posts/kube-traefik-cert-manager-le/

[giscus[bot]]

posts/kube-traefik-cert-manager-le/

Traefik, cert-manager, Cloudflare, and Let’s Encrypt are a winning combination when it comes to securing your services with certificates in Kubernetes. Today, we’ll install and configure Traefik, the cloud native proxy and load balancer, as our Kubernetes Ingress Controller. We’ll then install and configure cert-manager to manage certificates for our cluster. We’ll set up Let’s Encrypt as our Cluster Issuer so that cert-manager can automatically provision TLS certificates and even wildcard certificates using Cloudflare DNS challenge absolutely free. We’ll walk through all of this, step by step, so you can help secure your cluster today.

https://technotim.live/posts/kube-traefik-cert-manager-le/

[re4s0n4]

Please note: There has been a significant change in how metallb does its address-pools. This took me quite a while to figure out since every other example I found shows it how you did it, but it has been deprecated. This is a lesson for me to RTFM sooner (https://metallb.universe.tf/configuration/#layer-2-configuration).

apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: default
  namespace: metallb-system
spec:
  addresses:
  - 10.155.192.113-10.155.192.119

We'll also need an advertisement:

apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
  name: example
  namespace: metallb-system

[timothystewart6]

Thanks for the tip! Happy to update the docs!

[vrapcan]

Hi Tim,

Thanks for your awesome guides.

I was trying to issue Let's Encrypt certificates on a new cluster following this guide and I was getting this error: Error from server (NotFound): clusterissuers.cert-manager.io "letsencrypt" not found.

To fix it, I had to remove the double quotes around the name servers in the launchpad/kubernetes/traefik-cert-manager/cert-manager/values.yaml

I created a pull request for this issue on github: techno-tim/launchpad#34

Cheers,

Viliam

[jahknem]

Hi Tim,

I know it goes against exactly what you have achieved with this tutorial, but could you maybe explain how to use an existing certificate instead of cert-manager? I'm using your tutorial for a testing cluster in my internship and don't seem to be able to get it to work. Per my understanding cert-manager does not allow that?

Thanks

Jan

[cannfoddr]

Hi Tim,

Loving your K3S stuff - really interesting. I have a K8S (Kubeadm) piKube up and running with Traefik and cert manager all working. I have used your k3s ansible to setup a k3s cluster on proxmox and it was brilliant. I am now using this article to get Traefik and cert manager.

I am totally stuck on traefik - the helm install went fine but I cannot for the life of me get dashboard access. I can get chrome to prompt for a user name and password but no matter what I type I cannot get access. I have compared it to my almost identical working k8s dashboard setup for traefik and cannot see what I am doing wrong!

Interestingly I have tried removing the middleware from the ingressroute but I am still getting prompted for a password - I don't understand why that should be the case?

Next step is to completely remove traefik and start again wih a fresh helm install - any suggestions on why basicauth may not be working? I have in the back of my mind something to do with a security realm from my k8s install but I just cant see the problem

Adrian

[cannfoddr]

Ignore the above I am an idiot - there's a docker traffic instance running on my TrueNas Scale box with the same hostname!!! All my requests that I thought were ending up at k3s were actually going there! I fixed the local DNS and k3s traefik is now working as expected.

[CanisHelix]

This is great and I was able to tweak this and get route53 working for wildcards. But how can we get the dashboard to use the new live production cert instead of it's own?

I uncommented the following in the dashboard ingress.yml and applied it.

  tls:
    secretName: mydomain-com-tls

But it's still using the old self-signed traefik one.

[CanisHelix]

I believe it's due to the secret for the certifcate being in a different namespace. Using https://cert-manager.io/docs/tutorials/syncing-secrets-across-namespaces/ I've mirrored to traefik and default, but not sure if this is the best recommended method.

[JohnnySixStrings]

My dns provider is domains.google.com so I had to use a webhook. When the webhook makes a request to update the dns records it gets something like this : x509: certificate is valid for x.default.traefik not y. same thing happens with my rancher instance when I try to add a new repo similar issue. example Get "https://charts.jetstack.io/index.yaml": x509: certificate is valid for eed820bb8954c7e99e63219796ded95d.1c4467d7c584ce11c30c573d8a187bf4.traefik.default, not charts.jetstack.io

[JohnnySixStrings]

I figured it out I need to enable crossNameSpace in values for the traefik helm chart.
providers:
kubernetesCRD:
enabled: true
ingressClass: traefik-external
allowExternalNameServices: true
allowCrossNamespace: true

[CanisHelix]

Interesting solutions, I was having a similar error message when trying to add a plugin to Traefik. Turned out that a wildcard * A record on my domain was the cause because. I wonder if this might have resolved it too.

[cannfoddr]

Simplest thing to do would be to setup a port forward from your router to your metallb address using port 443. Then publish blog.mydomain.com <http://blog.mydomain.com/> to cloud flare as a CNAME of whatever host you are dynamically updating from home-assistant. This will in theory expose all of your services on the traffic host but you have to know the correct hostname to access them. I am considering running two traefik instances, one for external and one of internal and using different traffic classnames to direct services to internal or external

…

On 26 Apr 2023, at 14:26, madmurl0c ***@***.***> wrote: This may be a bit beyond the scope of this tutorial but what to do if I'd like to expose services from my k3s cluster to the outside world? Now that I have valid certificates I would like to have blog.mydomain.com reachable from the outside world. Is there a way to communicate the ipv4/ipv6 addresses of the metallb load balancer to cloudflare? Currently I have my DNS pointed to my Home Assistant VM (using the Home Assistant cloudflare integration) and use the Nginx Proxy Manager Add-on instead of traefik. — Reply to this email directly, view it on GitHub <#234 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAH4WOQ3PUNTAQYOMNACQXLXDEO7HANCNFSM6AAAAAAVK6YITM>. You are receiving this because you commented.

[afrojewelz]

hi , i ve been wondering among those traefik deploy issue on dashboard not showing up when turn on the options on values of traefik.
as for certmgr on k3s, i obtain successfully my third tier domain name with wild card *.k3s.example.com
but when i open up url like traefik.k3s.example.com ,the browser will always says

此网站无法提供安全连接traefik.k3s.example.com 使用了不受支持的协议。
ERR_SSL_VERSION_OR_CIPHER_MISMATCH

[afrojewelz]

and i think somehow you forgot mention to corporate certmanager with traefik, the certs needs define TLSstore kind yaml on certificate in order to let traefik automated load cert that acquire from certmgr. otherwise it's will always fallback to TRAEFIK DEFAULT.

[rdm0991]

Hi Tim, Excellent videos, and have been following to have the home lab setup. Now I have the k3s cluster up and running with Rancher. The cert-manager is giving trouble with DNS , it is ending with the error: ClusterIssuer letsencrypt-staging cert-manager-clusterissuers Error initializing issuer: Get "https://acme-staging-v02.api.letsencrypt.org./directory": dial tcp: lookup acme-staging-v02.api.letsencrypt.org.: i/o timeout. Is this any indication that the virtualized pfsense is blocking 443 traffic into kubernetes cluster? Please advise any work around for getting the cert manager up and running. thanks. pfsense

[sli3]

Hey Tim!, Fabulous video and I learnt so much about SSL thank you so much. I have a quest that still unclear, and wonder if you have any video that explain about more about Middleware part?

Thanks in advance.

[coco6789]

Hi,
awsome tutorial, following your videos one by one. so interesting, bit of a newbie here but i like the clallenge. i was wondering if you could make a template for duckdns webhook ? i found a few example while googling but cant seem to make it work. also i rather the way you do it.

thanks

[byrn-baker]

Tim,
Really have gotten a lot out of the series k3s including this one. Thanks for putting the time in to figure this out and explain it. I went ahead and added some ansible tasks to your k3s-ansible project for the steps you have in this post.

https://github.com/byrn-baker/k3s-ansible

[tidusff86]

Is it possible to use Namecheap instead of Cloudflare?

[timothystewart6]

You'll have to check cert-manager to see which DNS providers they support for DNS01

[mrkhachaturov]

apiVersion: traefik.containo.us/v1alpha1 must be updated to traefik.io/v1alpha1 for traefik 3

[Mithi83]

This has cost me a night of debugging. Thanks for the solution!

[cgraaaj]

Hey Geeks,

I wanted to know how the nginx deployment is working without making the service of nginx as load balancer.
how tim managed to point it out via lb to traefik to container pod

could anyone help me understand this!!!

[tscibilia]

Thanks so much for detailing this setup (along with your ansible playbook to configure kubernetes) I'm pretty sure I followed this guide to the letter but I was not able to reach the traefik dashboard page. I knew there was some issue with not being able to reach the metallb ip address (but since the rancher ui was in the same pool, I was confused).

I stumbled on this comment from github and I added the following to my L2Advertisement, and to my surprise it all worked. I just wanted to share in case anyone else runs into this issue.

spec:
  ipAddressPools:
  - first-pool

[mcguppy]

First of all, thank you for your amazing work in the k3s series! I’ve been following along over the past few days and successfully set up my k3s cluster, Traefik, and cert-manager with a wildcard certificate, as you described. Everything worked flawlessly—thank you for the clear instructions.

Today, I installed Rancher according your article and wanted to secure it with the same wildcard certificate to avoid certificate errors. However, I ran into an issue: the certificate secret was only available in the "default" namespace. When I tried using your Nginx test app in a different namespace, I encountered the same problem—no access to the certificate secret, which led to certificate errors.

After some research, I found this article from Cert-Manager: https://cert-manager.io/docs/devops-tips/syncing-secrets-across-namespaces/

However, I opted for a simpler solution: setting the wildcard certificate as Traefik's default certificate. I followed the steps outlined in this article: https://blog.stonegarden.dev/articles/2023/12/traefik-wildcard-certificates/

Here’s what I did:

I moved my wildcard certificate to the "traefik" namespace.
I updated Traefik’s Helm values to specify this wildcard certificate as the default certificate.
Now, for my applications, I simply omit the "tls" parameters in the Ingress resources, and Traefik automatically uses the default certificate (my wildcard certificate).

For Rancher, I updated the Ingress to use the "Default Ingress Controller Certificate," and everything is working perfectly—no more certificate errors!

I hope this helps others who might face a similar issue.

[ts67]

I'm trying to install Traefik with the values.yaml, according to this article, but I get the following error:

"Error: INSTALLATION FAILED: execution error at (traefik/templates/_podtemplate.tpl:601:18): ERROR: redirectTo syntax has been removed in v34 of this Chart."

What can be wrong?

[erustyrannus]

traefik/traefik-helm-chart#1301

TLDR:
Change:

ports:
web:
redirectTo:
port: websecure

to:

ports:
web:
redirections:
entryPoint:
to: websecure
scheme: https

On values.yaml

[rtomik]

Good solution but it only worked in default namespace edited it a bit and added to ansible to easy deploy

group_vars/all/main.yml

Domain configuration

domain:
email:

Cloudflare

If you want to use TLS certificates on apps enable cloudflare and define API token

Cloudflare api token settings Permissions: Zone - DNS - Edit Zone - Zone - Read Zone Resources: Include - All Zones

enable_cloudflare: true
cloudflare_api_token:
tls_secret_name: "wildcard-{{ domain }}-tls"

playbooks/main.yml

• name: 05 Deploy infrastructure applications
  hosts: k3s_cluster[0]
  become: true
  vars:
  ansible_user: "{{ user }}"
  roles:

  • role: 05_infra
    tags:
    • infra
      roles/infra/main.yml

• name: Install Helm
  shell: |
  curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
  args:
  creates: /usr/local/bin/helm
  tags:

  • infra
  • infra:helm

• name: Add Helm repositories
  kubernetes.core.helm_repository:
  name: "{{ item.name }}"
  repo_url: "{{ item.url }}"
  loop:

  • { name: traefik, url: "https://helm.traefik.io/traefik" }
  • { name: authentik, url: "https://charts.goauthentik.io" }
  • { name: argo, url: "https://argoproj.github.io/argo-helm" }
  • { name: longhorn, url: "https://charts.longhorn.io" }
  • { name: prometheus-community, url: "https://prometheus-community.github.io/helm-charts" }
  • { name: rancher-stable, url: "https://releases.rancher.com/server-charts/stable" }
  • { name: jetstack, url: "https://charts.jetstack.io" }
  • { name: metallb, url: "https://metallb.github.io/metallb" }
  • { name: gitlab, url: "https://charts.gitlab.io/" }
  • { name: grafana, url: "https://grafana.github.io/helm-charts"}
  • { name: emberstack , url: "https://emberstack.github.io/helm-charts"}
    tags:
  • infra
  • infra:repos

• import_tasks: traefik.yml
  tags:

  • infra
  • infra:traefik

• import_tasks: certs.yml
  tags:

  • infra
  • infra:certs

roles/infra/certs.yml

• name: Check if cert-manager is already installed
  kubernetes.core.k8s_info:
  api_version: apps/v1
  kind: Deployment
  name: cert-manager
  namespace: cert-manager
  register: cert_manager_check
  ignore_errors: true

• name: Deploy cert-manager
  kubernetes.core.helm:
  name: cert-manager
  chart_ref: jetstack/cert-manager
  chart_version: "{{ certmanager_version }}"
  release_namespace: cert-manager
  create_namespace: yes
  values:
  installCRDs: true
  replicaCount: 1
  extraArgs:
  - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
  - --dns01-recursive-nameservers-only
  podDnsPolicy: None
  podDnsConfig:
  nameservers:
  - 1.1.1.1
  - 9.9.9.9
  #when: cert_manager_check.resources | length == 0

• name: Wait for cert-manager to be ready
  kubernetes.core.k8s_info:
  kind: Pod
  namespace: cert-manager
  label_selectors:
  - app.kubernetes.io/instance=cert-manager
  register: cert_manager_pods
  until: cert_manager_pods.resources | length > 0 and cert_manager_pods.resources | map(attribute='status.phase') | list | unique == ['Running']
  retries: 10
  delay: 30

• name: Deploy reflector
  kubernetes.core.helm:
  name: reflector
  chart_ref: emberstack/reflector
  chart_version: "{{ reflector_version }}"
  release_namespace: cert-manager
  when: enable_cloudflare | bool

• name: Add cloudflare api token to secret
  kubernetes.core.k8s:
  definition:
  apiVersion: v1
  kind: Secret
  metadata:
  name: cloudflare-api-token
  namespace: cert-manager
  type: Opaque
  data:
  api-token: "{{ cloudflare_api_token | b64encode }}"
  when: enable_cloudflare | bool

• name: Create issuer
  kubernetes.core.k8s:
  definition:
  apiVersion: cert-manager.io/v1
  kind: ClusterIssuer
  metadata:
  name: cloudflare-issuer
  spec:
  acme:
  server: https://acme-v02.api.letsencrypt.org/directory
  email: "{{ email }}"
  privateKeySecretRef:
  name: cloudflare-key
  solvers:
  - dns01:
  cloudflare:
  apiTokenSecretRef:
  name: cloudflare-api-token
  key: api-token
  selector:
  dnsZones:
  - "{{ domain }}"
  when: enable_cloudflare | bool

• name: Create certificate
  kubernetes.core.k8s:
  definition:
  apiVersion: cert-manager.io/v1
  kind: Certificate
  metadata:
  name: wildcard-{{ domain }}
  namespace: cert-manager
  spec:
  secretName: "{{ tls_secret_name }}"
  issuerRef:
  name: cloudflare-issuer
  kind: ClusterIssuer
  commonName: ".{{ domain }}"
  dnsNames:
  - "{{ domain }}"
  - ".{{ domain }}"
  secretTemplate:
  annotations:
  reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
  reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "traefik"
  reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
  reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "traefik"
  when: enable_cloudflare | bool

roles/infra/traefik.yml

• name: Deploy or upgrade traefik
  kubernetes.core.helm:
  name: traefik
  chart_ref: traefik/traefik
  chart_version: "{{ traefik_version }}"
  release_namespace: traefik
  create_namespace: yes
  values: "{{ lookup('template', 'values-traefik.yml.j2') | from_yaml }}"
  wait: yes
  wait_timeout: 5m
  register: traefik_deploy

• name: Configure traefik Middleware
  kubernetes.core.k8s:
  definition:
  apiVersion: traefik.io/v1alpha1
  kind: Middleware
  metadata:
  name: default-headers
  namespace: default
  spec:
  headers:
  browserXssFilter: true
  contentTypeNosniff: true
  forceSTSHeader: true
  stsIncludeSubdomains: true
  stsPreload: true
  stsSeconds: 15552000
  referrerPolicy: no-referrer
  contentSecurityPolicy: "default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' https: data:; connect-src 'self' https:; frame-src 'self' https:; media-src 'self' https:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; form-action 'self';"
  customFrameOptionsValue: SAMEORIGIN
  customRequestHeaders:
  X-Forwarded-Proto: https

roles/infra/templates/values-traefik.yml.j2

globalArguments:

• "--global.sendanonymoususage=false"
• "--global.checknewversion=false"

additionalArguments:

• "--serversTransport.insecureSkipVerify=true"
• "--log.level=INFO"

deployment:
enabled: true
replicas: 3
annotations: {}
podAnnotations: {}
additionalContainers: []
initContainers: []

ports:
websecure:
http3:
enabled: true
advertisedPort: 4443
tls:
enabled: true

ingressRoute:
dashboard:
enabled: false

providers:
kubernetesCRD:
enabled: true
ingressClass: traefik
allowExternalNameServices: true
kubernetesIngress:
enabled: true
allowExternalNameServices: true
publishedService:
enabled: false

rbac:
enabled: true

service:
enabled: true
type: LoadBalancer
annotations: {}
labels: {}
spec:
loadBalancerIP: 100.64.0.1
loadBalancerSourceRanges: []
externalIPs: []

tlsStore:
default:
defaultCertificate:
secretName: "{{ tls_secret_name }}"

[rtomik]

i had issues with grafana ive changed the middleware config

- name: Configure traefik Middleware
  kubernetes.core.helm:
    definition:
      apiVersion: traefik.io/v1alpha1
      kind: Middleware
      metadata:
        name: default-headers
        namespace: default
      spec:
        headers:
          browserXssFilter: true
          contentTypeNosniff: true
          forceSTSHeader: true
          stsIncludeSubdomains: true
          stsPreload: true
          stsSeconds: 15552000
          referrerPolicy: no-referrer
          contentSecurityPolicy: >-
            default-src 'self';
            script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:;
            style-src 'self' 'unsafe-inline';
            img-src 'self' data: blob:;
            font-src 'self' data:;
            connect-src 'self' ws: wss:;
            worker-src 'self' blob:;
            frame-src 'self';
            media-src 'self';
            object-src 'none';
            frame-ancestors 'self';
            base-uri 'self';
            form-action 'self'
          customFrameOptionsValue: SAMEORIGIN
          customRequestHeaders:
            X-Forwarded-Proto: https

[rtomik]

sorry forgot to add it to code block

git/k3s_ansible/roles/05_infra/tasks/certs.yml

---
- name: Check if cert-manager is already installed
  kubernetes.core.k8s_info:
    api_version: apps/v1
    kind: Deployment
    name: cert-manager
    namespace: cert-manager
  register: cert_manager_check
  ignore_errors: true

- name: Deploy cert-manager
  kubernetes.core.helm:
    name: cert-manager
    chart_ref: jetstack/cert-manager
    chart_version: "{{ certmanager_version }}"
    release_namespace: cert-manager
    create_namespace: yes
    values:
      installCRDs: true
      replicaCount: 1
      extraArgs:
        - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
        - --dns01-recursive-nameservers-only
      podDnsPolicy: None
      podDnsConfig:
        nameservers:
          - 1.1.1.1
          - 9.9.9.9
  #when: cert_manager_check.resources | length == 0

- name: Wait for cert-manager to be ready
  kubernetes.core.k8s_info:
    kind: Pod
    namespace: cert-manager
    label_selectors:
      - app.kubernetes.io/instance=cert-manager
  register: cert_manager_pods
  until: cert_manager_pods.resources | length > 0 and cert_manager_pods.resources | map(attribute='status.phase') | list | unique == ['Running']
  retries: 10
  delay: 30

- name: Deploy reflector 
  kubernetes.core.helm:
    name: reflector 
    chart_ref: emberstack/reflector
    chart_version: "{{ reflector_version }}"
    release_namespace: cert-manager
  when: enable_cloudflare | bool

- name: Add cloudflare api token to secret
  kubernetes.core.k8s:
    definition:
      apiVersion: v1
      kind: Secret
      metadata:
        name: cloudflare-api-token
        namespace: cert-manager
      type: Opaque
      data:
        api-token: "{{ cloudflare_api_token | b64encode }}"
  when: enable_cloudflare | bool

- name: Create issuer 
  kubernetes.core.k8s:
    definition:
      apiVersion: cert-manager.io/v1
      kind: ClusterIssuer
      metadata:
        name: cloudflare-issuer
      spec:
        acme:
          server: https://acme-v02.api.letsencrypt.org/directory
          email: "{{ email }}"
          privateKeySecretRef:
            name: cloudflare-key
          solvers:
            - dns01:
                cloudflare:
                  apiTokenSecretRef:
                    name: cloudflare-api-token
                    key: api-token
              selector:
                dnsZones:
                  - "{{ domain }}"              
  when: enable_cloudflare | bool

- name: Create certificate
  kubernetes.core.k8s:
    definition:
      apiVersion: cert-manager.io/v1
      kind: Certificate
      metadata:
        name: wildcard-{{ domain }}
        namespace: cert-manager
      spec:
        secretName: "{{ tls_secret_name }}"
        issuerRef:
          name: cloudflare-issuer
          kind: ClusterIssuer       
        commonName: "*.{{ domain }}"           
        dnsNames:
        - "{{ domain }}"
        - "*.{{ domain }}"
        secretTemplate:
          annotations:
            reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
            reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "traefik"
            reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
            reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "traefik"
  when: enable_cloudflare | bool

[rtomik]

git/k3s_ansible/roles/05_infra/tasks/traefik.yml

---
- name: Check if traefik is already installed
  kubernetes.core.k8s_info:
    api_version: apps/v1
    kind: Deployment
    name: traefik-server
    namespace: traefik
  register: traefik_check
  ignore_errors: true

- name: Fetch traefik Helm chart information
  kubernetes.core.helm_info:
    name: traefik
    release_namespace: traefik
  register: traefik_helm_info
  ignore_errors: true

- name: Deploy or upgrade traefik
  kubernetes.core.helm:
    name: traefik
    chart_ref: traefik/traefik
    chart_version: "{{ traefik_version }}"
    release_namespace: traefik
    create_namespace: yes
    values: "{{ lookup('template', 'values-traefik.yml.j2') | from_yaml }}"
    wait: yes
    wait_timeout: 5m
  register: traefik_deploy

- name: Configure traefik Middleware
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: traefik.io/v1alpha1
      kind: Middleware
      metadata:
        name: default-headers
        namespace: default
      spec:
        headers:
          browserXssFilter: true
          contentTypeNosniff: true
          forceSTSHeader: true
          stsIncludeSubdomains: true
          stsPreload: true
          stsSeconds: 15552000
          referrerPolicy: no-referrer
          contentSecurityPolicy: >-
            default-src 'self';
            script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:;
            style-src 'self' 'unsafe-inline';
            img-src 'self' data: blob:;
            font-src 'self' data:;
            connect-src 'self' ws: wss:;
            worker-src 'self' blob:;
            frame-src 'self';
            media-src 'self';
            object-src 'none';
            frame-ancestors 'self';
            base-uri 'self';
            form-action 'self'
          customFrameOptionsValue: SAMEORIGIN
          customRequestHeaders:
            X-Forwarded-Proto: https

git/k3s_ansible/roles/05_infra/tasks/templates/values-traefik.yml.j2

globalArguments:
  - "--global.sendanonymoususage=false"
  - "--global.checknewversion=false"

additionalArguments:
  - "--serversTransport.insecureSkipVerify=true"
  - "--log.level=INFO"

deployment:
  enabled: true
  replicas: 3
  annotations: {}
  podAnnotations: {}
  additionalContainers: []
  initContainers: []

ports:
  websecure:
    http3:
      enabled: true
    advertisedPort: 4443
    tls:
      enabled: true
      
ingressRoute:
  dashboard:
    enabled: false

providers:
  kubernetesCRD:
    enabled: true
    ingressClass: traefik
    allowExternalNameServices: true
  kubernetesIngress:
    enabled: true
    allowExternalNameServices: true
    publishedService:
      enabled: false

rbac:
  enabled: true

service:
  enabled: true
  type: LoadBalancer
  annotations: {}
  labels: {}
  spec:
    loadBalancerIP: 100.64.0.1
  loadBalancerSourceRanges: []
  externalIPs: []

tlsStore:
  default:
    defaultCertificate:
      secretName: "{{ tls_secret_name }}"