PaletteAI 1.4.2 Release Notes
Summary
PaletteAI 1.4.2 is a stable patch release on the 1.4 line that hardens profile bundle and compute pool updates, preserves operator configuration across controller restarts, and moves the built-in ingress to Traefik Hub in proxy mode.
- Profile bundles and compute pools - Workload Profile and cluster profile updates are deferred when a required variable has no value, with a status message that lists the missing variables, and deployed cluster add-on profiles are reconciled when a ProfileBundle is re-pinned. Packaged profile bundles now write lowercase
cpuandgpurequirement keys, which clears schema validation errors. Provisioned Compute Pools reportUnknowninstead ofFailedwhile Palette is unreachable, and a host already markedUnhealthyno longer flips back toProvisioningwhen Palette briefly reports it as provisioning again. - Palette integration and access control - Changes an operator makes to the default Tenant and Project, such as a custom Palette secret or display names, are preserved across controller restarts. ClusterProfiles deleted or moved in Palette are restored, unexpected
oci://orhttps://prefixes on the injectedzot-endpointare normalized to a barehost:port, and PaletteResOperationForbiddenresponses are classified as forbidden rather than a generic error. - Console - Skip SSL Certificate Verification and a certificate secret are now mutually exclusive in Palette integration settings, a project can override an unlocked system Hugging Face integration when the tenant scope is not shared with that project, display names may differ from resource names when creating tenants and projects, and the required-field asterisk stays visible in the profile bundle variables table.
- Platform and security - The built-in ingress runs Traefik Hub in proxy mode (Traefik Proxy without a hub token), Traefik is enabled on spokes that enable Zot, Dex moves to 2.46.0 with post-logout redirects registered, Helm helper jobs use a unified
spectro-kubectlimage, the Canvas config-reload sidecar moves to its own image, the fluxcd-manager chart no longer installs CRDs, and a newcleanup.deleteHubvalue controls whether the OCM Hub is removed on uninstall. Dependency refreshes includegolang.org/x/net0.62 for reported vulnerabilities, current Kubernetes and Flux libraries, and Node 26.12.1 for Canvas.
For the complete list of changes in each component, refer to Full Component Release Notes.
Upgrade Notes
- You must upgrade the
mural-crdschart to 0.7.26-hotfix.2 before upgrading themuralchart to 1.4.2. - The default ingress controller image is now
ghcr.io/traefik/traefik-hub:v3.21.6-fips. If you mirror images for an air-gapped installation, include this image in your registry. Custom values that pin the previous Traefik image must also settraefik.hub.enabled: false. Without that setting, themuralchart fails to render. - Traefik Service overrides that were previously top-level, such as
traefik.service.loadBalancerSourceRangesandtraefik.service.externalIPs, are now read only fromtraefik.service.spec. Move any existing Service spec overrides undertraefik.service.specbefore upgrading. Otherwise, the upgrade silently ignores them. - For detailed instructions on how to upgrade PaletteAI, refer to the PaletteAI upgrade guide.
Component Versions
The following component versions are pinned for this PaletteAI release:
| Component | Version |
|---|---|
| brush | 0.5.34-hotfix.2 |
| canvas | 0.6.30-hotfix.2 |
| curator | 0.0.11-hotfix.2 |
| frisket | 0.1.10-hotfix.2 |
| hue | 0.12.38-hotfix.2 |
| mural-crds | 0.7.26-hotfix.2 |
Mural Helm values
The following diff lists changes to mural/charts/mural/values.yaml between PaletteAI 1.4.1 and 1.4.2. Review it before upgrading if you maintain custom Helm values. The largest block is the regenerated Traefik chart values that accompany the Traefik Hub upgrade.
values.yaml changes between 1.4.1 and 1.4.2
values.yaml
diff --git a/mural/charts/mural/values.yaml b/mural/charts/mural/values.yaml
index 8c2dce980e..53b93d7b0b 100644
--- a/mural/charts/mural/values.yaml
+++ b/mural/charts/mural/values.yaml
@@ -72,7 +72,7 @@ global:
# - use a custom FleetConfig controller image with the `gke-gcloud-auth-plugin` installed
kubernetesProvider: "Generic"
certManagerVersion: "v1.21.0"
- muralVersion: "1.4.1" # x-release-please-version
+ muralVersion: "1.4.2" # x-release-please-version
dns:
domain: "replace.with.your.domain"
rootIngress:
@@ -120,7 +120,7 @@ global:
username: ""
password: ""
basicAuthSecretName: ""
- muralCrdsVersion: "0.7.26-hotfix.1"
+ muralCrdsVersion: "0.7.26-hotfix.2"
## @section certificates
## @param certificates.clusterIssuer.spec.selfSigned The spec for the ClusterIssuer used by cert-manager to issue the Mural root CA certificate.
@@ -150,11 +150,13 @@ certificates:
## @param cleanup.imagePullPolicy Cleanup image pull policy.
## @param cleanup.deletionIntervalSeconds Cleanup deletion interval seconds.
## @param cleanup.deletionTimeoutSeconds Cleanup deletion timeout seconds.
+## @param cleanup.deleteHub Delete the OCM Hub on uninstall.
cleanup:
image: us-docker.pkg.dev/palette-images-fips/palette/spectro-cleanup-bcfips/cleanup:v1.9.0
imagePullPolicy: IfNotPresent
deletionIntervalSeconds: 2
deletionTimeoutSeconds: 300
+ deleteHub: true
## @section fleetConfig
## @param fleetConfig.enabled Whether to create Hub and Spoke resources.
@@ -1562,7 +1564,7 @@ brush:
## @param brush.image.pullPolicy The pull policy to use for the image
image:
repository: public.ecr.aws/mural/brush
- tag: v0.5.34-hotfix.1
+ tag: v0.5.34-hotfix.2
pullPolicy: IfNotPresent
## @param brush.imagePullSecrets The pull secrets to use for the image
imagePullSecrets: []
@@ -1857,7 +1859,7 @@ canvas:
## @param canvas.image.pullPolicy canvas image pull policy
image:
repository: public.ecr.aws/mural/canvas
- tag: v0.6.30-hotfix.1
+ tag: v0.6.30-hotfix.2
pullPolicy: IfNotPresent
## @param canvas.imagePullSecrets Image pull secrets
imagePullSecrets: []
@@ -1873,6 +1875,8 @@ canvas:
## @param canvas.configReload.tlsCert The path to the TLS certificate. Default is /etc/k8s-webhook-certs/tls.crt. Requires connectionSchema to be https.
## @param canvas.configReload.tlsKey The path to the TLS key. Default is /etc/k8s-webhook-certs/tls.key. Requires connectionSchema to be https.
## @param canvas.configReload.connectionSchema The schema to use for webhook request to the /webhooks/reload endpoint. Default is https.
+ ## @param canvas.configReload.image.repository configmap-reload sidecar image repository
+ ## @param canvas.configReload.image.tag configmap-reload sidecar image tag
configReload:
code: KeOgpeNa45k3
insecure: false
@@ -1880,6 +1884,9 @@ canvas:
tlsCert: "/etc/k8s-webhook-certs/tls.crt"
tlsKey: "/etc/k8s-webhook-certs/tls.key"
connectionSchema: "https"
+ image:
+ repository: public.ecr.aws/mural/third-party/configmap-reload
+ tag: v1.4.0
## @param canvas.podSecurityContext.fsGroup File system group ID to run the container as
## @param canvas.podSecurityContext.seccompProfile.type Seccomp profile type to use for the canvas pod
podSecurityContext:
@@ -2096,7 +2103,7 @@ curator:
## @param curator.image.pullPolicy Image pull policy for curator.
image:
repository: public.ecr.aws/mural/curator
- tag: v0.0.11-hotfix.1
+ tag: v0.0.11-hotfix.2
pullPolicy: IfNotPresent
## @param curator.imagePullSecrets Image pull secrets for curator.
imagePullSecrets: []
@@ -2176,7 +2183,7 @@ dex:
# -- [Image pull policy](https://kubernetes.io/docs/concepts/containers/images/#updating-images) for updating already existing images on a node.
pullPolicy: IfNotPresent
# -- Image tag override for the default value (chart appVersion).
- tag: "v2.45.1"
+ tag: "v2.46.0"
# -- When digest is set to a non-empty value, images will be pulled by digest (regardless of tag value).
digest: ""
# -- Reference to one or more secrets to be used when [pulling images](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-pod-that-uses-your-secret) (from private registries).
@@ -2238,6 +2245,8 @@ dex:
- id: mural
redirectURIs:
- 'https://replace.with.your.domain/ai/callback'
+ postLogoutRedirectURIs:
+ - 'https://replace.with.your.domain/ai/login'
name: 'mural'
secret: "REPLACEME_WITH_YOUR_SECRET"
public: false
@@ -3372,7 +3381,7 @@ fluxcd-manager:
## @param fluxcd-manager.kubectl.image The kubectl helper image to use for FluxCD operations
kubectl:
- image: us-east1-docker.pkg.dev/spectro-images/dev-fips/spectro-kubectl:1.34.2
+ image: us-docker.pkg.dev/palette-images-fips/third-party/spectro-kubectl:1.37.1-spectro-4.9.x
## @skip fluxcd-manager.fluxcdConfig
fluxcdConfig:
installCRDs: true
@@ -3414,7 +3423,7 @@ frisket:
## @param frisket.image.pullPolicy Image pull policy for frisket.
image:
repository: public.ecr.aws/mural/frisket
- tag: v0.1.10-hotfix.1
+ tag: v0.1.10-hotfix.2
pullPolicy: IfNotPresent
## @param frisket.imagePullSecrets Secret names used to authenticate the private image registry (leave empty for public ECR).
imagePullSecrets: []
@@ -3588,7 +3597,7 @@ hue:
## @param hue.image.pullPolicy Image pull policy
image:
repository: public.ecr.aws/mural/hue
- tag: v0.12.38-hotfix.1
+ tag: v0.12.38-hotfix.2
pullPolicy: IfNotPresent
## @param hue.resources.requests.cpu hue controller deployment's cpu request
## @param hue.resources.requests.memory hue controller deployment's memory request
@@ -3693,7 +3702,7 @@ hue:
enabled: true
failurePolicy: Fail
secretsWebhookRegister:
- image: public.ecr.aws/mural/third-party/kubectl:v1.35.5
+ image: us-docker.pkg.dev/palette-images-fips/third-party/spectro-kubectl:1.37.1-spectro-4.9.x
certificate:
mountPath: /etc/k8s-webhook-certs
certManager:
@@ -3767,7 +3776,7 @@ hue:
enabled: true
image:
repository: public.ecr.aws/mural/hue-definitions
- tag: v0.12.38-hotfix.1
+ tag: v0.12.38-hotfix.2
pullPolicy: IfNotPresent
pullSecrets: []
job:
@@ -3794,15 +3803,19 @@ traefik:
# This is a YAML-formatted file.
# Declare variables to be passed into templates
image: # @schema additionalProperties: false
- # -- Traefik image host registry
- registry: us-docker.pkg.dev/palette-images-fips/palette
- # -- Traefik image repository
- repository: traefik
+ # -- Traefik image host registry. Defaults to `docker.io` for Traefik Proxy and `ghcr.io` for Traefik Hub (when `hub.enabled` is true).
+ registry: ghcr.io # @schema type:[string, null]
+ # -- Traefik image repository. Defaults to `traefik` for Traefik Proxy and `traefik/traefik-hub` for Traefik Hub (when `hub.enabled` is true).
+ repository: traefik/traefik-hub # @schema type:[string, null]
# -- defaults to appVersion. It's used for version checking, even prefixed with experimental- or latest-.
- # When a digest is required, `versionOverride` can be used to set the version.
- tag: 3.6.11-fips # @schema type:[string, null]
+ # To pin by digest, prefer `image.digest`. A `<version>@<digest>` combo is also accepted here; in that case the digest is what Kubernetes verifies and the version is informational (and can drift from the underlying image).
+ tag: v3.21.6-fips # @schema type:[string, null]
+ # -- Traefik image digest (e.g. `sha256:abc...`). When set, takes precedence over `tag`. Set `versionOverride` alongside it so the chart's version-checking logic knows the version (it cannot be derived from the digest).
+ digest: # @schema type:[string, null]; pattern:^sha256:[a-f0-9]{64}$
# -- Traefik image pull policy
pullPolicy: IfNotPresent
+ # -- Pull secrets for fetching traefik container image when `deployment.imagePullSecrets` is empty
+ imagePullSecrets: []
# -- Add additional label to all resources
commonLabels: {}
deployment:
@@ -3810,29 +3823,30 @@ traefik:
enabled: true
# -- Deployment or DaemonSet
kind: Deployment
- # -- Number of pods of the deployment (only applies when kind == Deployment)
- replicas: 1
- # -- Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10)
+ # -- Number of pods of the deployment (only applies when kind == Deployment).
+ # Set to null to omit spec.replicas, e.g. when an external controller (HPA/KEDA) owns scaling.
+ replicas: 1 # @schema type:[integer, null];minimum:0
+ # -- (int) Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10)
revisionHistoryLimit: # @schema type:[integer, null];minimum:0
# -- Amount of time (in seconds) before Kubernetes will send the SIGKILL signal if Traefik does not shut down
terminationGracePeriodSeconds: 60
# -- The minimum number of seconds Traefik needs to be up and running before the DaemonSet/Deployment controller considers it available
minReadySeconds: 0
- ## -- Override the liveness/readiness port. This is useful to integrate traefik
- ## with an external Load Balancer that performs healthchecks.
- ## Default: ports.traefik.port
- healthchecksPort: # @schema type:[integer, null];minimum:0
- ## -- Override the liveness/readiness host. Useful for getting ping to respond on non-default entryPoint.
- ## Default: ports.traefik.hostIP if set, otherwise Pod IP
+ # -- (string/int) Override the liveness/readiness port. This is useful to integrate traefik
+ # with an external Load Balancer that performs healthchecks.
+ # @default -- `ports.traefik.port`
+ healthchecksPort: # @schema type:[string, integer, null]; minimum:0
+ # -- Override the liveness/readiness host. Useful for getting ping to respond on non-default entryPoint.
+ # @default -- `ports.traefik.hostIP` if set, otherwise Pod IP
healthchecksHost: ""
- ## -- Override the liveness/readiness scheme. Useful for getting ping to
- ## respond on websecure entryPoint.
+ # -- Override the liveness/readiness scheme. Useful for getting ping to
+ # respond on websecure entryPoint.
healthchecksScheme: # @schema enum:[HTTP, HTTPS, null]; type:[string, null]; default: HTTP
- ## -- Override the readiness path.
- ## Default: /ping
+ # -- Override the readiness path.
+ # @default -- `/ping`
readinessPath: ""
# -- Override the liveness path.
- # Default: /ping
+ # @default -- `/ping`
livenessPath: ""
# -- Additional deployment annotations (e.g. for jaeger-operator sidecar injection)
annotations: {}
@@ -3870,13 +3884,18 @@ traefik:
# mountPath: /data
# -- Use process namespace sharing
shareProcessNamespace: false
+ # -- (bool) Whether to use the host user namespace. Setting this to false enables user namespaces,
+ # which can improve security by isolating the pod's users from the host.
+ # See https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/
+ # @default -- unset (inherits cluster default)
+ hostUsers: # @schema type:[boolean, null]
# -- Custom pod DNS policy. Apply if `hostNetwork: true`
dnsPolicy: ""
# -- Custom pod [DNS config](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#poddnsconfig-v1-core)
dnsConfig: {}
# -- Custom [host aliases](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/)
hostAliases: []
- # -- Pull secret for fetching traefik container image
+ # -- Pull secrets for fetching traefik container image. Takes precedence over `imagePullSecrets` and `global.imagePullSecrets`
imagePullSecrets: []
# -- Pod lifecycle actions
lifecycle: {}
@@ -3891,10 +3910,11 @@ traefik:
# scheme: HTTP
# -- Set a runtimeClassName on pod
runtimeClassName: ""
- # -- Percentage of memory limit to set for GOMEMLIMIT
- # -- set as decimal (0.9 = 90%, 0.95 = 95% etc)
- # -- only takes effect when resources.limits.memory is set
+ # -- Percentage of memory limit to set for GOMEMLIMIT, set as decimal (0.9 = 90%, 0.95 = 95% etc). Only takes effect when resources.limits.memory is set. Set to 0 to disable (e.g. when using VPA or setting it via env)
goMemLimitPercentage: 0.9
+ tmpVolume:
+ # -- [EmptyDir](https://kubernetes.io/docs/concepts/storage/volumes/#emptydir) options for the tmp volume.
+ emptyDir: {}
# -- [Pod Disruption Budget](https://kubernetes.io/docs/reference/kubernetes-api/policy-resources/pod-disruption-budget-v1/)
# @default -- See _values.yaml_
podDisruptionBudget: # @schema additionalProperties: false
@@ -3911,6 +3931,8 @@ traefik:
# -- Can be used to use globally v2 router syntax. Deprecated since v3.4 /!\.
# See https://doc.traefik.io/traefik/v3.0/migration/v2-to-v3/#new-v3-syntax-notable-changes
defaultRuleSyntax: ""
+ # -- Disables the unsafe fallback to default TLS options on conflict, mitigating [GHSA-g55h-rg46-x9c5](https://github.com/traefik/traefik/security/advisories/GHSA-g55h-rg46-x9c5). Requires traefik v3.7.11+.
+ strictTLSOptions: false
# Traefik experimental features
experimental:
# -- Defines whether all plugins must be loaded successfully for Traefik to start
@@ -3982,9 +4004,13 @@ traefik:
api: # @schema additionalProperties: false
# -- Enable the dashboard
dashboard: true
- # -- Enable the insecure API (HTTP)
+ # -- Custom name for the dashboard (v3.7+).
+ dashboardName: "" # @schema type:[string, null]
+ # -- (bool) Disable the advertisement from the dashboard.
+ disableDashboardAd: # @schema type:[boolean, null]
+ # -- (bool) Enable the insecure API (HTTP)
insecure: # @schema type:[boolean, null]
- # -- Enable the debug API
+ # -- (bool) Enable the debug API
debug: # @schema type:[boolean, null]
# -- Configure API basePath
basePath: "" # @schema type:[string, null]; default: "/"
@@ -4067,6 +4093,8 @@ traefik:
startupProbe: {}
# @schema additionalProperties: false
providers:
+ # -- Defines the routing precedence between providers. See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/providers/overview/#routing-precedence) for the default order.
+ precedence: []
# @schema additionalProperties: false
kubernetesCRD:
# -- Load Kubernetes IngressRoute provider
@@ -4077,6 +4105,10 @@ traefik:
allowExternalNameServices: false
# -- Allows to return 503 when there are no endpoints available
allowEmptyServices: true
+ # -- List of namespaces from which IngressRoute, IngressRouteTCP, IngressRouteUDP, and TraefikService are allowed to declare cross-provider references. Requires traefik v3.7.1+.
+ crossProviderNamespaces: []
+ # -- Restricts the namespace where the cluster-wide TLSOption and TLSStore named `default` can be defined. When empty, any namespace is allowed. Requires traefik v3.7.11+.
+ defaultTLSResourcesNamespace: ""
# -- When the parameter is set, only resources containing an annotation with the same value are processed. Otherwise, resources missing the annotation, having an empty value, or the value traefik are processed. It will also set required annotation on Dashboard and Healthcheck IngressRoute when enabled.
ingressClass: ""
# -- See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-ingress/#opt-providers-kubernetesIngress-labelselector)
@@ -4085,6 +4117,8 @@ traefik:
namespaces: []
# -- Defines whether to use Native Kubernetes load-balancing mode by default.
nativeLBByDefault: false
+ # -- Enables collision-safe naming. ⚠️ It can be breaking, see [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-crd/#safenaming). Requires traefik v3.7.11+.
+ safeNaming: false
# @schema additionalProperties: false
kubernetesIngress:
# -- Load Kubernetes Ingress provider
@@ -4093,6 +4127,8 @@ traefik:
allowExternalNameServices: false
# -- Allows to return 503 when there are no endpoints available
allowEmptyServices: true
+ # -- List of namespaces from which Ingresses or Services are allowed to declare Middlewares, TLSOptions, or ServersTransport references. Requires traefik v3.7.1+.
+ crossProviderNamespaces: []
# -- Only for Traefik v3.0, Deprecated since v3.1. See [upstream documentation](https://doc.traefik.io/traefik/v3.0/providers/kubernetes-ingress/#disableingressclasslookup)
disableIngressClassLookup: false
# -- When ingressClass is set, only Ingresses containing an annotation with the same value are processed. Otherwise, Ingresses missing the annotation, having an empty value, or the value traefik are processed.
@@ -4102,12 +4138,18 @@ traefik:
namespaces: []
# IP used for Kubernetes Ingress endpoints
publishedService:
- # -- Enable [publishedService](https://doc.traefik.io/traefik/providers/kubernetes-ingress/#publishedservice),
+ # -- Enable [publishedService](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-ingress/#ingressendpointpublishedservice),
# usually with the Service provided by this Chart. It's possible to use it with an external Service using pathOverride.
enabled: true
# -- Override path of Kubernetes Service used to copy status from. Format: namespace/servicename.
# Default to Service deployed with this Chart.
pathOverride: ""
+ # @schema additionalProperties: false
+ ingressEndpoint:
+ # -- Hostname used for Kubernetes Ingress endpoints
+ hostname: "" # @schema type:[string, null]
+ # -- IP used for Kubernetes Ingress endpoints
+ ip: "" # @schema type:[string, null]
# -- Defines whether to use Native Kubernetes load-balancing mode by default.
nativeLBByDefault: false
# -- Defines whether to make prefix matching strictly comply with the Kubernetes Ingress specification.
@@ -4116,15 +4158,24 @@ traefik:
kubernetesGateway:
# -- Enable Traefik Gateway provider for Gateway API
enabled: false
+ # -- List of namespaces from which Gateway API routes are allowed to declare TraefikService backendRef references. Requires traefik v3.7.1+.
+ crossProviderNamespaces: []
# -- Toggles support for the Experimental Channel resources (Gateway API release channels documentation).
# This option currently enables support for TCPRoute and TLSRoute.
experimentalChannel: false
- # -- Array of namespaces to watch. If left empty, Traefik watches all namespaces. . When using `rbac.namespaced`, it will watch helm release namespace and namespaces listed in this array.
+ # -- Array of namespaces to watch. If left empty, Traefik watches all namespaces. kubernetesGateway provider requires ClusterRole and as a consequence `rbac.namespaced` is not supported.
namespaces: []
# -- A label selector can be defined to filter on specific GatewayClass objects only.
labelSelector: ""
+ # -- Scopes the provider to specific Gateways, as a list of `name` and `namespace` (defaults to the release namespace) (v3.7.14+).
+ # If left empty, Traefik processes all Gateways.
+ gateways: []
# -- Defines whether to use Native Kubernetes load-balancing mode by default.
nativeLBByDefault: false
+ # -- (int) Maximum QPS to the Kubernetes API server. A negative value disables client-side ratelimiting (v3.7.3+). Defaults to 50.
+ qps: # @schema type:[integer, null]
+ # -- (int) Maximum burst of requests to the Kubernetes API server (v3.7.3+). Defaults to 100.
+ burst: # @schema type:[integer, null]
statusAddress:
# -- This IP will get copied to the Gateway status.addresses, and currently only supports one IP value (IPv4 or IPv6).
ip: ""
@@ -4141,11 +4192,11 @@ traefik:
enabled: false
# -- Allows Traefik to automatically watch for file changes
watch: true
- # -- File content (YAML format, go template supported) (see https://doc.traefik.io/traefik/providers/file/)
- content: ""
+ # -- File content as an object (will be YAML-formatted, go template supported) (see https://doc.traefik.io/traefik/reference/install-configuration/providers/others/file/)
+ content: {}
# @schema additionalProperties: false
- kubernetesIngressNginx:
- # -- Enable Kubernetes Ingress NGINX provider (experimental)
+ kubernetesIngressNGINX:
+ # -- Enable Kubernetes Ingress NGINX provider
enabled: false
# -- Ingress Class Controller value this controller satisfies
controllerClass: "k8s.io/ingress-nginx"
@@ -4155,13 +4206,17 @@ traefik:
ingressClassByName: false
# -- Define if Ingress Controller should also watch for Ingresses without an IngressClass or the annotation specified
watchIngressWithoutClass: false
- # -- Namespace the controller watches for updates to Kubernetes objects. Mutually exclusive with watchNamespaceSelector.
+ # -- Single namespace the controller watches for updates to Kubernetes objects. Mutually exclusive with watchNamespaceSelector.
watchNamespace: ""
# -- Select namespaces the controller watches for updates to Kubernetes objects. Mutually exclusive with watchNamespace.
+ # It requires a ClusterRole to list and watch namespaces, and is therefore incompatible with `rbac.namespaced`.
watchNamespaceSelector: ""
publishService:
- # -- Service fronting the Ingress controller. Takes the form 'namespace/name'
+ # -- Enable publishService. Service fronting the Ingress controller, used to set the load-balancer status of Ingress objects.
+ # Usually the Service provided by this Chart. It's possible to use it with an external Service using pathOverride.
enabled: false
+ # -- Override path of Kubernetes Service used to copy status from. Format: namespace/servicename.
+ # Default to Service deployed with this Chart.
pathOverride: ""
# -- Customized address (or addresses, separated by comma) to set as the load-balancer status of Ingress objects this controller satisfies
publishStatusAddress: ""
@@ -4177,6 +4232,65 @@ traefik:
endpoint: ""
# -- Kubernetes bearer token (not needed for in-cluster client). It accepts either a token value or a file path to the token
token: ""
+ # -- (bool) Defines whether to enable request buffering (default: false)
+ proxyRequestBuffering: null # @schema type:[boolean, null]
+ # -- (int) Default buffer size for reading client request body in bytes (default: 16384)
+ clientBodyBufferSize: # @schema type:[integer, null]
+ # -- (int) Default maximum size of a client request body in bytes (default: 1048576)
+ proxyBodySize: # @schema type:[integer, null]
+ # -- (bool) Defines whether to enable response buffering (default: false)
+ proxyBuffering: null # @schema type:[boolean, null]
+ # -- (int) Default buffer size for reading the response body in bytes (default: 8192)
+ proxyBufferSize: # @schema type:[integer, null]
+ # -- (int) Default number of buffers for reading a response (default: 4)
+ proxyBuffersNumber: # @schema type:[integer, null]
+ # -- (int) Amount of time to wait until a connection to a server can be established. Unitless, in seconds (default: 60)
+ proxyConnectTimeout: # @schema type:[integer, null]
+ # -- (int) Amount of time between two successive read operations. Unitless, in seconds (default: 60)
+ proxyReadTimeout: # @schema type:[integer, null]
+ # -- (int) Amount of time between two successive write operations. Unitless, in seconds (default: 60)
+ proxySendTimeout: # @schema type:[integer, null]
+ # -- Defines in which cases a request should be retried (default: "error timeout")
+ proxyNextUpstream: ""
+ # -- (int) Limits the number of possible tries if the backend server does not reply (default: 3)
+ proxyNextUpstreamTries: # @schema type:[integer, null]
+ # -- (int) Limits the total elapsed time to retry the request. Unitless, in seconds (default: 0)
+ proxyNextUpstreamTimeout: # @schema type:[integer, null]
+ # -- Defines which HTTP status codes should result in calling the default backend to return an error page
+ customHTTPErrors: []
+ # -- (int) Defines the idle timeout for keep-alive connections to upstream servers. Unitless, in seconds (default: 60)
+ upstreamKeepaliveTimeout: # @schema type:[integer, null]
+ # -- (bool) Allow Ingress to reference resources (e.g. ConfigMaps, Secrets) in different namespaces (default: false)
+ allowCrossNamespaceResources: null # @schema type:[boolean, null]
+ # -- List of allowed response headers inside the custom headers annotations
+ globalAllowedResponseHeaders: []
+ # -- URL to the service that provides authentication for all the locations. Per ingress auth-url annotation has precedence over this option.
+ globalAuthUrl: ""
+ # -- When set, the strategy is applied to every generated IPAllowList middleware.
+ # @default -- See below
+ ipAllowListStrategy:
+ # -- Number of trusted proxy hops to skip when extracting the client IP from the X-Forwarded-For header. 0 disables depth-based extraction. (default: 0)
+ depth: 0
+ # -- List of IPs to exclude when scanning the X-Forwarded-For header to find the client IP.
+ excludedIPS: []
+ # -- IPv6 subnet size used to group IPv6 addresses when checking the allow list. 0 disables subnet grouping.
+ ipv6Subnet: 0
+ # -- (bool) Enables parsing and adding -snippet annotations/directives (default: false)
+ allowSnippetAnnotations: null # @schema type:[boolean, null]
+ # -- (bool) Defines whether to reject the entire ingress when any path contains regex characters and pathType is Prefix or Exact (default: true)
+ strictValidatePathType: null # @schema type:[boolean, null]
+ # -- Defines the EntryPoint to use for HTTP requests
+ httpEntryPoint: "web"
+ # -- Defines the EntryPoint to use for HTTPS requests
+ httpsEntryPoint: "websecure"
+ # @schema additionalProperties: false
+ modsec:
+ # -- Enable ModSec engine. Requires Traefik Hub >= v3.20.0-ea.8.
+ enabled: false
+ # -- Enable OWASP Core Rules.
+ owaspCoreRules: false
+ # -- Custom ModSec rules snippet.
+ snippet: ""
# @schema additionalProperties: false
knative:
# -- Enable Knative provider
@@ -4206,130 +4320,135 @@ traefik:
# - name: traefik-logs
# mountPath: /var/log/traefik
- logs:
- general:
- # -- Set [logs format](https://doc.traefik.io/traefik/observability/logs/#format)
- format: # @schema enum:["common", "json", null]; type:[string, null]; default: "common"
- # By default, the level is set to INFO.
- # -- Alternative logging levels are TRACE, DEBUG, INFO, WARN, ERROR, FATAL, and PANIC.
- level: "INFO" # @schema enum:[TRACE,DEBUG,INFO,WARN,ERROR,FATAL,PANIC]; default: "INFO"
- # -- To write the logs into a log file, use the filePath option.
- filePath: ""
- # -- When set to true and format is common, it disables the colorized output.
- noColor: false
- otlp:
- # -- Set to true in order to enable OpenTelemetry on logs. Note that experimental.otlpLogs needs to be enabled.
+ # -- See [logs reference](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/)
+ log:
+ # -- Set [logs format](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/#opt-log-format)
+ format: # @schema enum:["common", "json", null]; type:[string, null]; default: "common"
+ # By default, the level is set to INFO.
+ # -- Alternative logging levels are TRACE, DEBUG, INFO, WARN, ERROR, FATAL, and PANIC.
+ level: "INFO" # @schema enum:[TRACE,DEBUG,INFO,WARN,ERROR,FATAL,PANIC]; default: "INFO"
+ # -- To write the logs into a log file, use the filePath option.
+ filePath: ""
+ # -- When set to true and format is common, it disables the colorized output.
+ noColor: false
+ otlp:
+ # -- Set to true in order to enable OpenTelemetry on logs. Note that experimental.otlpLogs needs to be enabled.
+ enabled: false
+ # -- Service name used in OTLP backend. Default: traefik.
+ serviceName: # @schema type:[string, null]
+ http:
+ # -- Set to true in order to send logs to the OpenTelemetry Collector using HTTP.
enabled: false
- # -- Service name used in OTLP backend. Default: traefik.
- serviceName: # @schema type:[string, null]
- http:
- # -- Set to true in order to send logs to the OpenTelemetry Collector using HTTP.
- enabled: false
- # -- Format: <scheme>://<host>:<port><path>. Default: https://localhost:4318/v1/logs
- endpoint: ""
- # -- Additional headers sent with logs by the reporter to the OpenTelemetry Collector.
- headers: {}
- ## Defines the TLS configuration used by the reporter to send logs to the OpenTelemetry Collector.
- tls:
- # -- The path to the certificate authority, it defaults to the system bundle.
- ca: ""
- # -- The path to the public certificate. When using this option, setting the key option is required.
- cert: ""
- # -- The path to the private key. When using this option, setting the cert option is required.
- key: ""
- # -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
- insecureSkipVerify: # @schema type:[boolean, null]
- grpc:
- # -- Set to true in order to send logs to the OpenTelemetry Collector using gRPC
- enabled: false
- # -- Format: <host>:<port>. Default: "localhost:4317"
- endpoint: ""
- # -- Allows reporter to send logs to the OpenTelemetry Collector without using a secured protocol.
- insecure: false
- ## Defines the TLS configuration used by the reporter to send logs to the OpenTelemetry Collector.
- tls:
- # -- The path to the certificate authority, it defaults to the system bundle.
- ca: ""
- # -- The path to the public certificate. When using this option, setting the key option is required.
- cert: ""
- # -- The path to the private key. When using this option, setting the cert option is required.
- key: ""
- # -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
- insecureSkipVerify: # @schema type:[boolean, null]
- # -- Defines additional resource attributes to be sent to the collector.
- resourceAttributes: {}
- access:
- # -- To enable access logs
+ # -- Format: <scheme>://<host>:<port><path>. Default: https://localhost:4318/v1/logs
+ endpoint: ""
+ # -- Additional headers sent with logs by the reporter to the OpenTelemetry Collector.
+ headers: {}
+ ## Defines the TLS configuration used by the reporter to send logs to the OpenTelemetry Collector.
+ tls:
+ # -- The path to the certificate authority, it defaults to the system bundle.
+ ca: ""
+ # -- The path to the public certificate. When using this option, setting the key option is required.
+ cert: ""
+ # -- The path to the private key. When using this option, setting the cert option is required.
+ key: ""
+ # -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
+ insecureSkipVerify: # @schema type:[boolean, null]
+ grpc:
+ # -- Set to true in order to send logs to the OpenTelemetry Collector using gRPC
+ enabled: false
+ # -- Format: <host>:<port>. Default: "localhost:4317"
+ endpoint: ""
+ # -- Allows reporter to send logs to the OpenTelemetry Collector without using a secured protocol.
+ insecure: false
+ ## Defines the TLS configuration used by the reporter to send logs to the OpenTelemetry Collector.
+ tls:
+ # -- The path to the certificate authority, it defaults to the system bundle.
+ ca: ""
+ # -- The path to the public certificate. When using this option, setting the key option is required.
+ cert: ""
+ # -- The path to the private key. When using this option, setting the cert option is required.
+ key: ""
+ # -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
+ insecureSkipVerify: # @schema type:[boolean, null]
+ # -- Defines additional resource attributes to be sent to the collector.
+ resourceAttributes: {}
+ # -- See [access logs reference](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/)
+ accessLog:
+ # -- To enable access logs
+ enabled: false
+ # -- Set [access log format](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/#opt-accesslog-format)
+ format: # @schema enum:["common", "genericCLF", "json", null]; type:[string, null]; default: "common"
+ # filePath: "/var/log/traefik/access.log
+ # -- (int) Set [bufferingSize](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/#opt-accesslog-bufferingSize)
+ bufferingSize: # @schema type:[integer, null]
+ # -- Set [timezone](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/#time-zones)
+ timezone: ""
+ # -- Set [filtering](https://doc.traefik.io/traefik/observe/logs-and-access-logs/#access-log-filters)
+ # @default -- See below
+ filters: # @schema additionalProperties: false
+ # -- Set statusCodes, to limit the access logs to requests with a status codes in the specified range
+ statusCodes: ""
+ # -- Set retryAttempts, to keep the access logs when at least one retry has happened
+ retryAttempts: false
+ # -- Set minDuration, to keep access logs when requests take longer than the specified duration
+ minDuration: ""
+ # -- Enables accessLogs for internal resources. Default: false.
+ addInternals: false
+ # -- Enables access log output alongside OTLP (v3.7+).
+ dualOutput: false
+ fields:
+ # -- Set default mode for fields.names
+ defaultMode: keep # @schema enum:[keep, drop, redact]; default: keep
+ # -- Names of the fields to limit.
+ names: {}
+ headers:
+ # -- [Limit logged fields or headers](https://doc.traefik.io/traefik/observe/logs-and-access-logs/#log-fields-customization)
+ defaultMode: drop # @schema enum:[keep, drop, redact]; default: drop
+ names: {}
+ queryParameters:
+ # -- Keep or drop all query parameters in the RequestPath access log field (v3.7.3+).
+ defaultMode: # @schema enum:[keep, drop, null]; type:[string, null]; default: null
+ otlp:
+ # -- Set to true in order to enable OpenTelemetry on access logs. Note that experimental.otlpLogs needs to be enabled.
enabled: false
- # -- Set [access log format](https://doc.traefik.io/traefik/observability/access-logs/#format)
- format: # @schema enum:["common", "genericCLF", "json", null]; type:[string, null]; default: "common"
- # filePath: "/var/log/traefik/access.log
- # -- Set [bufferingSize](https://doc.traefik.io/traefik/observability/access-logs/#bufferingsize)
- bufferingSize: # @schema type:[integer, null]
- # -- Set [timezone](https://doc.traefik.io/traefik/observability/access-logs/#time-zones)
- timezone: ""
- # -- Set [filtering](https://docs.traefik.io/observability/access-logs/#filtering)
- # @default -- See below
- filters: # @schema additionalProperties: false
- # -- Set statusCodes, to limit the access logs to requests with a status codes in the specified range
- statuscodes: ""
- # -- Set retryAttempts, to keep the access logs when at least one retry has happened
- retryattempts: false
- # -- Set minDuration, to keep access logs when requests take longer than the specified duration
- minduration: ""
- # -- Enables accessLogs for internal resources. Default: false.
- addInternals: false
- fields:
- general:
- # -- Set default mode for fields.names
- defaultmode: keep # @schema enum:[keep, drop, redact]; default: keep
- # -- Names of the fields to limit.
- names: {}
- headers:
- # -- [Limit logged fields or headers](https://doc.traefik.io/traefik/observability/access-logs/#limiting-the-fieldsincluding-headers)
- defaultmode: drop # @schema enum:[keep, drop, redact]; default: drop
- names: {}
- otlp:
- # -- Set to true in order to enable OpenTelemetry on access logs. Note that experimental.otlpLogs needs to be enabled.
+ # -- Service name used in OTLP backend. Default: traefik.
+ serviceName: # @schema type:[string, null]
+ http:
+ # -- Set to true in order to send access logs to the OpenTelemetry Collector using HTTP.
enabled: false
- # -- Service name used in OTLP backend. Default: traefik.
- serviceName: # @schema type:[string, null]
- http:
- # -- Set to true in order to send access logs to the OpenTelemetry Collector using HTTP.
- enabled: false
- # -- Format: <scheme>://<host>:<port><path>. Default: https://localhost:4318/v1/logs
- endpoint: ""
- # -- Additional headers sent with access logs by the reporter to the OpenTelemetry Collector.
- headers: {}
- ## Defines the TLS configuration used by the reporter to send access logs to the OpenTelemetry Collector.
- tls:
- # -- The path to the certificate authority, it defaults to the system bundle.
- ca: ""
- # -- The path to the public certificate. When using this option, setting the key option is required.
- cert: ""
- # -- The path to the private key. When using this option, setting the cert option is required.
- key: ""
- # -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
- insecureSkipVerify: # @schema type:[boolean, null]
- grpc:
- # -- Set to true in order to send access logs to the OpenTelemetry Collector using gRPC
- enabled: false
- # -- Format: <host>:<port>. Default: "localhost:4317"
- endpoint: ""
- # -- Allows reporter to send access logs to the OpenTelemetry Collector without using a secured protocol.
- insecure: false
- ## Defines the TLS configuration used by the reporter to send access logs to the OpenTelemetry Collector.
- tls:
- # -- The path to the certificate authority, it defaults to the system bundle.
- ca: ""
- # -- The path to the public certificate. When using this option, setting the key option is required.
- cert: ""
- # -- The path to the private key. When using this option, setting the cert option is required.
- key: ""
- # -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
- insecureSkipVerify: # @schema type:[boolean, null]
- # -- Defines additional resource attributes to be sent to the collector.
- resourceAttributes: {}
+ # -- Format: <scheme>://<host>:<port><path>. Default: https://localhost:4318/v1/logs
+ endpoint: ""
+ # -- Additional headers sent with access logs by the reporter to the OpenTelemetry Collector.
+ headers: {}
+ ## Defines the TLS configuration used by the reporter to send access logs to the OpenTelemetry Collector.
+ tls:
+ # -- The path to the certificate authority, it defaults to the system bundle.
+ ca: ""
+ # -- The path to the public certificate. When using this option, setting the key option is required.
+ cert: ""
+ # -- The path to the private key. When using this option, setting the cert option is required.
+ key: ""
+ # -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
+ insecureSkipVerify: # @schema type:[boolean, null]
+ grpc:
+ # -- Set to true in order to send access logs to the OpenTelemetry Collector using gRPC
+ enabled: false
+ # -- Format: <host>:<port>. Default: "localhost:4317"
+ endpoint: ""
+ # -- Allows reporter to send access logs to the OpenTelemetry Collector without using a secured protocol.
+ insecure: false
+ ## Defines the TLS configuration used by the reporter to send access logs to the OpenTelemetry Collector.
+ tls:
+ # -- The path to the certificate authority, it defaults to the system bundle.
+ ca: ""
+ # -- The path to the public certificate. When using this option, setting the key option is required.
+ cert: ""
+ # -- The path to the private key. When using this option, setting the cert option is required.
+ key: ""
+ # -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
+ insecureSkipVerify: # @schema type:[boolean, null]
+ # -- Defines additional resource attributes to be sent to the collector.
+ resourceAttributes: {}
metrics:
# -- Enable metrics for internal resources. Default: false
addInternals: false
@@ -4338,11 +4457,11 @@ traefik:
prometheus:
# -- Entry point used to expose metrics.
entryPoint: metrics
- # -- Enable metrics on entry points. Default: true
+ # -- (bool) Enable metrics on entry points. Default: true
addEntryPointsLabels: # @schema type:[boolean, null]
- # -- Enable metrics on routers. Default: false
+ # -- (bool) Enable metrics on routers. Default: false
addRoutersLabels: # @schema type:[boolean, null]
- # -- Enable metrics on services. Default: true
+ # -- (bool) Enable metrics on services. Default: true
addServicesLabels: # @schema type:[boolean, null]
# -- Buckets for latency metrics. Default="0.1,0.3,1.2,5.0"
buckets: ""
@@ -4356,7 +4475,7 @@ traefik:
enabled: false
labels: {}
annotations: {}
- # -- When set to true, it won't check if Prometheus Operator CRDs are deployed
+ # -- (bool) When set to true, it won't check if Prometheus Operator CRDs are deployed
disableAPICheck: # @schema type:[boolean, null]
serviceMonitor:
# -- Enable optional CR for Prometheus Operator. See EXAMPLES.md for more details.
@@ -4430,11 +4549,11 @@ traefik:
otlp:
# -- Set to true in order to enable the OpenTelemetry metrics
enabled: false
- # -- Enable metrics on entry points. Default: true
+ # -- (bool) Enable metrics on entry points. Default: true
addEntryPointsLabels: # @schema type:[boolean, null]
- # -- Enable metrics on routers. Default: false
+ # -- (bool) Enable metrics on routers. Default: false
addRoutersLabels: # @schema type:[boolean, null]
- # -- Enable metrics on services. Default: true
+ # -- (bool) Enable metrics on services. Default: true
addServicesLabels: # @schema type:[boolean, null]
# -- Explicit boundaries for Histogram data points. Default: [.005, .01, .025, .05, .1, .25, .5, 1, 2.5, 5, 10]
explicitBoundaries: []
@@ -4457,7 +4576,7 @@ traefik:
cert: ""
# -- The path to the private key. When using this option, setting the cert option is required.
key: ""
- # -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
+ # -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
insecureSkipVerify: # @schema type:[boolean, null]
grpc:
# -- Set to true in order to send metrics to the OpenTelemetry Collector using gRPC
@@ -4474,18 +4593,18 @@ traefik:
cert: ""
# -- The path to the private key. When using this option, setting the cert option is required.
key: ""
- # -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
+ # -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
insecureSkipVerify: # @schema type:[boolean, null]
# -- Defines additional resource attributes to be sent to the collector.
resourceAttributes: {}
ocsp:
# -- Enable OCSP stapling support.
- # See https://doc.traefik.io/traefik/https/ocsp/#overview
+ # See https://doc.traefik.io/traefik/reference/install-configuration/tls/ocsp/
enabled: false
# -- Defines the OCSP responder URLs to use instead of the one provided by the certificate.
responderOverrides: {}
## Tracing
- # -- https://doc.traefik.io/traefik/observability/tracing/overview/
+ # -- https://doc.traefik.io/traefik/reference/install-configuration/observability/tracing/
# @default -- See _values.yaml_
tracing: # @schema additionalProperties: false
# -- Enables tracing for internal resources. Default: false.
@@ -4500,10 +4619,10 @@ traefik:
capturedResponseHeaders: []
# -- By default, all query parameters are redacted. Defines the list of query parameters to not redact.
safeQueryParams: []
- # -- The proportion of requests to trace, specified between 0.0 and 1.0. Default: 1.0.
+ # -- (float) The proportion of requests to trace, specified between 0.0 and 1.0. Default: 1.0.
sampleRate: # @schema type:[number, null]; minimum:0; maximum:1
otlp:
- # -- See https://doc.traefik.io/traefik/v3.0/observability/tracing/opentelemetry/
+ # -- See https://doc.traefik.io/traefik/reference/install-configuration/observability/tracing/#configuration-options
enabled: false
http:
# -- Set to true in order to send metrics to the OpenTelemetry Collector using HTTP.
@@ -4520,7 +4639,7 @@ traefik:
cert: ""
# -- The path to the private key. When using this option, setting the cert option is required.
key: ""
- # -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
+ # -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
insecureSkipVerify: # @schema type:[boolean, null]
grpc:
# -- Set to true in order to send metrics to the OpenTelemetry Collector using gRPC
@@ -4537,13 +4656,17 @@ traefik:
cert: ""
# -- The path to the private key. When using this option, setting the cert option is required.
key: ""
- # -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
+ # -- (bool) When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
insecureSkipVerify: # @schema type:[boolean, null]
global:
checkNewVersion: true
# -- Please take time to consider whether or not you wish to share anonymous data with us
# See https://doc.traefik.io/traefik/contributing/data-collection/
sendAnonymousUsage: false
+ # -- Disable appending RemoteAddr to X-Forwarded-For header globally (v3.7+).
+ notAppendXForwardedFor: false
+ # -- Pull secrets for fetching traefik container image when `deployment.imagePullSecrets` and `imagePullSecrets` are empty
+ imagePullSecrets: []
# -- Required for Azure Marketplace integration.
# See https://learn.microsoft.com/en-us/partner-center/marketplace-offers/azure-container-technical-assets-kubernetes?tabs=linux,linux2#update-the-helm-chart
# @default -- See _values.yaml_
@@ -4574,7 +4697,7 @@ traefik:
# @schema additionalProperties: false
traefik:
port: 8080
- # -- Use hostPort if set.
+ # -- (int) Use hostPort if set.
hostPort: # @schema type:[integer, null]; minimum:0
# -- Use hostIP if set. If not set, Kubernetes will default to 0.0.0.0, which
# means it's listening on all your interfaces and all your IPs. You may want
@@ -4594,16 +4717,16 @@ traefik:
# -- The port protocol (TCP/UDP)
protocol: TCP
observability: # @schema additionalProperties: false
- # -- Defines whether a router attached to this EntryPoint produces metrics by default.
+ # -- (bool) Defines whether a router attached to this EntryPoint produces metrics by default.
metrics: # @schema type:[boolean, null]; default: true
- # -- Defines whether a router attached to this EntryPoint produces access-logs by default.
+ # -- (bool) Defines whether a router attached to this EntryPoint produces access-logs by default.
accessLogs: # @schema type:[boolean, null]; default: true
- # -- Defines whether a router attached to this EntryPoint produces traces by default.
+ # -- (bool) Defines whether a router attached to this EntryPoint produces traces by default.
tracing: # @schema type:[boolean, null]; default: true
# -- Defines the tracing verbosity level for routers attached to this EntryPoint.
traceVerbosity: # @schema enum:[minimal, detailed, null]; type:[string, null]; default: minimal
web:
- ## -- Enable this entrypoint as a default entrypoint. When a service doesn't explicitly set an entrypoint it will only use this entrypoint.
+ # -- (bool) Enable this entrypoint as a default entrypoint. When a service doesn't explicitly set an entrypoint it will only use this entrypoint.
asDefault: # @schema type: [boolean, null]; default: null
port: 8000
# hostPort: 8000
@@ -4611,12 +4734,14 @@ traefik:
expose:
default: true
exposedPort: 80
- ## -- Different target traefik port on the cluster, useful for IP type LB
+ # -- (string/int) Different target traefik port on the cluster, useful for IP type LB
targetPort: # @schema type:[string, integer, null]; minimum:0
- # The port protocol (TCP/UDP)
+ # -- The port protocol (TCP/UDP)
protocol: TCP
- # -- See [upstream documentation](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport)
+ # -- (int) See [upstream documentation](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport)
nodePort: # @schema type:[integer, null]; minimum:0
+ # -- See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#allowacmebypass)
+ allowACMEByPass: false
http:
redirections:
# -- Port Redirections
@@ -4628,12 +4753,13 @@ traefik:
# -- Trust forwarded headers information (X-Forwarded-*).
trustedIPs: []
insecure: true
+ # -- Disable appending RemoteAddr to X-Forwarded-For header (v3.7+).
+ notAppendXForwardedFor: false
proxyProtocol:
# -- Enable the Proxy Protocol header parsing for the entry point
trustedIPs: []
insecure: false
- # -- Set transport settings for the entrypoint; see also
- # https://doc.traefik.io/traefik/routing/entrypoints/#transport
+ # -- Set transport settings for the entrypoint
# @default -- nil
transport:
respondingTimeouts:
@@ -4645,12 +4771,15 @@ traefik:
graceTimeOut: # @schema type:[string, integer, null]
keepAliveMaxRequests: # @schema type:[integer, null]; minimum:0
keepAliveMaxTime: # @schema type:[string, integer, null]
+ # -- (bool) Enable this port as an uplink for multi cluster.
+ # ⚠️ This feature is experimental and requires Traefik Hub with a specific subscription.
+ uplink: # @schema type: [boolean, null]; default: null
observability: # @schema additionalProperties: false
- # -- Enables metrics for this entryPoint.
+ # -- (bool) Enables metrics for this entryPoint.
metrics: # @schema type:[boolean, null]; default: true
- # -- Enables access-logs for this entryPoint.
+ # -- (bool) Enables access-logs for this entryPoint.
accessLogs: # @schema type:[boolean, null]; default: true
- # -- Enables tracing for this entryPoint.
+ # -- (bool) Enables tracing for this entryPoint.
tracing: # @schema type:[boolean, null]; default: true
# -- Defines the tracing verbosity level for this entryPoint.
traceVerbosity: # @schema enum:[minimal, detailed, null]; type:[string, null]; default: minimal
@@ -4658,20 +4787,22 @@ traefik:
## -- Enable this entrypoint as a default entrypoint. When a service doesn't explicitly set an entrypoint it will only use this entrypoint.
# asDefault: true
port: 8443
+ # -- (int) Use hostPort if set.
hostPort: # @schema type:[integer, null]; minimum:0
+ # -- (int) Use containerPort if set.
containerPort: # @schema type:[integer, null]; minimum:0
expose:
default: true
exposedPort: 443
- ## -- Different target traefik port on the cluster, useful for IP type LB
+ # -- (string/int) Different target traefik port on the cluster, useful for IP type LB
targetPort: web # @schema type:[string, integer, null]; minimum:0
- ## -- The port protocol (TCP/UDP)
+ # -- The port protocol (TCP/UDP)
protocol: TCP
- # -- See [upstream documentation](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport)
+ # -- (int) See [upstream documentation](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport)
nodePort: # @schema type:[integer, null]; minimum:0
# -- See [upstream documentation](https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol)
appProtocol: # @schema type:[string, null]
- # -- See [upstream documentation](https://doc.traefik.io/traefik/routing/entrypoints/#allowacmebypass)
+ # -- See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#allowacmebypass)
allowACMEByPass: false
http:
# -- See [upstream documentation](https://doc.traefik.io/traefik/security/request-path/#encoded-character-filtering)
@@ -4684,12 +4815,19 @@ traefik:
allowEncodedPercent: # @schema type:[boolean, null]
allowEncodedQuestionMark: # @schema type:[boolean, null]
allowEncodedHash: # @schema type:[boolean, null]
- # -- Maximum size of request headers in bytes. Default: 1048576 (1 MB)
+ # -- (int) Maximum size of request headers in bytes. Default: 1048576 (1 MB)
maxHeaderBytes: # @schema type:[integer, null]; minimum:0
# -- See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#httpmiddlewares)
middlewares: [] # @schema type: [array, null]
- # -- See [upstream documentation](https://doc.traefik.io/traefik/security/request-path/#path-sanitization)
+ # -- (bool) See [upstream documentation](https://doc.traefik.io/traefik/security/request-path/#path-sanitization)
sanitizePath: # @schema type:[boolean, null]
+ # -- Defines how request headers with non-alphanumeric characters in their names are handled (v3.7.12+).
+ # See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#aliasheadersstrategy)
+ aliasHeadersStrategy: # @schema enum:[keep, delete, reject, null]; type:[string, null]
+ # -- Defines how request headers with underscores in their names are handled (v3.7.6-v3.7.11).
+ # Replaced by the aliasHeadersStrategy option for Traefik v3.7.12+.
+ # See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#underscoreheadersstrategy)
+ underscoreHeadersStrategy: # @schema deprecated; enum:[keep, delete, reject, null]; type:[string, null]
tls:
# -- See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-http-tls)
# @default -- true
@@ -4698,23 +4836,23 @@ traefik:
certResolver: ""
domains: []
http3:
- ## -- Enable HTTP/3 on the entrypoint
- ## Enabling it will also enable http3 experimental feature
- ## https://doc.traefik.io/traefik/routing/entrypoints/#http3
- ## There are known limitations when trying to listen on same ports for
- ## TCP & UDP (Http3). There is a workaround in this chart using dual Service.
- ## https://github.com/kubernetes/kubernetes/issues/47249#issuecomment-587960741
+ # -- Enable HTTP/3 on the entrypoint. It also enables the http3 experimental feature.
+ # See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-http3).
+ # There are known limitations when trying to listen on same ports for TCP & UDP ([kubernetes#47249](https://github.com/kubernetes/kubernetes/issues/47249#issuecomment-587960741)): this chart works around it using a dual Service.
enabled: false
+ # -- (int) Defines the UDP port to advertise as the HTTP/3 authority.
advertisedPort: # @schema type:[integer, null]; minimum:0
forwardedHeaders:
# -- Trust forwarded headers information (X-Forwarded-*).
trustedIPs: []
insecure: true
+ # -- Disable appending RemoteAddr to X-Forwarded-For header (v3.7+).
+ notAppendXForwardedFor: false
proxyProtocol:
# -- Enable the Proxy Protocol header parsing for the entry point
trustedIPs: []
insecure: false
- # -- See [upstream documentation](https://doc.traefik.io/traefik/routing/entrypoints/#transport)
+ # -- Set transport settings for the entrypoint
# @default -- nil
transport:
respondingTimeouts:
@@ -4727,11 +4865,11 @@ traefik:
keepAliveMaxRequests: # @schema type:[integer, null]; minimum:0
keepAliveMaxTime: # @schema type:[string, integer, null]
observability: # @schema additionalProperties: false
- # -- Enables metrics for this entryPoint.
+ # -- (bool) Enables metrics for this entryPoint.
metrics: # @schema type:[boolean, null]; default: true
- # -- Enables access-logs for this entryPoint.
+ # -- (bool) Enables access-logs for this entryPoint.
accessLogs: # @schema type:[boolean, null]; default: true
- # -- Enables tracing for this entryPoint.
+ # -- (bool) Enables tracing for this entryPoint.
tracing: # @schema type:[boolean, null]; default: true
# -- Defines the tracing verbosity level for this entryPoint.
traceVerbosity: # @schema enum:[minimal, detailed, null]; type:[string, null]; default: minimal
@@ -4749,26 +4887,28 @@ traefik:
# -- The port protocol (TCP/UDP)
protocol: TCP
observability: # @schema additionalProperties: false
- # -- Enables metrics for this entryPoint.
+ # -- (bool) Enables metrics for this entryPoint.
metrics: # @schema type:[boolean, null]; default: true
- # -- Enables access-logs for this entryPoint.
+ # -- (bool) Enables access-logs for this entryPoint.
accessLogs: # @schema type:[boolean, null]; default: true
- # -- Enables tracing for this entryPoint.
+ # -- (bool) Enables tracing for this entryPoint.
tracing: # @schema type:[boolean, null]; default: true
# -- Defines the tracing verbosity level for this entryPoint.
traceVerbosity: # @schema enum:[minimal, detailed, null]; type:[string, null]; default: minimal
- # -- TLS Options are created as [TLSOption CRDs](https://doc.traefik.io/traefik/https/tls/#tls-options)
+ # -- TLS Options are created as [TLSOption CRDs](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/crd/tls/tlsoption/)
# When using `labelSelector`, you'll need to set labels on tlsOption accordingly.
# See EXAMPLE.md for details.
tlsOptions: {}
- # -- TLS Store are created as [TLSStore CRDs](https://doc.traefik.io/traefik/https/tls/#default-certificate). This is useful if you want to set a default certificate. See EXAMPLE.md for details.
+ # -- TLS Store are created as [TLSStore CRDs](https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/crd/tls/tlsstore/).
+ # This is useful if you want to set a default certificate. See EXAMPLE.md for details.
tlsStore: {}
service:
enabled: true
- ## -- Single service is using `MixedProtocolLBService` feature gate.
- ## -- When set to false, it will create two Service, one for TCP and one for UDP.
+ # -- Override the default Service name. Useful for adopting an existing Service (e.g., during migration from another ingress controller).
+ nameOverride: "" # @schema type:[string, null]
+ # -- Single service exposing both TCP and UDP ports.
+ # When set to false, it will create two Service, one for TCP and one for UDP.
single: true
- type: LoadBalancer
# -- Additional annotations applied to both TCP and UDP services (e.g. for cloud provider specific config)
annotations: {}
# -- Additional annotations for TCP service only
@@ -4777,45 +4917,20 @@ traefik:
annotationsUDP: {}
# -- Additional service labels (e.g. for filtering Service by custom labels)
labels: {}
- # -- Additional entries here will be added to the service spec.
- # -- Cannot contain type, selector or ports entries.
- spec: {}
- # externalTrafficPolicy: Cluster
- # loadBalancerIP: "1.2.3.4"
- # clusterIP: "2.3.4.5"
- loadBalancerSourceRanges: []
- # - 192.168.0.1/32
- # - 172.16.0.0/16
- ## -- Class of the load balancer implementation
- # loadBalancerClass: service.k8s.aws/nlb
- externalIPs: []
- # - 1.2.3.4
- ## One of SingleStack, PreferDualStack, or RequireDualStack.
- # ipFamilyPolicy: SingleStack
- ## List of IP families (e.g. IPv4 and/or IPv6).
- ## ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
- # ipFamilies:
- # - IPv4
- # - IPv6
- ##
+ # -- Additional entries here will be added to the Service [spec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#servicespec-v1-core).
+ # Cannot contain selector or ports entries.
+ spec:
+ type: LoadBalancer
+ # -- Can be used to create multiple Service.
+ # See EXAMPLES.md for more details.
additionalServices: {}
- ## -- An additional and optional internal Service.
- ## Same parameters as external Service
- # internal:
- # type: ClusterIP
- # # labels: {}
- # # annotations: {}
- # # spec: {}
- # # loadBalancerSourceRanges: []
- # # externalIPs: []
- # # ipFamilies: [ "IPv4","IPv6" ]
autoscaling: # @schema additionalProperties: false
# -- Create HorizontalPodAutoscaler object.
# See EXAMPLES.md for more details.
enabled: false
- # -- minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod.
+ # -- (int) minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod.
minReplicas: # @schema type:[integer, null]; minimum:0
- # -- maxReplicas is the upper limit for the number of pods that can be set by the autoscaler; cannot be smaller than MinReplicas.
+ # -- (int) maxReplicas is the upper limit for the number of pods that can be set by the autoscaler; cannot be smaller than MinReplicas.
maxReplicas: # @schema type:[integer, null]; minimum:0
# -- metrics contains the specifications for which to use to calculate the desired replica count (the maximum replica count across all metrics will be used).
metrics: []
@@ -4842,8 +4957,10 @@ traefik:
annotations: {}
# -- Only mount a subpath of the Volume into the pod
subPath: ""
+ # -- [EmptyDir](https://kubernetes.io/docs/concepts/storage/volumes/#emptydir) options when persistence is disabled
+ emptyDir: {}
# -- Certificates resolvers configuration.
- # Ref: https://doc.traefik.io/traefik/https/acme/#certificate-resolvers
+ # Ref: https://doc.traefik.io/traefik/reference/install-configuration/tls/certificate-resolvers/acme/
# See EXAMPLES.md for more details.
certificatesResolvers: {}
# -- If hostNetwork is true, runs traefik in the host network namespace
@@ -4854,19 +4971,18 @@ traefik:
rbac: # @schema additionalProperties: false
# -- Whether Role Based Access Control objects like roles and rolebindings should be created
enabled: true
- # When set to true:
- # 1. It switches respectively the use of `ClusterRole` and `ClusterRoleBinding` to `Role` and `RoleBinding`.
- # 2. It adds `disableIngressClassLookup` on Kubernetes Ingress with Traefik Proxy v3 until v3.1.4
- # 3. It adds `disableClusterScopeResources` on Ingress and CRD (Kubernetes) providers with Traefik Proxy v3.1.2+
- # **NOTE**: `IngressClass`, `NodePortLB` and **Gateway** provider cannot be used with namespaced RBAC.
- # See [upstream documentation](https://doc.traefik.io/traefik/providers/kubernetes-ingress/#disableclusterscoperesources) for more details.
+ # -- When set to true: <br />
+ # 1. It switches respectively the use of `ClusterRole` and `ClusterRoleBinding` to `Role` and `RoleBinding`.<br />
+ # 2. It adds `disableClusterScopeResources` on Ingress and CRD (Kubernetes) providers<br />
+ # **NOTE**: `IngressClass`, `NodePortLB` and **Gateway** provider cannot be used with namespaced RBAC. <br />
+ # **NOTE**: with Traefik Hub, a cluster-scoped `ValidatingAdmissionPolicy` is deployed by default but can be opt-out. See `hub.restrictSecretTypes`. <br />
+ # See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-ingress/#opt-providers-kubernetesIngress-disableClusterScopeResources) for more details.
namespaced: false
- # Enable user-facing roles
+ # -- Enable user-facing roles
# https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles
aggregateTo: []
- # -- Enable to create a PodSecurityPolicy and assign it to the Service Account via RoleBinding or ClusterRoleBinding
- podSecurityPolicy:
- enabled: false
+ # -- List of Kubernetes secrets that are accessible for Traefik when `rbac.namespaced` is true. If empty, then access is granted to every secret. Ignored when `rbac.namespaced` is false (ClusterRole), since Kubernetes RBAC does not support `resourceNames` on cluster-scoped list/watch rules.
+ secretResourceNames: []
# -- The service account the pods will use to interact with the Kubernetes API
serviceAccount: # @schema additionalProperties: false
# If set, an existing service account is used
@@ -4932,23 +5048,35 @@ traefik:
namespaceOverride: ""
# -- This field overrides the default app.kubernetes.io/instance label for all Objects.
instanceLabelOverride: ""
- # -- This field overrides the default version extracted from image.tag
+ # -- This field overrides the default version extracted from image.tag. Required when pinning by `image.digest`, since the version cannot be derived from a digest.
versionOverride: ""
# -- overrides the app.kubernetes.io/name label
nameOverride: ""
# -- Overrides the resource name for templates (i.e deployment, service, etc..)
fullnameOverride: ""
- # Traefik Hub configuration. See https://doc.traefik.io/traefik-hub/
- hub:
+ # Proxy mode: without a token, Traefik Hub runs as Traefik Proxy. Set
+ # hub.token to a Secret name with a `token` key to enable API Gateway.
+ hub: # @schema additionalProperties: false
+ # -- (bool) Install Traefik Hub. Without `hub.token`, it runs in proxy mode: a drop-in Traefik
+ # Proxy, which requires Traefik Hub >= v3.21.0-ea.
+ # @default -- `true` when `hub.token` is set
+ enabled: true # @schema type:[boolean, null]
# -- Name of `Secret` with key 'token' set to a valid license token.
# It enables API Gateway.
token: ""
# -- Mount path for token secret.
tokenMountPath: "/etc/secrets"
- # -- Disables all external network connections.
+ # -- Use the hardened image variant. It appends `-hardened` to the tag and defaults the image
+ # to `registry.traefik.io/traefik-hub`. Requires `hub.enabled` and Traefik Hub >= v3.21.0-ea.
+ hardened: false
+ # -- (bool) Disables all external network connections.
offline: # @schema type:[boolean, null]
# -- By default, Traefik Hub provider watches all namespaces. When using `rbac.namespaced`, it will watch helm release namespace and namespaces listed in this array.
namespaces: [] # @schema required:true
+ # -- Deploy a `ValidatingAdmissionPolicy` that only allows Traefik Hub to write `Opaque` and `kubernetes.io/tls` Secrets.
+ # It prevents Traefik Hub from creating `kubernetes.io/service-account-token` Secrets. Requires `hub.token`.
+ # **NOTE**: it is a cluster-scoped resource, also deployed with `rbac.namespaced`. Disable it only if the chart installer cannot create it.
+ restrictSecretTypes: true
apimanagement:
# -- Set to true in order to enable API Management. Requires a valid license token.
enabled: false
@@ -4968,15 +5096,18 @@ traefik:
openApi:
# -- When set to true, it will only accept paths and methods that are explicitly defined in its OpenAPI specification
validateRequestMethodAndPath: false
+ # -- Interval to refresh the OpenAPI specification, as a Go duration. Must be at least `1m`.
+ # @default -- `1m` when unset
+ refreshInterval: ""
mcpgateway:
# -- Set to true in order to enable AI MCP Gateway. Requires a valid license token.
enabled: false
- # -- Hard limit for the size of request bodies inspected by the gateway. Accepts a plain integer representing **bytes**. The default value is `1048576` (1 MiB).
+ # -- (int) Hard limit for the size of request bodies inspected by the gateway. Accepts a plain integer representing **bytes**. The default value is `1048576` (1 MiB).
maxRequestBodySize: # @schema type:[integer, null]; minimum:0
aigateway:
# -- Set to true in order to enable AI Gateway. Requires a valid license token.
enabled: false
- # -- Hard limit for the size of request bodies inspected by the gateway. Accepts a plain integer representing **bytes**. The default value is `1048576` (1 MiB).
+ # -- (int) Hard limit for the size of request bodies inspected by the gateway. Accepts a plain integer representing **bytes**. The default value is `1048576` (1 MiB).
maxRequestBodySize: # @schema type:[integer, null]; minimum:0
providers:
consulCatalogEnterprise:
@@ -4997,8 +5128,8 @@ traefik:
address: ""
# -- Data center to use. If not provided, the default agent data center is used
datacenter: ""
- # -- WaitTime limits how long a Watch will block. If not provided, the agent default
- endpointWaitTime: 0
+ # -- (int) WaitTime limits how long a Watch will block. If not provided, the agent default
+ endpointWaitTime: # @schema type:[integer, null]
httpauth:
# -- Basic Auth password
password: ""
@@ -5037,6 +5168,34 @@ traefik:
strictChecks: "passing, warning"
# -- Watch Consul API events.
watch: false
+ # @schema additionalProperties: false
+ ec2:
+ # -- Enable AWS EC2 provider.
+ enabled: false
+ # -- AWS region used for EC2 API requests. When empty, the region is retrieved from the EC2 Instance Metadata Service.
+ region: ""
+ # -- AWS access key ID, set together with secretAccessKey. Readable from the Pod spec: prefer IRSA, the instance role or `env`.
+ accessKeyID: ""
+ # -- AWS secret access key, set together with accessKeyID. Readable from the Pod spec: prefer IRSA, the instance role or `env`.
+ secretAccessKey: ""
+ # -- Expose instances by default. When false, only instances with the `traefik.enable=true` tag are exposed.
+ exposedByDefault: true
+ # -- Polling interval, in seconds, for the EC2 API.
+ refreshSeconds: 15
+ # -- Default rule applied to instances that do not define a router rule tag.
+ defaultRule: ""
+ # -- Expression matched against instance tags to determine whether to create routes for an instance.
+ constraints: ""
+ # -- Default backend IP mode: private, public or ipv6. Overridable per instance with the `traefik.ec2.ipmode` tag.
+ ipMode: "" # @schema enum:["", "private", "public", "ipv6"]
+ # -- EC2 API filters used to scope instance discovery. List of `{ name: "<filter>", values: ["<value>"] }` entries.
+ filters: [] # @schema item:object
+ # @schema additionalProperties: false
+ securityGroupPortDiscovery:
+ # -- Derive the backend port from the instance security-group rules when no port tag is set.
+ enabled: false
+ # -- Ports excluded from security-group port discovery. When empty, the provider excludes privileged ports except 80 and 443.
+ excludedPorts: []
microcks:
# -- Enable Microcks provider.
enabled: false
@@ -5064,11 +5223,115 @@ traefik:
insecureSkipVerify: false
# -- TLS key
key: ""
+ multicluster:
+ # -- Enable Multi-cluster provider.
+ enabled: false
+ # -- Polling interval for Multi-cluster.
+ pollInterval: 5
+ # -- Polling timeout for Multi-cluster.
+ pollTimeout: 5
+ # @schema mergeProperties: true
+ # -- Child cluster configurations, keyed by a unique name.
+ # @default -- {}
+ children:
+ # @schema additionalProperties: false
+ cluster-1:
+ # -- URL of the child cluster's uplink entrypoint.
+ address: ""
+ # -- TLS and transport configuration for connecting to this child.
+ # @default -- {}
+ serversTransport:
+ # -- (bool) Disable TLS certificate verification. **Not recommended for production.**
+ # @default -- false
+ insecureSkipVerify: # @schema type:[boolean, null]
+ # -- Server name used for SNI and certificate verification.
+ serverName: ""
+ rootCAs: []
+ certificates: []
+ # -- (int) Maximum idle connections per host.
+ # @default -- 200
+ maxIdleConnsPerHost: # @schema type:[integer, null]
+ # -- (bool) Disable HTTP/2 for connections to this child.
+ # @default -- false
+ disableHTTP2: # @schema type:[boolean, null]
+ # -- Minimum TLS version (e.g. `VersionTLS12`, `VersionTLS13`).
+ minVersion: ""
+ # -- Maximum TLS version (e.g. `VersionTLS12`, `VersionTLS13`).
+ maxVersion: ""
+ # -- List of supported cipher suites for TLS versions up to 1.2.
+ cipherSuites: []
+ # -- URI used to match against SAN URIs during the server's certificate verification.
+ peerCertURI: ""
+ forwardingTimeouts:
+ # @schema type:[string, integer, null]
+ # -- Timeout for establishing connections.
+ # @default -- 30s
+ dialTimeout:
+ # @schema type:[string, integer, null]
+ # -- Timeout for reading response headers.
+ # @default -- 0s
+ responseHeaderTimeout:
+ # @schema type:[string, integer, null]
+ # -- Timeout for idle connections.
+ # @default -- 90s
+ idleConnTimeout:
+ # @schema type:[string, integer, null]
+ # -- Timeout for HTTP/2 server ping frames.
+ # @default -- 15s
+ pingTimeout:
+ # @schema type:[string, integer, null]
+ # -- Timeout for HTTP/2 connection idle reads.
+ # @default -- 0s
+ readIdleTimeout:
+ # @schema type:[string, integer, null]
+ # -- Timeout for reading the request body.
+ # @default -- 0s
+ readTimeout:
+ # @schema type:[string, integer, null]
+ # -- Timeout for writing the response.
+ # @default -- 0s
+ writeTimeout:
+ spiffe:
+ ids: []
+ # @schema type:[string, integer, null]
+ # -- SPIFFE trust domain.
+ trustDomain: ""
+ # @schema additionalProperties: false
+ nutanixPrismCentral:
+ # -- Enable Nutanix Prism Central provider.
+ enabled: false
+ # -- Prism Central endpoint.
+ endpoint: ""
+ # -- Prism Central username.
+ username: ""
+ # -- Prism Central password.
+ password: ""
+ # -- Prism Central API key.
+ apiKey: ""
+ # -- Base configuration file path.
+ filename: ""
+ # -- Polling interval for Nutanix Prism Central API.
+ pollInterval: 30
+ # -- Polling timeout for Nutanix Prism Central API.
+ pollTimeout: 5
+ # -- Category key used to derive the service name.
+ serviceNameCategoryKey: "TraefikServiceName"
+ # -- Filter VMs by VPCs. List of `{ uuid: "<vpc-uuid>" }` entries.
+ allowedVpcs: []
+ tls:
+ # -- TLS CA
+ ca: ""
+ # -- TLS cert
+ cert: ""
+ # -- TLS key
+ key: ""
+ # -- TLS insecure skip verify
+ insecureSkipVerify: false
redis:
- # -- Enable Redis Cluster. Default: true.
+ # -- (bool) Enable Redis Cluster. Default: true.
cluster: # @schema type:[boolean, null]
- # -- Database used to store information. Default: "0".
- database: # @schema type:[string, null]
+ # -- (int) Database used to store information. Default: 0.
+ database: # @schema type:[integer, null]
# -- Endpoints of the Redis instances to connect to. Default: "".
endpoints: ""
# -- The username to use when connecting to Redis endpoints. Default: "".
@@ -5093,8 +5356,60 @@ traefik:
key: ""
# -- When insecureSkipVerify is set to true, the TLS connection accepts any certificate presented by the server. Default: false.
insecureSkipVerify: false
- # Enable export of error logs to the platform. Default: true.
+ # -- (bool) Enable export of error logs to the platform. Default: true.
sendlogs: # @schema type:[boolean, null]
+ # @schema additionalProperties: false
+ # -- Tamper-evident transparency logs. It's enabled as soon as a `driver` is configured.
+ # Requires a valid license token and Traefik Hub >= v3.21.
+ # @default -- See _values.yaml_
+ transparencyLogs:
+ # @schema additionalProperties: false
+ # -- Storage backend for the transparency log tree. Exactly one of `posix`, `gcp` or `aws` can be set.
+ driver:
+ # @schema additionalProperties: false
+ posix:
+ # -- Local filesystem path where the transparency log is stored.
+ path: ""
+ # @schema additionalProperties: false
+ gcp:
+ # -- Name of the GCS bucket used to store log state.
+ bucket: ""
+ # -- Prefix prepended to all log resource paths, to store multiple logs in one bucket.
+ bucketPrefix: ""
+ # -- GCP resource URI of the Spanner database instance to use.
+ spanner: ""
+ # @schema additionalProperties: false
+ aws:
+ # -- Name of the S3 bucket used to store log state.
+ bucket: ""
+ # -- Prefix prepended to all log resource paths, to store multiple logs in one bucket.
+ bucketPrefix: ""
+ # -- DSN of the MySQL instance to use. It carries the database password: treat it as a secret.
+ dsn: ""
+ # -- (int) Maximum number of open connections to the MySQL database.
+ maxOpenConns: # @schema type:[integer, null]; minimum:0
+ # -- (int) Maximum number of idle connections in the MySQL connection pool.
+ maxIdleConns: # @schema type:[integer, null]; minimum:0
+ # -- Private key used to sign each checkpoint, as a file path. It's required as soon as a `driver` is set and it needs to be mounted in the pod, see EXAMPLES.md.
+ signerPrivateKey: ""
+ # -- Interval between checkpoint writes, as a Go duration. Must be at least `100ms`.
+ # @default -- `1s` when unset
+ checkpointInterval: ""
+ # -- (bool) Also store the full rendered log line, not only its hash. Not recommended in production. Default: false.
+ debug: # @schema type:[boolean, null]
+ # @schema additionalProperties: false
+ # -- Witnesses cosigning each checkpoint.
+ # @default -- See _values.yaml_
+ witnessGroup:
+ # -- (int) Minimum number of witnesses that must cosign for the group to be satisfied. It cannot exceed the number of configured witnesses. Default: 1.
+ threshold: # @schema type:[integer, null]; minimum:1
+ # -- Maximum time to wait for witnesses to cosign a checkpoint, as a Go duration.
+ # @default -- `5s` when unset
+ timeout: ""
+ # -- (bool) Publish checkpoints even when the witness policy cannot be satisfied. Intended only for a non-blocking adoption of witnessing. Default: false.
+ failOpen: # @schema type:[boolean, null]
+ # -- (list) Witnesses cosigning each checkpoint. At least one is required when `threshold`, `timeout` or `failOpen` is set. List of `{ url: "<url>", key: "<path-or-content>" }` entries.
+ witnesses: # @schema type:[array, null]; item:object; minItems:1
tracing:
additionalTraceHeaders:
# -- Tracing headers to duplicate.
@@ -5140,6 +5455,24 @@ zot:
# Default values for zot.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
+
+ # Specify config.json as yaml object
+ # This will be injected into a Secret resource, so that you can store certain
+ # config options securely.
+ # Make sure `config.json` is explicitly unset in `configFiles` so that it does
+ # not conflict.
+ config: {}
+ # Example config:
+ # config:
+ # storage:
+ # rootDirectory: "/var/lib/registry"
+ # http:
+ # address: 0.0.0.0
+ # port: '5000'
+ # readTimeout: 60s
+ # writeTimeout: 60s
+ # log:
+ # level: debug
replicaCount: 1
image:
repository: us-docker.pkg.dev/palette-images-fips/palette/spectro-zot-bcfips/zot
Full Component Release Notes
The table below lists each component release in this PaletteAI cut, with the changes customers can see.
Per-component changes in 1.4.2
| Component | Tag | Notes |
|---|---|---|
| brush | brush/v0.5.34-hotfix.2 | Bug Fixes
Other
|
| canvas | canvas/v0.6.30-hotfix.2 | Bug Fixes
Other
|
| curator | curator/v0.0.11-hotfix.2 | Other
|
| frisket | frisket/v0.1.10-hotfix.2 | Bug Fixes
Other
|
| hue | hue/v0.12.38-hotfix.2 | Bug Fixes
Other
|
| mural-crds | mural-crds/v0.7.26-hotfix.2 | Other
|