# Default values for Traefik

# This is a YAML-formatted file.

# Declare variables to be passed into templates

image: # @schema additionalProperties: false

# -- Traefik image host registry. Defaults to `docker.io` for Traefik Proxy and `ghcr.io` for Traefik Hub (when `hub.token` is set).

registry: # @schema type:[string, null]

# -- Traefik image repository. Defaults to `traefik` for Traefik Proxy and `traefik/traefik-hub` for Traefik Hub (when `hub.token` is set).

repository: # @schema type:[string, null]

# -- defaults to appVersion. It's used for version checking, even prefixed with experimental- or latest-.

# To pin by digest, prefer `image.digest`. A `<version>@<digest>` combo is also accepted here; in that case the digest is what Kubernetes verifies and the version is informational (and can drift from the underlying image).

tag: # @schema type:[string, null]

# -- Traefik image digest (e.g. `sha256:abc...`). When set, takes precedence over `tag`. Set `versionOverride` alongside it so the chart's version-checking logic knows the version (it cannot be derived from the digest).

digest: # @schema type:[string, null]; pattern:^sha256:[a-f0-9]{64}$

# -- Traefik image pull policy

pullPolicy: IfNotPresent

# -- Add additional label to all resources

commonLabels: {}

deployment:

# -- Enable deployment

enabled: true

# -- Deployment or DaemonSet

kind: Deployment

# -- Number of pods of the deployment (only applies when kind == Deployment).

# Set to null to omit spec.replicas, e.g. when an external controller (HPA/KEDA) owns scaling.

replicas: 1 # @schema type:[integer, null];minimum:0

# -- Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10)

revisionHistoryLimit: # @schema type:[integer, null];minimum:0

# -- Amount of time (in seconds) before Kubernetes will send the SIGKILL signal if Traefik does not shut down

terminationGracePeriodSeconds: 60

# -- The minimum number of seconds Traefik needs to be up and running before the DaemonSet/Deployment controller considers it available

minReadySeconds: 0

## -- Override the liveness/readiness port. This is useful to integrate traefik

## with an external Load Balancer that performs healthchecks.

## Default: ports.traefik.port

healthchecksPort: # @schema type:[integer, null];minimum:0

## -- Override the liveness/readiness host. Useful for getting ping to respond on non-default entryPoint.

## Default: ports.traefik.hostIP if set, otherwise Pod IP

healthchecksHost: ""

## -- Override the liveness/readiness scheme. Useful for getting ping to

## respond on websecure entryPoint.

healthchecksScheme: # @schema enum:[HTTP, HTTPS, null]; type:[string, null]; default: HTTP

## -- Override the readiness path.

## Default: /ping

readinessPath: ""

# -- Override the liveness path.

# Default: /ping

livenessPath: ""

# -- Additional deployment annotations (e.g. for jaeger-operator sidecar injection)

annotations: {}

# -- Additional deployment labels (e.g. for filtering deployment by custom labels)

labels: {}

# -- Additional pod annotations (e.g. for mesh injection or prometheus scraping)

# It supports templating. One can set it with values like traefik/name: '{{ template "traefik.name" . }}'

podAnnotations: {}

# -- Additional Pod labels (e.g. for filtering Pod by custom labels)

# It supports templating. One can set it with values like traefik/name: '{{ template "traefik.name" . }}'

podLabels: {}

# -- Additional containers (e.g. for metric offloading sidecars)

additionalContainers: []

# https://docs.datadoghq.com/developers/dogstatsd/unix_socket/?tab=host

# - name: socat-proxy

# image: alpine/socat:1.0.5

# args: ["-s", "-u", "udp-recv:8125", "unix-sendto:/socket/socket"]

# volumeMounts:

# - name: dsdsocket

# mountPath: /socket

# -- Additional volumes available for use with initContainers and additionalContainers

additionalVolumes: []

# - name: dsdsocket

# hostPath:

# path: /var/run/statsd-exporter

# -- Additional initContainers (e.g. for setting file permission as shown below)

initContainers: []

# The "volume-permissions" init container is required if you run into permission issues.

# Related issue: https://github.com/traefik/traefik-helm-chart/issues/396

# - name: volume-permissions

# image: busybox:latest

# command: ["sh", "-c", "touch /data/acme.json; chmod -v 600 /data/acme.json"]

# volumeMounts:

# - name: data

# mountPath: /data

# -- Use process namespace sharing

shareProcessNamespace: false

# @schema type: [boolean, null]

# -- Whether to use the host user namespace. Setting this to false enables user namespaces,

# which can improve security by isolating the pod's users from the host.

# See https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/

# @default -- unset (inherits cluster default)

hostUsers:

# -- Custom pod DNS policy. Apply if `hostNetwork: true`

dnsPolicy: ""

# -- Custom pod [DNS config](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#poddnsconfig-v1-core)

dnsConfig: {}

# -- Custom [host aliases](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/)

hostAliases: []

# -- Pull secret for fetching traefik container image

imagePullSecrets: []

# -- Pod lifecycle actions

lifecycle: {}

# preStop:

# sleep:

# seconds: 20

# postStart:

# httpGet:

# path: /ping

# port: 8080

# host: localhost

# scheme: HTTP

# -- Set a runtimeClassName on pod

runtimeClassName: ""

# -- Percentage of memory limit to set for GOMEMLIMIT, set as decimal (0.9 = 90%, 0.95 = 95% etc). Only takes effect when resources.limits.memory is set. Set to 0 to disable (e.g. when using VPA or setting it via env)

goMemLimitPercentage: 0.9

# -- [Pod Disruption Budget](https://kubernetes.io/docs/reference/kubernetes-api/policy-resources/pod-disruption-budget-v1/)

# @default -- See _values.yaml_

podDisruptionBudget: # @schema additionalProperties: false

enabled: false

maxUnavailable: # @schema type:[string, integer, null];minimum:0

minAvailable: # @schema type:[string, integer, null];minimum:0

ingressClass: # @schema additionalProperties: false

# -- Create a default IngressClass for Traefik

enabled: true

isDefaultClass: true

name: ""

core: # @schema additionalProperties: false

# -- Can be used to use globally v2 router syntax. Deprecated since v3.4 /!\.

# See https://doc.traefik.io/traefik/v3.0/migration/v2-to-v3/#new-v3-syntax-notable-changes

defaultRuleSyntax: ""

# Traefik experimental features

experimental:

# -- Defines whether all plugins must be loaded successfully for Traefik to start

abortOnPluginFailure: false

fastProxy:

# -- Enables the FastProxy implementation.

enabled: false

# -- Enable debug mode for the FastProxy implementation.

debug: false

kubernetesGateway:

# -- Enable traefik experimental GatewayClass CRD

enabled: false

# -- Enable experimental plugins

plugins: {}

# -- Enable experimental local plugins

localPlugins: {}

# -- Enable OTLP logging experimental feature.

otlpLogs: false

# -- Enable Knative provider experimental feature.

knative: false

gateway:

# -- When providers.kubernetesGateway.enabled, deploy a default gateway

enabled: true

# -- Set a custom name to gateway

name: ""

# -- By default, Gateway is created in the same `Namespace` as Traefik.

namespace: ""

# -- Additional gateway annotations (e.g. for cert-manager.io/issuer)

annotations: {}

# -- [Infrastructure](https://kubernetes.io/blog/2023/11/28/gateway-api-ga/#gateway-infrastructure-labels)

infrastructure: {}

# -- Configure this Gateway as a [Default Gateway](https://kubernetes.io/blog/2025/11/06/gateway-api-v1-4/#introducing-default-gateways)

# by setting the `defaultScope` field (e.g. `All` or `Namespace`).

defaultScope: null # @schema enum:["All", "None", null]; type:[string, null]; default: null

listeners:

web:

# -- Port is the network port. Multiple listeners may use the same port, subject to the Listener compatibility rules.

# The port must match a port declared in ports section.

port: 8000

# -- Optional hostname. See [Hostname](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Hostname)

hostname: ""

# Specify expected protocol on this listener. See [ProtocolType](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.ProtocolType)

protocol: HTTP

# -- (object) Routes are restricted to namespace of the gateway [by default](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.FromNamespaces

namespacePolicy: # @schema type:[object, null]

# websecure listener is disabled by default because certificateRefs needs to be added,

# or you may specify TLS protocol with Passthrough mode and add "--providers.kubernetesGateway.experimentalChannel=true" in additionalArguments section.

# websecure:

# # -- Port is the network port. Multiple listeners may use the same port, subject to the Listener compatibility rules.

# # The port must match a port declared in ports section.

# port: 8443

# # -- Optional hostname. See [Hostname](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Hostname)

# hostname:

# # Specify expected protocol on this listener See [ProtocolType](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.ProtocolType)

# protocol: HTTPS

# # -- Routes are restricted to namespace of the gateway [by default](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.FromNamespaces)

# namespacePolicy:

# # -- Add certificates for TLS or HTTPS protocols. See [GatewayTLSConfig](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io%2fv1.GatewayTLSConfig)

# certificateRefs:

# # -- TLS behavior for the TLS session initiated by the client. See [TLSModeType](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.TLSModeType).

# mode:

gatewayClass: # @schema additionalProperties: false

# -- When providers.kubernetesGateway.enabled and gateway.enabled, deploy a default gatewayClass

enabled: true

# -- Set a custom name to GatewayClass

name: ""

# -- Additional gatewayClass labels (e.g. for filtering gateway objects by custom labels)

labels: {}

api: # @schema additionalProperties: false

# -- Enable the dashboard

dashboard: true

# -- Custom name for the dashboard (v3.7+).

dashboardName: "" # @schema type:[string, null]

# -- Disable the advertisement from the dashboard.

disableDashboardAd: # @schema type:[boolean, null]

# -- Enable the insecure API (HTTP)

insecure: # @schema type:[boolean, null]

# -- Enable the debug API

debug: # @schema type:[boolean, null]

# -- Configure API basePath

basePath: "" # @schema type:[string, null]; default: "/"

# -- Only dashboard & healthcheck IngressRoute are supported.

# It's recommended to create workloads CR outside of this Chart.

# @default -- See _values.yaml_

ingressRoute:

dashboard:

# -- Create an IngressRoute for the dashboard

enabled: false

# -- Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class)

annotations: {}

# -- Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels)

labels: {}

# -- The router match rule used for the dashboard ingressRoute

matchRule: PathPrefix(`/dashboard`) || PathPrefix(`/api`)

# -- The internal service used for the dashboard ingressRoute

# @default -- api@internal

services:

- name: api@internal

kind: TraefikService

# -- Specify the allowed entrypoints to use for the dashboard ingress route, (e.g. traefik, web, websecure).

# By default, it's using traefik entrypoint, which is not exposed.

# /!\ Do not expose your dashboard without any protection over the internet /!\

entryPoints: ["traefik"]

# -- Additional ingressRoute middlewares (e.g. for authentication)

middlewares: []

# -- TLS options (e.g. secret containing certificate)

tls: {}

healthcheck:

# -- Create an IngressRoute for the healthcheck probe

enabled: false

# -- Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class)

annotations: {}

# -- Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels)

labels: {}

# -- The router match rule used for the healthcheck ingressRoute

matchRule: PathPrefix(`/ping`)

# -- The internal service used for the healthcheck ingressRoute

# @default -- ping@internal

services:

- name: ping@internal

kind: TraefikService

# -- Specify the allowed entrypoints to use for the healthcheck ingress route, (e.g. traefik, web, websecure).

# By default, it's using traefik entrypoint, which is not exposed.

entryPoints: ["traefik"]

# -- Additional ingressRoute middlewares (e.g. for authentication)

middlewares: []

# -- TLS options (e.g. secret containing certificate)

tls: {}

updateStrategy: # @schema additionalProperties: false

# -- Customize updateStrategy of Deployment or DaemonSet

type: RollingUpdate

rollingUpdate:

maxUnavailable: 0 # @schema type:[integer, string, null]

maxSurge: 1 # @schema type:[integer, string, null]

readinessProbe: # @schema additionalProperties: false

# -- The number of consecutive failures allowed before considering the probe as failed.

failureThreshold: 1

# -- The number of seconds to wait before starting the first probe.

initialDelaySeconds: 2

# -- The number of seconds to wait between consecutive probes.

periodSeconds: 10

# -- The minimum consecutive successes required to consider the probe successful.

successThreshold: 1

# -- The number of seconds to wait for a probe response before considering it as failed.

timeoutSeconds: 2

livenessProbe: # @schema additionalProperties: false

# -- The number of consecutive failures allowed before considering the probe as failed.

failureThreshold: 3

# -- The number of seconds to wait before starting the first probe.

initialDelaySeconds: 2

# -- The number of seconds to wait between consecutive probes.

periodSeconds: 10

# -- The minimum consecutive successes required to consider the probe successful.

successThreshold: 1

# -- The number of seconds to wait for a probe response before considering it as failed.

timeoutSeconds: 2

# -- Define [Startup Probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes)

startupProbe: {}

# @schema additionalProperties: false

providers:

# -- Defines the routing precedence between providers. See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/providers/overview/#routing-precedence) for the default order.

precedence: []

# @schema additionalProperties: false

kubernetesCRD:

# -- Load Kubernetes IngressRoute provider

enabled: true

# -- Allows IngressRoute to reference resources in namespace other than theirs

allowCrossNamespace: false

# -- Allows to reference ExternalName services in IngressRoute

allowExternalNameServices: false

# -- Allows to return 503 when there are no endpoints available

allowEmptyServices: true

# -- List of namespaces from which IngressRoute, IngressRouteTCP, IngressRouteUDP, and TraefikService are allowed to declare cross-provider references. Requires traefik v3.7.1+.

crossProviderNamespaces: []

# -- When the parameter is set, only resources containing an annotation with the same value are processed. Otherwise, resources missing the annotation, having an empty value, or the value traefik are processed. It will also set required annotation on Dashboard and Healthcheck IngressRoute when enabled.

ingressClass: ""

# -- See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-ingress/#opt-providers-kubernetesIngress-labelselector)

labelSelector: ""

# -- Array of namespaces to watch. If left empty, Traefik watches all namespaces. . When using `rbac.namespaced`, it will watch helm release namespace and namespaces listed in this array.

namespaces: []

# -- Defines whether to use Native Kubernetes load-balancing mode by default.

nativeLBByDefault: false

# @schema additionalProperties: false

kubernetesIngress:

# -- Load Kubernetes Ingress provider

enabled: true

# -- Allows to reference ExternalName services in Ingress

allowExternalNameServices: false

# -- Allows to return 503 when there are no endpoints available

allowEmptyServices: true

# -- List of namespaces from which Ingresses or Services are allowed to declare Middlewares, TLSOptions, or ServersTransport references. Requires traefik v3.7.1+.

crossProviderNamespaces: []

# -- Only for Traefik v3.0, Deprecated since v3.1. See [upstream documentation](https://doc.traefik.io/traefik/v3.0/providers/kubernetes-ingress/#disableingressclasslookup)

disableIngressClassLookup: false

# -- When ingressClass is set, only Ingresses containing an annotation with the same value are processed. Otherwise, Ingresses missing the annotation, having an empty value, or the value traefik are processed.

ingressClass: # @schema type:[string, null]

labelSelector: # @schema type:[string, null]

# -- Array of namespaces to watch. If left empty, Traefik watches all namespaces. . When using `rbac.namespaced`, it will watch helm release namespace and namespaces listed in this array.

namespaces: []

# IP used for Kubernetes Ingress endpoints

publishedService:

# -- Enable [publishedService](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-ingress/#ingressendpointpublishedservice),

# usually with the Service provided by this Chart. It's possible to use it with an external Service using pathOverride.

enabled: true

# -- Override path of Kubernetes Service used to copy status from. Format: namespace/servicename.

# Default to Service deployed with this Chart.

pathOverride: ""

# @schema additionalProperties: false

ingressEndpoint:

# -- Hostname used for Kubernetes Ingress endpoints

hostname: "" # @schema type:[string, null]

# -- IP used for Kubernetes Ingress endpoints

ip: "" # @schema type:[string, null]

# -- Defines whether to use Native Kubernetes load-balancing mode by default.

nativeLBByDefault: false

# -- Defines whether to make prefix matching strictly comply with the Kubernetes Ingress specification.

strictPrefixMatching: false

# @schema additionalProperties: false

kubernetesGateway:

# -- Enable Traefik Gateway provider for Gateway API

enabled: false

# -- List of namespaces from which Gateway API routes are allowed to declare TraefikService backendRef references. Requires traefik v3.7.1+.

crossProviderNamespaces: []

# -- Toggles support for the Experimental Channel resources (Gateway API release channels documentation).

# This option currently enables support for TCPRoute and TLSRoute.

experimentalChannel: false

# -- Array of namespaces to watch. If left empty, Traefik watches all namespaces. kubernetesGateway provider requires ClusterRole and as a consequence `rbac.namespaced` is not supported.

namespaces: []

# -- A label selector can be defined to filter on specific GatewayClass objects only.

labelSelector: ""

# -- Defines whether to use Native Kubernetes load-balancing mode by default.

nativeLBByDefault: false

# -- Maximum QPS to the Kubernetes API server. A negative value disables client-side ratelimiting (v3.7.3+). Defaults to 50.

qps: # @schema type:[integer, null]

# -- Maximum burst of requests to the Kubernetes API server (v3.7.3+). Defaults to 100.

burst: # @schema type:[integer, null]

statusAddress:

# -- This IP will get copied to the Gateway status.addresses, and currently only supports one IP value (IPv4 or IPv6).

ip: ""

# -- This Hostname will get copied to the Gateway status.addresses.

hostname: ""

service:

# -- The Kubernetes service to copy status addresses from. When using third parties tools like External-DNS, this option can be used to copy the service loadbalancer.status (containing the service's endpoints IPs) to the gateways. Default to Service of this Chart.

enabled: true

name: ""

namespace: ""

# @schema additionalProperties: false

file:

# -- Create a file provider

enabled: false

# -- Allows Traefik to automatically watch for file changes

watch: true

# -- File content as an object (will be YAML-formatted, go template supported) (see https://doc.traefik.io/traefik/reference/install-configuration/providers/others/file/)

content: {}

# @schema additionalProperties: false

kubernetesIngressNGINX:

# -- Enable Kubernetes Ingress NGINX provider

enabled: false

# -- Ingress Class Controller value this controller satisfies

controllerClass: "k8s.io/ingress-nginx"

# -- Name of the ingress class this controller satisfies

ingressClass: "nginx"

# -- Define if Ingress Controller should watch for Ingress Class by Name together with Controller Class

ingressClassByName: false

# -- Define if Ingress Controller should also watch for Ingresses without an IngressClass or the annotation specified

watchIngressWithoutClass: false

# -- Single namespace the controller watches for updates to Kubernetes objects. Mutually exclusive with watchNamespaceSelector.

watchNamespace: ""

# -- Select namespaces the controller watches for updates to Kubernetes objects. Mutually exclusive with watchNamespace.

watchNamespaceSelector: ""

publishService:

# -- Enable publishService. Service fronting the Ingress controller, used to set the load-balancer status of Ingress objects.

# Usually the Service provided by this Chart. It's possible to use it with an external Service using pathOverride.

enabled: false

# -- Override path of Kubernetes Service used to copy status from. Format: namespace/servicename.

# Default to Service deployed with this Chart.

pathOverride: ""

# -- Customized address (or addresses, separated by comma) to set as the load-balancer status of Ingress objects this controller satisfies

publishStatusAddress: ""

# -- Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form 'namespace/name'

defaultBackendService: ""

# -- Disable support for Services of type ExternalName

disableSvcExternalName: false

# -- Ingress refresh throttle duration

throttleDuration: ""

# -- Kubernetes certificate authority file path (not needed for in-cluster client)

certAuthFilePath: ""

# -- Kubernetes server endpoint (required for external cluster client)

endpoint: ""

# -- Kubernetes bearer token (not needed for in-cluster client). It accepts either a token value or a file path to the token

token: ""

# -- Defines whether to enable request buffering (default: false)

proxyRequestBuffering: null # @schema type:[boolean, null]

# -- Default buffer size for reading client request body in bytes (default: 16384)

clientBodyBufferSize: # @schema type:[integer, null]

# -- Default maximum size of a client request body in bytes (default: 1048576)

proxyBodySize: # @schema type:[integer, null]

# -- Defines whether to enable response buffering (default: false)

proxyBuffering: null # @schema type:[boolean, null]

# -- Default buffer size for reading the response body in bytes (default: 8192)

proxyBufferSize: # @schema type:[integer, null]

# -- Default number of buffers for reading a response (default: 4)

proxyBuffersNumber: # @schema type:[integer, null]

# -- Amount of time to wait until a connection to a server can be established. Unitless, in seconds (default: 60)

proxyConnectTimeout: # @schema type:[integer, null]

# -- Amount of time between two successive read operations. Unitless, in seconds (default: 60)

proxyReadTimeout: # @schema type:[integer, null]

# -- Amount of time between two successive write operations. Unitless, in seconds (default: 60)

proxySendTimeout: # @schema type:[integer, null]

# -- Defines in which cases a request should be retried (default: "error timeout")

proxyNextUpstream: ""

# -- Limits the number of possible tries if the backend server does not reply (default: 3)

proxyNextUpstreamTries: # @schema type:[integer, null]

# -- Limits the total elapsed time to retry the request. Unitless, in seconds (default: 0)

proxyNextUpstreamTimeout: # @schema type:[integer, null]

# -- Defines which HTTP status codes should result in calling the default backend to return an error page

customHTTPErrors: []

# -- Defines the idle timeout for keep-alive connections to upstream servers. Unitless, in seconds (default: 60)

upstreamKeepaliveTimeout: # @schema type:[integer, null]

# -- Allow Ingress to reference resources (e.g. ConfigMaps, Secrets) in different namespaces (default: false)

allowCrossNamespaceResources: null # @schema type:[boolean, null]

# -- List of allowed response headers inside the custom headers annotations

globalAllowedResponseHeaders: []

# -- URL to the service that provides authentication for all the locations. Per ingress auth-url annotation has precedence over this option.

globalAuthUrl: ""

# -- When set, the strategy is applied to every generated IPAllowList middleware.

# @default -- See below

ipAllowListStrategy:

# -- Number of trusted proxy hops to skip when extracting the client IP from the X-Forwarded-For header. 0 disables depth-based extraction. (default: 0)

depth: 0

# -- List of IPs to exclude when scanning the X-Forwarded-For header to find the client IP.

excludedIPS: []

# -- IPv6 subnet size used to group IPv6 addresses when checking the allow list. 0 disables subnet grouping.

ipv6Subnet: 0

# -- Enables parsing and adding -snippet annotations/directives (default: false)

allowSnippetAnnotations: null # @schema type:[boolean, null]

# -- Defines whether to reject the entire ingress when any path contains regex characters and pathType is Prefix or Exact (default: true)

strictValidatePathType: null # @schema type:[boolean, null]

# -- Defines the EntryPoint to use for HTTP requests

httpEntryPoint: "web"

# -- Defines the EntryPoint to use for HTTPS requests

httpsEntryPoint: "websecure"

# @schema additionalProperties: false

modsec:

# -- Enable ModSec engine. Requires Traefik Hub >= v3.20.0-ea.8.

enabled: false

# -- Enable OWASP Core Rules.

owaspCoreRules: false

# -- Custom ModSec rules snippet.

snippet: ""

# @schema additionalProperties: false

knative:

# -- Enable Knative provider

enabled: false

# -- Array of namespaces to watch. If left empty, Traefik watches all namespaces. . When using `rbac.namespaced`, it will watch helm release namespace and namespaces listed in this array.

namespaces: []

# -- Allow filtering Knative Ingress objects

labelSelector: ""

# -- Add volumes to the traefik pod. The volume name will be passed to tpl.

# This can be used to mount a cert pair or a configmap that holds a config.toml file.

# After the volume has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg:

# `additionalArguments:

# - "--providers.file.filename=/config/dynamic.toml"

# - "--ping"

# - "--ping.entrypoint=web"`

volumes: []

# - name: public-cert

# mountPath: "/certs"

# type: secret

# - name: '{{ printf "%s-configs" .Release.Name }}'

# mountPath: "/config"

# type: configMap

# -- Additional volumeMounts to add to the Traefik container

additionalVolumeMounts: []

# -- For instance when using a logshipper for access logs

# - name: traefik-logs

# mountPath: /var/log/traefik

# -- See [logs reference](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/)

log:

# -- Set [logs format](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/#opt-log-format)

format: # @schema enum:["common", "json", null]; type:[string, null]; default: "common"

# By default, the level is set to INFO.

# -- Alternative logging levels are TRACE, DEBUG, INFO, WARN, ERROR, FATAL, and PANIC.

level: "INFO" # @schema enum:[TRACE,DEBUG,INFO,WARN,ERROR,FATAL,PANIC]; default: "INFO"

# -- To write the logs into a log file, use the filePath option.

filePath: ""

# -- When set to true and format is common, it disables the colorized output.

noColor: false

otlp:

# -- Set to true in order to enable OpenTelemetry on logs. Note that experimental.otlpLogs needs to be enabled.

enabled: false

# -- Service name used in OTLP backend. Default: traefik.

serviceName: # @schema type:[string, null]

http:

# -- Set to true in order to send logs to the OpenTelemetry Collector using HTTP.

enabled: false

# -- Format: <scheme>://<host>:<port><path>. Default: https://localhost:4318/v1/logs

endpoint: ""

# -- Additional headers sent with logs by the reporter to the OpenTelemetry Collector.

headers: {}

## Defines the TLS configuration used by the reporter to send logs to the OpenTelemetry Collector.

tls:

# -- The path to the certificate authority, it defaults to the system bundle.

ca: ""

# -- The path to the public certificate. When using this option, setting the key option is required.

cert: ""

# -- The path to the private key. When using this option, setting the cert option is required.

key: ""

# -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

insecureSkipVerify: # @schema type:[boolean, null]

grpc:

# -- Set to true in order to send logs to the OpenTelemetry Collector using gRPC

enabled: false

# -- Format: <host>:<port>. Default: "localhost:4317"

endpoint: ""

# -- Allows reporter to send logs to the OpenTelemetry Collector without using a secured protocol.

insecure: false

## Defines the TLS configuration used by the reporter to send logs to the OpenTelemetry Collector.

tls:

# -- The path to the certificate authority, it defaults to the system bundle.

ca: ""

# -- The path to the public certificate. When using this option, setting the key option is required.

cert: ""

# -- The path to the private key. When using this option, setting the cert option is required.

key: ""

# -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

insecureSkipVerify: # @schema type:[boolean, null]

# -- Defines additional resource attributes to be sent to the collector.

resourceAttributes: {}

# -- See [access logs reference](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/)

accessLog:

# -- To enable access logs

enabled: false

# -- Set [access log format](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/#opt-accesslog-format)

format: # @schema enum:["common", "genericCLF", "json", null]; type:[string, null]; default: "common"

# filePath: "/var/log/traefik/access.log

# -- Set [bufferingSize](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/#opt-accesslog-bufferingSize)

bufferingSize: # @schema type:[integer, null]

# -- Set [timezone](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/#time-zones)

timezone: ""

# -- Set [filtering](https://doc.traefik.io/traefik/observe/logs-and-access-logs/#access-log-filters)

# @default -- See below

filters: # @schema additionalProperties: false

# -- Set statusCodes, to limit the access logs to requests with a status codes in the specified range

statusCodes: ""

# -- Set retryAttempts, to keep the access logs when at least one retry has happened

retryAttempts: false

# -- Set minDuration, to keep access logs when requests take longer than the specified duration

minDuration: ""

# -- Enables accessLogs for internal resources. Default: false.

addInternals: false

# -- Enables access log output alongside OTLP (v3.7+).

dualOutput: false

fields:

# -- Set default mode for fields.names

defaultMode: keep # @schema enum:[keep, drop, redact]; default: keep

# -- Names of the fields to limit.

names: {}

headers:

# -- [Limit logged fields or headers](https://doc.traefik.io/traefik/observe/logs-and-access-logs/#log-fields-customization)

defaultMode: drop # @schema enum:[keep, drop, redact]; default: drop

names: {}

queryParameters:

# -- Keep or drop all query parameters in the RequestPath access log field (v3.7.3+).

defaultMode: # @schema enum:[keep, drop, null]; type:[string, null]; default: null

otlp:

# -- Set to true in order to enable OpenTelemetry on access logs. Note that experimental.otlpLogs needs to be enabled.

enabled: false

# -- Service name used in OTLP backend. Default: traefik.

serviceName: # @schema type:[string, null]

http:

# -- Set to true in order to send access logs to the OpenTelemetry Collector using HTTP.

enabled: false

# -- Format: <scheme>://<host>:<port><path>. Default: https://localhost:4318/v1/logs

endpoint: ""

# -- Additional headers sent with access logs by the reporter to the OpenTelemetry Collector.

headers: {}

## Defines the TLS configuration used by the reporter to send access logs to the OpenTelemetry Collector.

tls:

# -- The path to the certificate authority, it defaults to the system bundle.

ca: ""

# -- The path to the public certificate. When using this option, setting the key option is required.

cert: ""

# -- The path to the private key. When using this option, setting the cert option is required.

key: ""

# -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

insecureSkipVerify: # @schema type:[boolean, null]

grpc:

# -- Set to true in order to send access logs to the OpenTelemetry Collector using gRPC

enabled: false

# -- Format: <host>:<port>. Default: "localhost:4317"

endpoint: ""

# -- Allows reporter to send access logs to the OpenTelemetry Collector without using a secured protocol.

insecure: false

## Defines the TLS configuration used by the reporter to send access logs to the OpenTelemetry Collector.

tls:

# -- The path to the certificate authority, it defaults to the system bundle.

ca: ""

# -- The path to the public certificate. When using this option, setting the key option is required.

cert: ""

# -- The path to the private key. When using this option, setting the cert option is required.

key: ""

# -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

insecureSkipVerify: # @schema type:[boolean, null]

# -- Defines additional resource attributes to be sent to the collector.

resourceAttributes: {}

metrics:

# -- Enable metrics for internal resources. Default: false

addInternals: false

## Prometheus is enabled by default.

## It can be disabled by setting "prometheus: null"

prometheus:

# -- Entry point used to expose metrics.

entryPoint: metrics

# -- (bool) Enable metrics on entry points. Default: true

addEntryPointsLabels: # @schema type:[boolean, null]

# -- (bool) Enable metrics on routers. Default: false

addRoutersLabels: # @schema type:[boolean, null]

# -- (bool) Enable metrics on services. Default: true

addServicesLabels: # @schema type:[boolean, null]

# -- Buckets for latency metrics. Default="0.1,0.3,1.2,5.0"

buckets: ""

# -- When manualRouting is true, it disables the default internal router in

## order to allow creating a custom router for prometheus@internal service.

manualRouting: false

# -- Add HTTP header labels to metrics. See EXAMPLES.md or upstream doc for usage.

headerLabels: {} # @schema type:[object, null]

service:

# -- Create a dedicated metrics service to use with ServiceMonitor

enabled: false

labels: {}

annotations: {}

# -- When set to true, it won't check if Prometheus Operator CRDs are deployed

disableAPICheck: # @schema type:[boolean, null]

serviceMonitor:

# -- Enable optional CR for Prometheus Operator. See EXAMPLES.md for more details.

enabled: false

apiVersion: "monitoring.coreos.com/v1"

metricRelabelings: []

relabelings: []

jobLabel: ""

interval: ""

honorLabels: false

scrapeTimeout: ""

honorTimestamps: false

enableHttp2: false

followRedirects: false

additionalLabels: {}

namespace: ""

namespaceSelector: {}

prometheusRule:

# -- Enable optional CR for Prometheus Operator. See EXAMPLES.md for more details.

enabled: false

apiVersion: "monitoring.coreos.com/v1"

additionalLabels: {}

namespace: ""

# datadog:

# ## Address instructs exporter to send metrics to datadog-agent at this address.

# address: "127.0.0.1:8125"

# ## The interval used by the exporter to push metrics to datadog-agent. Default=10s

# # pushInterval: 30s

# ## The prefix to use for metrics collection. Default="traefik"

# # prefix: traefik

# ## Enable metrics on entry points. Default=true

# # addEntryPointsLabels: false

# ## Enable metrics on routers. Default=false

# # addRoutersLabels: true

# ## Enable metrics on services. Default=true

# # addServicesLabels: false

# influxdb2:

# ## Address instructs exporter to send metrics to influxdb v2 at this address.

# address: localhost:8086

# ## Token with which to connect to InfluxDB v2.

# token: xxx

# ## Organisation where metrics will be stored.

# org: ""

# ## Bucket where metrics will be stored.

# bucket: ""

# ## The interval used by the exporter to push metrics to influxdb. Default=10s

# # pushInterval: 30s

# ## Additional labels (influxdb tags) on all metrics.

# # additionalLabels:

# # env: production

# # foo: bar

# ## Enable metrics on entry points. Default=true

# # addEntryPointsLabels: false

# ## Enable metrics on routers. Default=false

# # addRoutersLabels: true

# ## Enable metrics on services. Default=true

# # addServicesLabels: false

# statsd:

# ## Address instructs exporter to send metrics to statsd at this address.

# address: localhost:8125

# ## The interval used by the exporter to push metrics to influxdb. Default=10s

# # pushInterval: 30s

# ## The prefix to use for metrics collection. Default="traefik"

# # prefix: traefik

# ## Enable metrics on entry points. Default=true

# # addEntryPointsLabels: false

# ## Enable metrics on routers. Default=false

# # addRoutersLabels: true

# ## Enable metrics on services. Default=true

# # addServicesLabels: false

otlp:

# -- Set to true in order to enable the OpenTelemetry metrics

enabled: false

# -- Enable metrics on entry points. Default: true

addEntryPointsLabels: # @schema type:[boolean, null]

# -- Enable metrics on routers. Default: false

addRoutersLabels: # @schema type:[boolean, null]

# -- Enable metrics on services. Default: true

addServicesLabels: # @schema type:[boolean, null]

# -- Explicit boundaries for Histogram data points. Default: [.005, .01, .025, .05, .1, .25, .5, 1, 2.5, 5, 10]

explicitBoundaries: []

# -- Interval at which metrics are sent to the OpenTelemetry Collector. Default: 10s

pushInterval: ""

# -- Service name used in OTLP backend. Default: traefik.

serviceName: # @schema type:[string, null]

http:

# -- Set to true in order to send metrics to the OpenTelemetry Collector using HTTP.

enabled: false

# -- Format: <scheme>://<host>:<port><path>. Default: https://localhost:4318/v1/metrics

endpoint: ""

# -- Additional headers sent with metrics by the reporter to the OpenTelemetry Collector.

headers: {}

## Defines the TLS configuration used by the reporter to send metrics to the OpenTelemetry Collector.

tls:

# -- The path to the certificate authority, it defaults to the system bundle.

ca: ""

# -- The path to the public certificate. When using this option, setting the key option is required.

cert: ""

# -- The path to the private key. When using this option, setting the cert option is required.

key: ""

# -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

insecureSkipVerify: # @schema type:[boolean, null]

grpc:

# -- Set to true in order to send metrics to the OpenTelemetry Collector using gRPC

enabled: false

# -- Format: <host>:<port>. Default: "localhost:4317"

endpoint: ""

# -- Allows reporter to send metrics to the OpenTelemetry Collector without using a secured protocol.

insecure: false

## Defines the TLS configuration used by the reporter to send metrics to the OpenTelemetry Collector.

tls:

# -- The path to the certificate authority, it defaults to the system bundle.

ca: ""

# -- The path to the public certificate. When using this option, setting the key option is required.

cert: ""

# -- The path to the private key. When using this option, setting the cert option is required.

key: ""

# -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

insecureSkipVerify: # @schema type:[boolean, null]

# -- Defines additional resource attributes to be sent to the collector.

resourceAttributes: {}

ocsp:

# -- Enable OCSP stapling support.

# See https://doc.traefik.io/traefik/reference/install-configuration/tls/ocsp/

enabled: false

# -- Defines the OCSP responder URLs to use instead of the one provided by the certificate.

responderOverrides: {}

## Tracing

# -- https://doc.traefik.io/traefik/reference/install-configuration/observability/tracing/

# @default -- See _values.yaml_

tracing: # @schema additionalProperties: false

# -- Enables tracing for internal resources. Default: false.

addInternals: false

# -- Service name used in selected backend. Default: traefik.

serviceName: # @schema type:[string, null]

# -- Defines additional resource attributes to be sent to the collector.

resourceAttributes: {}

# -- Defines the list of request headers to add as attributes. It applies to client and server kind spans.

capturedRequestHeaders: []

# -- Defines the list of response headers to add as attributes. It applies to client and server kind spans.

capturedResponseHeaders: []

# -- By default, all query parameters are redacted. Defines the list of query parameters to not redact.

safeQueryParams: []

# -- The proportion of requests to trace, specified between 0.0 and 1.0. Default: 1.0.

sampleRate: # @schema type:[number, null]; minimum:0; maximum:1

otlp:

# -- See https://doc.traefik.io/traefik/reference/install-configuration/observability/tracing/#configuration-options

enabled: false

http:

# -- Set to true in order to send metrics to the OpenTelemetry Collector using HTTP.

enabled: false

# -- Format: <scheme>://<host>:<port><path>. Default: https://localhost:4318/v1/tracing

endpoint: ""

# -- Additional headers sent with metrics by the reporter to the OpenTelemetry Collector.

headers: {}

## Defines the TLS configuration used by the reporter to send metrics to the OpenTelemetry Collector.

tls:

# -- The path to the certificate authority, it defaults to the system bundle.

ca: ""

# -- The path to the public certificate. When using this option, setting the key option is required.

cert: ""

# -- The path to the private key. When using this option, setting the cert option is required.

key: ""

# -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

insecureSkipVerify: # @schema type:[boolean, null]

grpc:

# -- Set to true in order to send metrics to the OpenTelemetry Collector using gRPC

enabled: false

# -- Format: <host>:<port>. Default: "localhost:4317"

endpoint: ""

# -- Allows reporter to send metrics to the OpenTelemetry Collector without using a secured protocol.

insecure: false

## Defines the TLS configuration used by the reporter to send metrics to the OpenTelemetry Collector.

tls:

# -- The path to the certificate authority, it defaults to the system bundle.

ca: ""

# -- The path to the public certificate. When using this option, setting the key option is required.

cert: ""

# -- The path to the private key. When using this option, setting the cert option is required.

key: ""

# -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.

insecureSkipVerify: # @schema type:[boolean, null]

global:

checkNewVersion: true

# -- Please take time to consider whether or not you wish to share anonymous data with us

# See https://doc.traefik.io/traefik/contributing/data-collection/

sendAnonymousUsage: false

# -- Disable appending RemoteAddr to X-Forwarded-For header globally (v3.7+).

notAppendXForwardedFor: false

# -- Required for Azure Marketplace integration.

# See https://learn.microsoft.com/en-us/partner-center/marketplace-offers/azure-container-technical-assets-kubernetes?tabs=linux,linux2#update-the-helm-chart

# @default -- See _values.yaml_

azure:

enabled: false

images:

proxy:

image: traefik

tag: latest

registry: docker.io/library

hub:

image: traefik-hub

tag: latest

registry: ghcr.io/traefik

# -- Additional arguments to be passed at Traefik's binary

# See [CLI Reference](https://docs.traefik.io/reference/static-configuration/cli/)

# Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"`

additionalArguments: []

# - "--providers.kubernetesingress.ingressclass=traefik-internal"

# - "--log.level=DEBUG"

# -- Additional Environment variables to be passed to Traefik's binary

env: []

# -- Environment variables to be passed to Traefik's binary from configMaps or secrets

envFrom: []

# @schema mergeProperties: true

ports:

# @schema additionalProperties: false

traefik:

port: 8080

# -- Use hostPort if set.

hostPort: # @schema type:[integer, null]; minimum:0

# -- Use hostIP if set. If not set, Kubernetes will default to 0.0.0.0, which

# means it's listening on all your interfaces and all your IPs. You may want

# to set this value if you need traefik to listen on specific interface

# only.

hostIP: # @schema type:[string, null]

# Defines whether the port is exposed if service.type is LoadBalancer or

# NodePort.

#

# -- You SHOULD NOT expose the traefik port on production deployments.

# If you want to access it from outside your cluster,

# use `kubectl port-forward` or create a secure ingress

expose:

default: false

# -- The exposed port for this service

exposedPort: 8080

# -- The port protocol (TCP/UDP)

protocol: TCP

observability: # @schema additionalProperties: false

# -- Defines whether a router attached to this EntryPoint produces metrics by default.

metrics: # @schema type:[boolean, null]; default: true

# -- Defines whether a router attached to this EntryPoint produces access-logs by default.

accessLogs: # @schema type:[boolean, null]; default: true

# -- Defines whether a router attached to this EntryPoint produces traces by default.

tracing: # @schema type:[boolean, null]; default: true

# -- Defines the tracing verbosity level for routers attached to this EntryPoint.

traceVerbosity: # @schema enum:[minimal, detailed, null]; type:[string, null]; default: minimal

web:

## -- Enable this entrypoint as a default entrypoint. When a service doesn't explicitly set an entrypoint it will only use this entrypoint.

asDefault: # @schema type: [boolean, null]; default: null

port: 8000

# hostPort: 8000

# containerPort: 8000

expose:

default: true

exposedPort: 80

## -- Different target traefik port on the cluster, useful for IP type LB

targetPort: # @schema type:[string, integer, null]; minimum:0

# The port protocol (TCP/UDP)

protocol: TCP

# -- See [upstream documentation](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport)

nodePort: # @schema type:[integer, null]; minimum:0

# -- See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#allowacmebypass)

allowACMEByPass: false

http:

redirections:

# -- Port Redirections

# Added in 2.2, one can make permanent redirects via entrypoints.

# Same sets of parameters: to, scheme, permanent and priority.

# https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#configuration-example

entryPoint: {}

forwardedHeaders:

# -- Trust forwarded headers information (X-Forwarded-*).

trustedIPs: []

insecure: false

# -- Disable appending RemoteAddr to X-Forwarded-For header (v3.7+).

notAppendXForwardedFor: false

proxyProtocol:

# -- Enable the Proxy Protocol header parsing for the entry point

trustedIPs: []

insecure: false

# -- Set transport settings for the entrypoint

# @default -- nil

transport:

respondingTimeouts:

readTimeout: # @schema type:[string, integer, null]

writeTimeout: # @schema type:[string, integer, null]

idleTimeout: # @schema type:[string, integer, null]

lifeCycle:

requestAcceptGraceTimeout: # @schema type:[string, integer, null]

graceTimeOut: # @schema type:[string, integer, null]

keepAliveMaxRequests: # @schema type:[integer, null]; minimum:0

keepAliveMaxTime: # @schema type:[string, integer, null]

# -- Enable this port as an uplink for multi cluster.

# ⚠️ This feature is experimental and requires Traefik Hub with a specific subscription.

uplink: # @schema type: [boolean, null]; default: null

observability: # @schema additionalProperties: false

# -- Enables metrics for this entryPoint.

metrics: # @schema type:[boolean, null]; default: true

# -- Enables access-logs for this entryPoint.

accessLogs: # @schema type:[boolean, null]; default: true

# -- Enables tracing for this entryPoint.

tracing: # @schema type:[boolean, null]; default: true

# -- Defines the tracing verbosity level for this entryPoint.

traceVerbosity: # @schema enum:[minimal, detailed, null]; type:[string, null]; default: minimal

websecure: