fml
This commit is contained in:
parent
6b59d3dc49
commit
103647b98f
GPG Key ID:
9B4E311961C63639
@ -1,18 +1,19 @@
|
||||
# Default values for Traefik
|
||||
image:
|
||||
traefik:
|
||||
# Default values for Traefik
|
||||
image:
|
||||
repository: &traefikImage library/traefik
|
||||
name: *traefikImage
|
||||
# defaults to appVersion
|
||||
tag: v2.6.0
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
cloudflaredmage:
|
||||
cloudflaredmage:
|
||||
image: &cloudflaredImage cloudflare/cloudflared:2022.5.3
|
||||
|
||||
#
|
||||
# Configure the deployment
|
||||
#
|
||||
deployment:
|
||||
#
|
||||
# Configure the deployment
|
||||
#
|
||||
deployment:
|
||||
enabled: true
|
||||
# Can be either Deployment or DaemonSet
|
||||
kind: Deployment
|
||||
@ -65,28 +66,28 @@ deployment:
|
||||
[]
|
||||
# - name: myRegistryKeySecretName
|
||||
|
||||
# Pod disruption budget
|
||||
podDisruptionBudget:
|
||||
# Pod disruption budget
|
||||
podDisruptionBudget:
|
||||
enabled: false
|
||||
# maxUnavailable: 1
|
||||
# maxUnavailable: 33%
|
||||
# minAvailable: 0
|
||||
# minAvailable: 25%
|
||||
|
||||
# Use ingressClass. Ignored if Traefik version < 2.3 / kubernetes < 1.18.x
|
||||
ingressClass:
|
||||
# Use ingressClass. Ignored if Traefik version < 2.3 / kubernetes < 1.18.x
|
||||
ingressClass:
|
||||
# true is not unit-testable yet, pending https://github.com/rancher/helm-unittest/pull/12
|
||||
enabled: false
|
||||
isDefaultClass: false
|
||||
# Use to force a networking.k8s.io API Version for certain CI/CD applications. E.g. "v1beta1"
|
||||
fallbackApiVersion: ""
|
||||
|
||||
# Activate Pilot integration
|
||||
pilot:
|
||||
# Activate Pilot integration
|
||||
pilot:
|
||||
enabled: true
|
||||
|
||||
# Enable experimental features
|
||||
experimental:
|
||||
# Enable experimental features
|
||||
experimental:
|
||||
http3:
|
||||
enabled: true
|
||||
plugins:
|
||||
@ -94,8 +95,8 @@ experimental:
|
||||
kubernetesGateway:
|
||||
enabled: false
|
||||
|
||||
# Create an IngressRoute for the dashboard
|
||||
ingressRoute:
|
||||
# Create an IngressRoute for the dashboard
|
||||
ingressRoute:
|
||||
dashboard:
|
||||
enabled: false
|
||||
# Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class)
|
||||
@ -103,29 +104,29 @@ ingressRoute:
|
||||
# Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels)
|
||||
labels: {}
|
||||
|
||||
rollingUpdate:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
maxSurge: 1
|
||||
|
||||
# Customize liveness and readiness probe values.
|
||||
readinessProbe:
|
||||
# Customize liveness and readiness probe values.
|
||||
readinessProbe:
|
||||
failureThreshold: 1
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 2
|
||||
|
||||
livenessProbe:
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 2
|
||||
|
||||
#
|
||||
# Configure providers
|
||||
#
|
||||
providers:
|
||||
#
|
||||
# Configure providers
|
||||
#
|
||||
providers:
|
||||
kubernetesCRD:
|
||||
enabled: true
|
||||
allowCrossNamespace: false
|
||||
@ -150,33 +151,33 @@ providers:
|
||||
# By default this Traefik service
|
||||
# pathOverride: ""
|
||||
|
||||
#
|
||||
# Add volumes to the traefik pod. The volume name will be passed to tpl.
|
||||
# This can be used to mount a cert pair or a configmap that holds a config.toml file.
|
||||
# After the volume has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg:
|
||||
# additionalArguments:
|
||||
# - "--providers.file.filename=/config/dynamic.toml"
|
||||
# - "--ping"
|
||||
# - "--ping.entrypoint=web"
|
||||
volumes:
|
||||
#
|
||||
# Add volumes to the traefik pod. The volume name will be passed to tpl.
|
||||
# This can be used to mount a cert pair or a configmap that holds a config.toml file.
|
||||
# After the volume has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg:
|
||||
# additionalArguments:
|
||||
# - "--providers.file.filename=/config/dynamic.toml"
|
||||
# - "--ping"
|
||||
# - "--ping.entrypoint=web"
|
||||
volumes:
|
||||
[]
|
||||
# - name: public-cert
|
||||
# mountPath: "/certs"
|
||||
# type: emptyDir
|
||||
# - name: '{{ printf "%s-configs" .Release.Name }}'
|
||||
# mountPath: "/config"
|
||||
# type: configMap
|
||||
# - name: '{{ printf "%s-configs" .Release.Name }}'
|
||||
# mountPath: "/config"
|
||||
# type: configMap
|
||||
|
||||
# Additional volumeMounts to add to the Traefik container
|
||||
additionalVolumeMounts:
|
||||
# Additional volumeMounts to add to the Traefik container
|
||||
additionalVolumeMounts:
|
||||
[]
|
||||
# For instance when using a logshipper for access logs
|
||||
# - name: traefik-logs
|
||||
# mountPath: /var/log/traefik
|
||||
|
||||
# Logs
|
||||
# https://docs.traefik.io/observability/logs/
|
||||
logs:
|
||||
# Logs
|
||||
# https://docs.traefik.io/observability/logs/
|
||||
logs:
|
||||
# Traefik logs concern everything that happens to Traefik itself (startup, configuration, events, shutdown, and so on).
|
||||
general:
|
||||
# By default, the logs use a text format (common), but you can
|
||||
@ -219,7 +220,7 @@ logs:
|
||||
# Authorization: drop
|
||||
# Content-Type: keep
|
||||
|
||||
metrics:
|
||||
metrics:
|
||||
# datadog:
|
||||
# address: 127.0.0.1:8125
|
||||
# influxdb:
|
||||
@ -231,7 +232,7 @@ metrics:
|
||||
# statsd:
|
||||
# address: localhost:8125
|
||||
|
||||
tracing:
|
||||
tracing:
|
||||
{}
|
||||
# instana:
|
||||
# enabled: true
|
||||
@ -241,17 +242,17 @@ tracing:
|
||||
# globalTag: ""
|
||||
# prioritySampling: false
|
||||
|
||||
globalArguments:
|
||||
globalArguments:
|
||||
- "--global.checknewversion"
|
||||
|
||||
#
|
||||
# Configure Traefik static configuration
|
||||
# Additional arguments to be passed at Traefik's binary
|
||||
# All available options available on https://docs.traefik.io/reference/static-configuration/cli/
|
||||
## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"`
|
||||
additionalArguments: []
|
||||
#
|
||||
# Configure Traefik static configuration
|
||||
# Additional arguments to be passed at Traefik's binary
|
||||
# All available options available on https://docs.traefik.io/reference/static-configuration/cli/
|
||||
## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"`
|
||||
additionalArguments: []
|
||||
|
||||
certResolvers:
|
||||
certResolvers:
|
||||
cf:
|
||||
dnsChallenge:
|
||||
provider: cloudflare
|
||||
@ -263,32 +264,32 @@ certResolvers:
|
||||
- 1.0.0.1
|
||||
# match the path to persistence
|
||||
storage: /data/acme.json
|
||||
# - "--providers.kubernetesingress.ingressclass=traefik-internal"
|
||||
# - "--log.level=DEBUG"
|
||||
# - "--providers.kubernetesingress.ingressclass=traefik-internal"
|
||||
# - "--log.level=DEBUG"
|
||||
|
||||
# Environment variables to be passed to Traefik's binary
|
||||
env: []
|
||||
# - name: SOME_VAR
|
||||
# value: some-var-value
|
||||
# - name: SOME_VAR_FROM_CONFIG_MAP
|
||||
# valueFrom:
|
||||
# configMapRef:
|
||||
# name: configmap-name
|
||||
# key: config-key
|
||||
# - name: SOME_SECRET
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: secret-name
|
||||
# key: secret-key
|
||||
# Environment variables to be passed to Traefik's binary
|
||||
env: []
|
||||
# - name: SOME_VAR
|
||||
# value: some-var-value
|
||||
# - name: SOME_VAR_FROM_CONFIG_MAP
|
||||
# valueFrom:
|
||||
# configMapRef:
|
||||
# name: configmap-name
|
||||
# key: config-key
|
||||
# - name: SOME_SECRET
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: secret-name
|
||||
# key: secret-key
|
||||
|
||||
envFrom:
|
||||
envFrom:
|
||||
# - configMapRef:
|
||||
# name: config-map-name
|
||||
- secretRef:
|
||||
name: traefik-secrets
|
||||
|
||||
# Configure ports
|
||||
ports:
|
||||
# Configure ports
|
||||
ports:
|
||||
# The name of this one can't be changed as it is used for the readiness and
|
||||
# liveness probes, but you can adjust its config to your liking
|
||||
traefik:
|
||||
@ -370,22 +371,22 @@ ports:
|
||||
# The port protocol (TCP/UDP)
|
||||
protocol: TCP
|
||||
|
||||
# TLS Options are created as TLSOption CRDs
|
||||
# https://doc.traefik.io/traefik/https/tls/#tls-options
|
||||
# Example:
|
||||
tlsOptions:
|
||||
# TLS Options are created as TLSOption CRDs
|
||||
# https://doc.traefik.io/traefik/https/tls/#tls-options
|
||||
# Example:
|
||||
tlsOptions:
|
||||
default:
|
||||
sniStrict: true
|
||||
minVersion: VersionTLS12
|
||||
# preferServerCipherSuites: true
|
||||
# foobar:
|
||||
# curvePreferences:
|
||||
# - CurveP521
|
||||
# - CurveP384
|
||||
# preferServerCipherSuites: true
|
||||
# foobar:
|
||||
# curvePreferences:
|
||||
# - CurveP521
|
||||
# - CurveP384
|
||||
|
||||
# Options for the main traefik service, where the entrypoints traffic comes
|
||||
# from.
|
||||
service:
|
||||
# Options for the main traefik service, where the entrypoints traffic comes
|
||||
# from.
|
||||
service:
|
||||
enabled: true
|
||||
type: NodePort
|
||||
# Additional annotations applied to both TCP and UDP services (e.g. for cloud provider specific config)
|
||||
@ -418,29 +419,29 @@ service:
|
||||
# - IPv4
|
||||
# - IPv6
|
||||
|
||||
## Create HorizontalPodAutoscaler object.
|
||||
##
|
||||
autoscaling:
|
||||
## Create HorizontalPodAutoscaler object.
|
||||
##
|
||||
autoscaling:
|
||||
enabled: false
|
||||
# minReplicas: 1
|
||||
# maxReplicas: 10
|
||||
# metrics:
|
||||
# - type: Resource
|
||||
# resource:
|
||||
# name: cpu
|
||||
# targetAverageUtilization: 60
|
||||
# - type: Resource
|
||||
# resource:
|
||||
# name: memory
|
||||
# targetAverageUtilization: 60
|
||||
# minReplicas: 1
|
||||
# maxReplicas: 10
|
||||
# metrics:
|
||||
# - type: Resource
|
||||
# resource:
|
||||
# name: cpu
|
||||
# targetAverageUtilization: 60
|
||||
# - type: Resource
|
||||
# resource:
|
||||
# name: memory
|
||||
# targetAverageUtilization: 60
|
||||
|
||||
# Enable persistence using Persistent Volume Claims
|
||||
# ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
|
||||
# After the pvc has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg:
|
||||
# additionalArguments:
|
||||
# - "--certificatesresolvers.le.acme.storage=/data/acme.json"
|
||||
# It will persist TLS certificates.
|
||||
persistence:
|
||||
# Enable persistence using Persistent Volume Claims
|
||||
# ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
|
||||
# After the pvc has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg:
|
||||
# additionalArguments:
|
||||
# - "--certificatesresolvers.le.acme.storage=/data/acme.json"
|
||||
# It will persist TLS certificates.
|
||||
persistence:
|
||||
enabled: false
|
||||
name: data
|
||||
# existingClaim: ""
|
||||
@ -451,34 +452,34 @@ persistence:
|
||||
annotations: {}
|
||||
# subPath: "" # only mount a subpath of the Volume into the pod
|
||||
|
||||
# If hostNetwork is true, runs traefik in the host network namespace
|
||||
# To prevent unschedulabel pods due to port collisions, if hostNetwork=true
|
||||
# and replicas>1, a pod anti-affinity is recommended and will be set if the
|
||||
# affinity is left as default.
|
||||
hostNetwork: false
|
||||
# If hostNetwork is true, runs traefik in the host network namespace
|
||||
# To prevent unschedulabel pods due to port collisions, if hostNetwork=true
|
||||
# and replicas>1, a pod anti-affinity is recommended and will be set if the
|
||||
# affinity is left as default.
|
||||
hostNetwork: false
|
||||
|
||||
# Whether Role Based Access Control objects like roles and rolebindings should be created
|
||||
rbac:
|
||||
# Whether Role Based Access Control objects like roles and rolebindings should be created
|
||||
rbac:
|
||||
enabled: true
|
||||
|
||||
# If set to false, installs ClusterRole and ClusterRoleBinding so Traefik can be used across namespaces.
|
||||
# If set to true, installs namespace-specific Role and RoleBinding and requires provider configuration be set to that same namespace
|
||||
namespaced: false
|
||||
|
||||
# Enable to create a PodSecurityPolicy and assign it to the Service Account via RoleBinding or ClusterRoleBinding
|
||||
podSecurityPolicy:
|
||||
# Enable to create a PodSecurityPolicy and assign it to the Service Account via RoleBinding or ClusterRoleBinding
|
||||
podSecurityPolicy:
|
||||
enabled: false
|
||||
|
||||
# The service account the pods will use to interact with the Kubernetes API
|
||||
serviceAccount:
|
||||
# The service account the pods will use to interact with the Kubernetes API
|
||||
serviceAccount:
|
||||
# If set, an existing service account is used
|
||||
# If not set, a service account is created automatically using the fullname template
|
||||
name: ""
|
||||
|
||||
# Additional serviceAccount annotations (e.g. for oidc authentication)
|
||||
serviceAccountAnnotations: {}
|
||||
# Additional serviceAccount annotations (e.g. for oidc authentication)
|
||||
serviceAccountAnnotations: {}
|
||||
|
||||
resources:
|
||||
resources:
|
||||
{}
|
||||
# requests:
|
||||
# cpu: "100m"
|
||||
@ -486,29 +487,29 @@ resources:
|
||||
# limits:
|
||||
# cpu: "300m"
|
||||
# memory: "150Mi"
|
||||
affinity: {}
|
||||
# # This example pod anti-affinity forces the scheduler to put traefik pods
|
||||
# # on nodes where no other traefik pods are scheduled.
|
||||
# # It should be used when hostNetwork: true to prevent port conflicts
|
||||
# podAntiAffinity:
|
||||
# requiredDuringSchedulingIgnoredDuringExecution:
|
||||
# - labelSelector:
|
||||
# matchExpressions:
|
||||
# - key: app.kubernetes.io/name
|
||||
# operator: In
|
||||
# values:
|
||||
# - {{ template "traefik.name" . }}
|
||||
# topologyKey: kubernetes.io/hostname
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
# # This example pod anti-affinity forces the scheduler to put traefik pods
|
||||
# # on nodes where no other traefik pods are scheduled.
|
||||
# # It should be used when hostNetwork: true to prevent port conflicts
|
||||
# podAntiAffinity:
|
||||
# requiredDuringSchedulingIgnoredDuringExecution:
|
||||
# - labelSelector:
|
||||
# matchExpressions:
|
||||
# - key: app.kubernetes.io/name
|
||||
# operator: In
|
||||
# values:
|
||||
# - {{ template "traefik.name" . }}
|
||||
# topologyKey: kubernetes.io/hostname
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
|
||||
# Pods can have priority.
|
||||
# Priority indicates the importance of a Pod relative to other Pods.
|
||||
priorityClassName: ""
|
||||
# Pods can have priority.
|
||||
# Priority indicates the importance of a Pod relative to other Pods.
|
||||
priorityClassName: ""
|
||||
|
||||
# Set the container security context
|
||||
# To run the container with ports below 1024 this will need to be adjust to run as root
|
||||
securityContext:
|
||||
# Set the container security context
|
||||
# To run the container with ports below 1024 this will need to be adjust to run as root
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
readOnlyRootFilesystem: true
|
||||
@ -516,5 +517,5 @@ securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
|
||||
podSecurityContext:
|
||||
podSecurityContext:
|
||||
fsGroup: 65532
|
||||
|
||||
28
apps/templates/traefik.yaml
Normal file
28
apps/templates/traefik.yaml
Normal file
@ -0,0 +1,28 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: default
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: default
|
||||
project: default
|
||||
source:
|
||||
path: Charts/traefik
|
||||
repoURL: https://git.roxedus.dev/Roxedus/Argo.git
|
||||
targetRevision: HEAD
|
||||
helm:
|
||||
version: v3
|
||||
#valueFiles:
|
||||
# - values.yaml
|
||||
values: |
|
||||
|
||||
image:
|
||||
tag: v2.6.0
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
Loading…
Reference in New Issue
Block a user