015cbf56de
Adds infrastructure/networking/traefik-helmchartconfig.yaml so the k3s Traefik overrides (badger plugin, allowCrossNamespace, letsencrypt resolver + persistent acme.json, non-root fsGroup) are tracked in git. kube-system is not managed by ArgoCD in this cluster; kubectl apply of this file is the manual reproducibility path. Refs: DEV-455, DEV-457 Co-Authored-By: Paperclip <noreply@paperclip.ing>
45 lines
1.8 KiB
YAML
45 lines
1.8 KiB
YAML
---
|
|
# k3s built-in Traefik HelmChartConfig overrides.
|
|
#
|
|
# k3s ships with a Traefik HelmChart; this HelmChartConfig layers extra
|
|
# values on top without forking the chart. The helm-controller reconciles it
|
|
# and rolls Traefik whenever this changes.
|
|
#
|
|
# Not managed by ArgoCD (ArgoCD doesn't manage kube-system in this cluster);
|
|
# `kubectl apply -f infrastructure/networking/traefik-helmchartconfig.yaml`
|
|
# is the reproducibility path if the cluster is rebuilt.
|
|
#
|
|
# Change history:
|
|
# - DEV-455: badger plugin experimental + additionalArguments.
|
|
# - DEV-457: enable providers.kubernetesCRD.allowCrossNamespace so Pangolin's
|
|
# TraefikService (ns=pangolin) can reference the paperclip Service (ns=paperclip).
|
|
# Add certResolver `letsencrypt` (HTTP-01) with persistent acme.json backing so
|
|
# Pangolin-generated IngressRoutes with `tls.certResolver=letsencrypt` load.
|
|
# podSecurityContext.fsGroup=65532 makes /data writable by Traefik's non-root UID.
|
|
apiVersion: helm.cattle.io/v1
|
|
kind: HelmChartConfig
|
|
metadata:
|
|
name: traefik
|
|
namespace: kube-system
|
|
spec:
|
|
valuesContent: |-
|
|
experimental:
|
|
plugins:
|
|
badger:
|
|
moduleName: "github.com/fosrl/badger"
|
|
version: "v1.5.0"
|
|
persistence:
|
|
enabled: true
|
|
size: 128Mi
|
|
path: /data
|
|
podSecurityContext:
|
|
fsGroup: 65532
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
additionalArguments:
|
|
- "--experimental.plugins.badger.moduleName=github.com/fosrl/badger"
|
|
- "--experimental.plugins.badger.version=v1.5.0"
|
|
- "--providers.kubernetescrd.allowCrossNamespace=true"
|
|
- "--certificatesresolvers.letsencrypt.acme.email=admin@basicstack.de"
|
|
- "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
|
|
- "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
|
|
- "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
|