHOULD NOT expose the traefik port on production deployments.
-    # If you want to access it from outside your cluster,
-    # use `kubectl port-forward` or create a secure ingress
-    expose: false
-    # -- The exposed port for this service
-    exposedPort: 9000
-    # -- The port protocol (TCP/UDP)
-    protocol: TCP
-    # -- Defines whether the port is exposed on the internal service;
-    # note that ports exposed on the default service are exposed on the internal
-    # service by default as well.
-    exposeInternal: false
-  web:
-    ## -- Enable this entrypoint as a default entrypoint. When a service doesn't explicitly set an entrypoint it will only use this entrypoint.
-    # asDefault: true
-    port: 8000
-    # hostPort: 8000
-    # containerPort: 8000
-    expose: true
-    exposedPort: 80
-    ## -- Different target traefik port on the cluster, useful for IP type LB
-    # targetPort: 80
-    # The port protocol (TCP/UDP)
-    protocol: TCP
-    # -- Use nodeport if set. This is useful if you have configured Traefik in a
-    # LoadBalancer.
-    # nodePort: 32080
-    # -- Defines whether the port is exposed on the internal service;
-    # note that ports exposed on the default service are exposed on the internal
-    # service by default as well.
-    exposeInternal: false
-    # Port Redirections
-    # Added in 2.2, you can make permanent redirects via entrypoints.
-    # https://docs.traefik.io/routing/entrypoints/#redirection
-    # redirectTo:
-    #   port: websecure
-    #   (Optional)
-    #   priority: 10
-    #
-    # Trust forwarded  headers information (X-Forwarded-*).
-    # forwardedHeaders:
-    #   trustedIPs: []
-    #   insecure: false
-    #
-    # Enable the Proxy Protocol header parsing for the entry point
-    # proxyProtocol:
-    #   trustedIPs: []
-    #   insecure: false
-  websecure:
-    ## -- Enable this entrypoint as a default entrypoint. When a service doesn't explicitly set an entrypoint it will only use this entrypoint.
-    # asDefault: true
-    port: 8443
-    # hostPort: 8443
-    # containerPort: 8443
-    expose: true
-    exposedPort: 443
-    ## -- Different target traefik port on the cluster, useful for IP type LB
-    # targetPort: 80
-    ## -- The port protocol (TCP/UDP)
-    protocol: TCP
-    # nodePort: 32443
-    # -- Defines whether the port is exposed on the internal service;
-    # note that ports exposed on the default service are exposed on the internal
-    # service by default as well.
-    exposeInternal: false
-    ## -- Specify an application protocol. This may be used as a hint for a Layer 7 load balancer.
-    # appProtocol: https
-    #
-    ## -- Enable HTTP/3 on the entrypoint
-    ## Enabling it will also enable http3 experimental feature
-    ## https://doc.traefik.io/traefik/routing/entrypoints/#http3
-    ## There are known limitations when trying to listen on same ports for
-    ## TCP & UDP (Http3). There is a workaround in this chart using dual Service.
-    ## https://github.com/kubernetes/kubernetes/issues/47249#issuecomment-587960741
-    http3:
-      enabled: false
-    # advertisedPort: 4443
-    #
-    ## -- Trust forwarded  headers information (X-Forwarded-*).
-    # forwardedHeaders:
-    #   trustedIPs: []
-    #   insecure: false
-    #
-    ## -- Enable the Proxy Protocol header parsing for the entry point
-    # proxyProtocol:
-    #   trustedIPs: []
-    #   insecure: false
-    #
-    ## Set TLS at the entrypoint
-    ## https://doc.traefik.io/traefik/routing/entrypoints/#tls
-    tls:
-      enabled: true      
-
-    middlewares: []
-  metrics:
-    # -- When using hostNetwork, use another port to avoid conflict with node exporter:
-    # https://github.com/prometheus/prometheus/wiki/Default-port-allocations
-    port: 9100
-    # hostPort: 9100
-    # Defines whether the port is exposed if service.type is LoadBalancer or
-    # NodePort.
-    #
-    # -- You may not want to expose the metrics port on production deployments.
-    # If you want to access it from outside your cluster,
-    # use `kubectl port-forward` or create a secure ingress
-    expose: false
-    # -- The exposed port for this service
-    exposedPort: 9100
-    # -- The port protocol (TCP/UDP)
-    protocol: TCP
-    # -- Defines whether the port is exposed on the internal service;
-    # note that ports exposed on the default service are exposed on the internal
-    # service by default as well.
-    exposeInternal: false
 
 service:
-  enabled: true
-  ## -- Single service is using `MixedProtocolLBService` feature gate.
-  ## -- When set to false, it will create two Service, one for TCP and one for UDP.
-  single: true
-  type: LoadBalancer
-  # -- Additional annotations applied to both TCP and UDP services (e.g. for cloud provider specific config)
   annotations: 
     oci.oraclecloud.com/load-balancer-type: "nlb"
-  # -- Additional annotations for TCP service only
-  annotationsTCP: {}
-  # -- Additional annotations for UDP service only
-  annotationsUDP: {}
-  # -- Additional service labels (e.g. for filtering Service by custom labels)
-  labels: {}
-  # -- Additional entries here will be added to the service spec.
-  # -- Cannot contain type, selector or ports entries.
-  spec: {}
-  # externalTrafficPolicy: Cluster
-  # loadBalancerIP: "1.2.3.4"
-  # clusterIP: "2.3.4.5"
-  loadBalancerSourceRanges: []
-  # - 192.168.0.1/32
-  # - 172.16.0.0/16
-  ## -- Class of the load balancer implementation
-  # loadBalancerClass: service.k8s.aws/nlb
-  externalIPs: []
 
-autoscaling:
-  enabled: false
-
-persistence:
-  # -- Enable persistence using Persistent Volume Claims
-  # ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
-  # It can be used to store TLS certificates, see `storage` in certResolvers
-  enabled: true
-  name: data
-  #  existingClaim: ""
-  accessMode: ReadWriteOnce
-  size: 128Mi
-  # storageClass: ""
-  # volumeName: ""
-  path: /data
-  annotations: {}
-  # -- Only mount a subpath of the Volume into the pod
-  # subPath: ""
-
-
-# -- If hostNetwork is true, runs traefik in the host network namespace
-# To prevent unschedulabel pods due to port collisions, if hostNetwork=true
-# and replicas>1, a pod anti-affinity is recommended and will be set if the
-# affinity is left as default.
-hostNetwork: false
-
-# -- Whether Role Based Access Control objects like roles and rolebindings should be created
-rbac:
-  enabled: true
-  # If set to false, installs ClusterRole and ClusterRoleBinding so Traefik can be used across namespaces.
-  # If set to true, installs Role and RoleBinding. Providers will only watch target namespace.
-  namespaced: false
-  # Enable user-facing roles
-  # https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles
-  # aggregateTo: [ "admin" ]
-
-# -- Enable to create a PodSecurityPolicy and assign it to the Service Account via RoleBinding or ClusterRoleBinding
-podSecurityPolicy:
-  enabled: false
-
-securityContext:
-  capabilities:
-    drop: [ALL]
-  readOnlyRootFilesystem: true
-  allowPrivilegeEscalation: false
-
-podSecurityContext:
-  # /!\ When setting fsGroup, Kubernetes will recursively change ownership and
-  # permissions for the contents of each volume to match the fsGroup. This can
-  # be an issue when storing sensitive content like TLS Certificates /!\
-  fsGroup: 65532
-  # -- Specifies the policy for changing ownership and permissions of volume contents to match the fsGroup.
-  fsGroupChangePolicy: "OnRootMismatch"
-  # -- The ID of the group for all containers in the pod to run as.
-  runAsGroup: 65532
-  # -- Specifies whether the containers should run as a non-root user.
-  runAsNonRoot: true
-  # -- The ID of the user for all containers in the pod to run as.
-  runAsUser: 65532
-
-#
-# -- Extra objects to deploy (value evaluated as a template)
-#
-# In some cases, it can avoid the need for additional, extended or adhoc deployments.
-# See #595 for more details and traefik/tests/values/extra.yaml for example.
 extraObjects:
   - apiVersion: v1
     kind: Secret
@@ -658,10 +81,3 @@ extraObjects:
     spec:
       basicAuth:
         secret: dashboard-authsecret
-
-# This will override the default Release Namespace for Helm.
-# It will not affect optional CRDs such as `ServiceMonitor` and `PrometheusRules`
-# namespaceOverride: traefik
-#
-## -- This will override the default app.kubernetes.io/instance label for all Objects.
-# instanceLabelOverride: traefik