### Install NGINX Ingress Controller

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Install the NGINX Ingress Controller using Helm. This is a prerequisite for testing migration.

```bash
# Install NGINX Ingress Controller
helm upgrade --install ingress-nginx ingress-nginx \
  --repo https://kubernetes.github.io/ingress-nginx \
  --namespace ingress-nginx --create-namespace
```

--------------------------------

### Update Helm Install Command for Additional Arguments

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/Changelog.md

This diff updates the example command for passing additional arguments to Traefik during Helm installation, changing the syntax for `--set`.

```yaml
diff --git a/traefik/values.yaml b/traefik/values.yaml
index 7f31548..ec1d619 100644
--- a/traefik/values.yaml
+++ b/traefik/values.yaml
@@ -40,7 +40,7 @@ volumes: []
 #
 # Configure Traefik entry points
 # Additional arguments to be passed at Traefik's binary
-## Use curly braces to pass values: `helm install --set="{--providers.kubernetesingress,--global.checknewversion=true}" ."
+## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress,--global.checknewversion=true}"`
 additionalArguments: []
 #  - "--providers.kubernetesingress"
```

--------------------------------

### Install Traefik Helm Chart (OCI Registry)

Source: https://github.com/traefik/traefik-helm-chart/blob/master/README.md

Install the Traefik Helm chart directly from the OCI registry. This method is an alternative to using the Helm repository.

```bash
helm install traefik oci://ghcr.io/traefik/helm/traefik
```

--------------------------------

### Install and Configure Knative Serving

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

These commands install the necessary Knative CRDs and core components, and then configure the network to use Traefik as the ingress class. A custom domain is also added for testing.

```shell
# 1. Install/update the Knative CRDs
kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.19.0/serving-crds.yaml
# 2. Install the Knative Serving core components
kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.19.0/serving-core.yaml
# 3. Update the config-network configuration to use the Traefik ingress class
kubectl patch configmap/config-network -n knative-serving --type merge 
  -p '{"data":{"ingress.class":"traefik.ingress.networking.knative.dev"}}'
# Add a custom domain to Knative configuration (in this example, docker.localhost)
kubectl patch configmap config-domain -n knative-serving --type='merge' 
  -p='{"data":{"docker.localhost":""}}'
```

--------------------------------

### Install Traefik Helm Chart (Standard)

Source: https://github.com/traefik/traefik-helm-chart/blob/master/README.md

Install the Traefik Helm chart using default values. This is the simplest way to deploy Traefik to your Kubernetes cluster.

```bash
helm install traefik traefik/traefik
```

--------------------------------

### Install cert-manager with Gateway API support

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Install or upgrade cert-manager using Helm, ensuring the Gateway API feature is enabled via the `--enable-gateway-api` flag. This is crucial for cert-manager to recognize and manage Gateway API resources.

```bash
helm repo add jetstack https://charts.jetstack.io --force-update
helm upgrade --install \
cert-manager jetstack/cert-manager \
--namespace cert-manager \
--create-namespace \
--version v1.15.1 \
--set crds.enabled=true \
--set "extraArgs={--enable-gateway-api}"
```

--------------------------------

### Entrypoint Redirection Configuration

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/Changelog.md

Configure permanent redirects for entrypoints. This example shows how to redirect to the 'websecure' port with a specified priority.

```yaml
redirectTo:
  port: websecure
  # (Optional)
  priority: 10
```

--------------------------------

### Define Startup Probe for Traefik Container

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/Changelog.md

Example configuration for defining a startup probe for the Traefik container, specifying execution command, initial delay, and period.

```yaml
# -- Define Startup Probe for container: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes
# eg.
# `startupProbe:
#   exec:
#     command:
#       - mycommand
#       - foo
#   initialDelaySeconds: 5
#   periodSeconds: 5`
startupProbe:
```

--------------------------------

### Configure Middlewares for Entrypoint

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/Changelog.md

Example of how to configure middlewares for a Traefik entrypoint. The schema indicates it can be an array or null.

```yaml
middlewares: []  # @schema type: [array, null]
```

--------------------------------

### Install Traefik Helm Chart with Custom Values

Source: https://github.com/traefik/traefik-helm-chart/blob/master/README.md

Install the Traefik Helm chart while providing a custom values file for configuration. This allows you to override default settings to suit your specific needs.

```bash
helm install -f myvalues.yaml traefik traefik/traefik
```

--------------------------------

### Install Traefik as a DaemonSet

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Configure Traefik to run as a DaemonSet instead of a Deployment. The update strategy may need adjustment.

```yaml
deployment:
  kind: DaemonSet

# The update strategy needs to be changed accordingly
# See https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/ for details
updateStrategy:
  rollingUpdate:
    maxUnavailable: 1
```

--------------------------------

### Expose Service with HTTPRoute using Gateway API

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

This example defines a Deployment and Service for 'whoami', and an HTTPRoute to expose it via the Traefik Gateway. Ensure these resources are in the same namespace as the Traefik Gateway.

```yaml
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: whoami
spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami
  template:
    metadata:
      labels:
        app: whoami
    spec:
      containers:
        - name: whoami
          image: traefik/whoami

---
apiVersion: v1
kind: Service
metadata:
  name: whoami
spec:
  selector:
    app: whoami
  ports:
    - protocol: TCP
      port: 80

---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: whoami
spec:
  parentRefs:
    - name: traefik-gateway
  hostnames:
    - whoami.docker.localhost
  rules:
    - matches:
        - path:
            type: Exact
            value: /

      backendRefs:
        - name: whoami
          port: 80
          weight: 1
```

--------------------------------

### Run Renovate Locally for Debugging

Source: https://github.com/traefik/traefik-helm-chart/blob/master/CONTRIBUTING.md

This command allows you to run Renovate locally for debugging purposes. Ensure you have Docker installed and the necessary configuration files present.

```bash
docker run -it -v $(pwd):/usr/src/app  -e RENOVATE_CONFIG_FILE=/usr/src/app/.github/renovate.json5 -e LOG_LEVEL=DEBUG renovate/renovate --platform=local
```

--------------------------------

### Example Value Documentation Pattern

Source: https://github.com/traefik/traefik-helm-chart/blob/master/AGENTS.md

Document values using helm-docs comments and inline schema annotations for type constraints and defaults. Primary keys in values.yaml should be separated by an empty commented line.

```yaml
log:
  # -- Set [logs format](https://doc.traefik.io/traefik/observability/logs/#format)
  format:  # @schema enum:["common", "json", null]; type:[string, null]; default: "common"
```

--------------------------------

### Use Go Templates in IngressRoute Annotations and Labels

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

This example demonstrates how to use Go template expressions within the `annotations` and `labels` fields of an IngressRoute. This allows for dynamic configuration based on Helm release values.

```yaml
ingressRoute:
  dashboard:
    enabled: true
    matchRule: Host(`traefik-dashboard.example.com`)
    entryPoints: ["websecure"]
    # Annotations support Go template expressions evaluated at render time
    annotations:
      gethomepage.dev/enabled: "true"
      gethomepage.dev/name: "Traefik"
      gethomepage.dev/group: "Infrastructure"
      gethomepage.dev/widget.url: "http://{{ .Release.Name }}.{{ .Release.Namespace }}:{{ .Values.ports.traefik.port }}"
    # Labels support Go template expressions as well
    labels:
      app.kubernetes.io/instance: "{{ .Release.Name }}"

```

--------------------------------

### Configure Child Cluster for Multi-Cluster Provider

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Enable the Multi-Cluster provider on a child cluster, set up an uplink entrypoint, and advertise a workload using the file provider. This is part of a multi-cluster setup.

```yaml
ports:
  multicluster:
    port: 9443
    asDefault: true
    uplink: true # <== This entrypoint becomes an uplink
    expose:
      default: true
    http:
      tls:
        enabled: true

hub:
  token: hub-token
  providers:
    multicluster:
      enabled: true

providers:
  file:
    enabled: true
    content:
      http:
        uplinks:
          whoami:
            entryPoints:
              - multicluster

        routers:
          backend:
            rule: PathPrefix(`/`)
            service: backend
            uplinks:
              - whoami

        services:
          backend:
            loadBalancer:
              servers:
                - url: http://whoami.example.svc.cluster.local:80
```

--------------------------------

### Common Helm Chart Commands

Source: https://github.com/traefik/traefik-helm-chart/blob/master/AGENTS.md

Run these commands via Docker for various development tasks like testing, linting, and documentation generation. No local tool installations are required.

```bash
make test          # Run unit tests (helm-unittest)
make lint          # Static linting via chart-testing (ct)
make test-ns       # Check namespace handling
make docs          # Regenerate traefik/VALUES.md via helm-docs
make schema        # Regenerate values.schema.json (requires helm-schema plugin: helm plugin install https://github.com/losisin/helm-values-schema-json.git)
make changelog     # Update Changelogs
```

--------------------------------

### Traefik Helm Chart: Deprecated Local Plugins Warning

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/templates/NOTES.txt

Warns about the use of deprecated legacy 'hostPath' configuration for local plugins and provides an example of the recommended migration to 'type.hostPathPlugin'.

```go-template
{{/* Warn about deprecated localPlugins */}}
  {{- if include "traefik.hasDeprecatedLocalPlugins" . }}
    {{- printf "\n" -}}
⚠️ DEPRECATION WARNING: You are using the deprecated legacy 'hostPath' configuration.
Please migrate to the new structured 'type.hostPathPlugin' configuration within localPlugins.
The legacy root-level hostPath configuration will be removed in the next major version.

Migration example:
  experimental:
    localPlugins:
      your-plugin:
        moduleName: github.com/example/yourplugin
        mountPath: /plugins-local/src/github.com/example/yourplugin
        # Choose one of the following types:
        type: inlinePlugin        # Recommended for small/medium plugins: secure ConfigMap-based
        source:                  # Required for inlinePlugin
          # your plugin files here
        # type: hostPath         # Use with caution for security reasons
        #   hostPath: /path/to/plugin
        # type: localPath       # Advanced: Uses additionalVolumes, can be used with PVC, CSI drivers (s3-csi-driver, FUSE), etc.
        #   volumeName: plugin-storage
    {{- printf "\n" -}}
  {{- end -}}
```

--------------------------------

### Install Traefik with Argo Rollouts

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Delegate replica management to Argo Rollouts by setting deployment replicas to 0. This enables progressive delivery strategies. The Rollout resource can be defined separately or within extraObjects.

```yaml
deployment:
  replicas: 0
autoscaling:
  enabled: true
  minReplicas: 5
  maxReplicas: 50
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 80
  scaleTargetRef:
    apiVersion: argoproj.io/v1alpha1
    kind: Rollout
    name: "{{ template \"traefik.fullname\" . }}"
```

```yaml
extraObjects:
  - apiVersion: argoproj.io/v1alpha1
    kind: Rollout
    metadata:
      name: "{{ template \"traefik.fullname\" . }}"
    spec:
      workloadRef:
        apiVersion: apps/v1
        kind: Deployment
        name: "{{ template \"traefik.fullname\" . }}"
      strategy:
        canary:
          steps:
          - setWeight: 10
          - pause:
              duration: 5m
```

--------------------------------

### Add Additional Volumes for Init and Additional Containers

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/Changelog.md

This snippet shows how to add additional volumes for init containers and additional containers in the Traefik Helm chart's values.yaml. It includes examples for Datadog's DogStatsD Unix socket.

```diff
diff --git a/traefik/values.yaml b/traefik/values.yaml
index 9bac45e..b7153a1 100644
--- a/traefik/values.yaml
+++ b/traefik/values.yaml
@@ -17,6 +17,18 @@ deployment:
   podAnnotations: {}
   # Additional containers (e.g. for metric offloading sidecars)
   additionalContainers: []
+    # https://docs.datadoghq.com/developers/dogstatsd/unix_socket/?tab=host
+    # - name: socat-proxy
+    # image: alpine/socat:1.0.5
+    # args: ["-s", "-u", "udp-recv:8125", "unix-sendto:/socket/socket"]
+    # volumeMounts:
+    #   - name: dsdsocket
+    #     mountPath: /socket
+  # Additional volumes available for use with initContainers and additionalContainers
+  additionalVolumes: []
+    # - name: dsdsocket
+    #   hostPath:
+    #   path: /var/run/statsd-exporter
   # Additional initContainers (e.g. for setting file permission as shown below)
   initContainers: []
     # The "volume-permissions" init container is required if you run into permission issues.

```

--------------------------------

### Configure Traefik Hub with Private Plugin Registry

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Set up Traefik Hub to use plugins from a private registry, specifying base module names and authentication credentials. Note: This example is for demonstration; prefer URNs for credentials in production.

```yaml
hub:
  token: traefik-hub-license
  pluginRegistry:
    sources:
      noop:
        baseModuleName: "github.com"
        github:
          token: "ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

image:
  registry: ghcr.io
  repository: traefik/traefik-hub
  tag: v3.18.0

experimental:
  plugins:
    noop:
      moduleName: github.com/traefik-contrib/noop
      version: v0.1.0

extraObjects:
  - apiVersion: traefik.io/v1alpha1
    kind: Middleware
    metadata:
      name: noop
    spec:
      plugin:
        noop:
          responseCode: 204
  - apiVersion: traefik.io/v1alpha1
    kind: IngressRoute
    metadata:
      name: demo
    spec:
      entryPoints:
        - web
      routes:
        - kind: Rule
          match: Host(`demo.localhost`)
          services:
            - name: noop@internal
              kind: TraefikService
          middlewares:
            - name: noop
```

--------------------------------

### Update Additional Arguments for Traefik

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/Changelog.md

Illustrates the modification in `values.yaml` to change the example for passing additional arguments, specifically updating the log level example.

```diff
diff --git a/traefik/values.yaml b/traefik/values.yaml
index d639f72..57cc7e1 100644
--- a/traefik/values.yaml
+++ b/traefik/values.yaml
@@ -50,9 +50,10 @@ globalArguments:
 # Configure Traefik static configuration
 # Additional arguments to be passed at Traefik's binary
 # All available options available on https://docs.traefik.io/reference/static-configuration/cli/
-## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress,--global.checknewversion=true}"`
+## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress,--logs.level=DEBUG}"`
 additionalArguments: []
 #  - "--providers.kubernetesingress"
+#  - "--logs.level=DEBUG"
 
 # Environment variables to be passed to Traefik's binary
env: []

```

--------------------------------

### Configure Entrypoint Protocol

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/Changelog.md

This snippet demonstrates how to configure the protocol for an entrypoint. The default protocol is TCP.

```yaml
ports:
    # hostPort: 8443
    expose: true
    exposedPort: 443
    ## The port protocol (TCP/UDP)
    protocol: TCP
    # nodePort: 32443
    # 

```

--------------------------------

### Install Traefik with Kubernetes Ingress NGINX Provider

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Install Traefik using Helm, enabling the Kubernetes Ingress NGINX provider. This allows Traefik to serve the same Ingress resources as NGINX.

```bash
helm upgrade --install traefik traefik/traefik \
  --namespace traefik --create-namespace \
  --set providers.kubernetesIngressNGINX.enabled=true
```

--------------------------------

### Install Gateway API CRDs

Source: https://github.com/traefik/traefik-helm-chart/blob/master/README.md

Apply the standard installation manifest for Gateway API CRDs if you are using the Kubernetes Gateway API provider with Traefik v3.7. This is a prerequisite for Traefik to function correctly with Gateway API.

```bash
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.1/standard-install.yaml
```

--------------------------------

### Update Pod Anti-Affinity Example in Traefik Helm Chart

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/Changelog.md

This diff shows the modification to the pod anti-affinity example in the Traefik Helm chart values. It updates the label selector to use `app.kubernetes.io/name` and changes the topology key.

```diff
diff --git a/traefik/values.yaml b/traefik/values.yaml
index 8c72905..ab25456 100644
--- a/traefik/values.yaml
+++ b/traefik/values.yaml
@@ -438,13 +438,13 @@ affinity: {}
 # # It should be used when hostNetwork: true to prevent port conflicts
 #   podAntiAffinity:
 #     requiredDuringSchedulingIgnoredDuringExecution:
-#     - labelSelector:
-#         matchExpressions:
-#         - key: app
-#           operator: In
-#           values:
-#           - {{ template "traefik.name" . }}
-#       topologyKey: failure-domain.beta.kubernetes.io/zone
+#       - labelSelector:
+#           matchExpressions:
+#             - key: app.kubernetes.io/name
+#               operator: In
+#               values:
+#                 - {{ template "traefik.name" . }}
+#         topologyKey: kubernetes.io/hostname
 nodeSelector: {}
 tolerations: []


```

--------------------------------

### Deploy Whoami Application with NGINX Ingress

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Deploy a sample application and configure an Ingress resource for the NGINX Ingress Controller.

```yaml
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: whoami
spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami
  template:
    metadata:
      labels:
        app: whoami
    spec:
      containers:
        - name: whoami
          image: traefik/whoami
          ports:
            - containerPort: 80

---
apiVersion: v1
kind: Service
metadata:
  name: whoami
spec:
  selector:
    app: whoami
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: whoami
  annotations:
    nginx.ingress.kubernetes.io/affinity: cookie
    nginx.ingress.kubernetes.io/affinity-mode: persistent
spec:
  ingressClassName: nginx
  rules:
    - host: whoami.docker.localhost
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: whoami
                port:
                  number: 80
```

--------------------------------

### Install Traefik on AWS with AWS LB Controller

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Configure Traefik service annotations for AWS Load Balancer Controller integration, specifying NLB-IP mode. This approach is used when the AWS Load Balancer controller is installed and managing services.

```yaml
service:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
```

--------------------------------

### Configure Entrypoint TLS

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/Changelog.md

This snippet shows how to configure TLS for an entrypoint, including specifying certificates and domains.

```yaml
    ## Set TLS at the entrypoint
    ## https://doc.traefik.io/traefik/routing/entrypoints/#tls
    tls:
      certResolver: myresolver
      domains:
        - main: "foo.example.com"
          sans:
            - "bar.example.com"
            - "baz.example.com"
      #    options: "myoptions"
      #    stores:
      #      - "mystore"
      #    # The default is to use the default certificate if no domain matches.
      #    defaultCertificate:
      #      certFile: "/path/to/your/cert.crt"
      #      keyFile: "/path/to/your/key.key"
      #    # You can also specify multiple domains for the same certificate.
      #    # - foo.example.com
      #    # - bar.example.com

```

--------------------------------

### Generated Internal Service Manifest

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Example of a generated Service manifest for an internal Traefik service.

```yaml
---
# Source: traefik/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: traefik-internal
  namespace: traefik
[...]
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: traefik
    app.kubernetes.io/instance: traefik-traefik
  ports:
  - port: 8080
    name: traefik
    targetPort: traefik
    protocol: TCP
```

--------------------------------

### Install Traefik with Namespaced RBAC

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Restrict Traefik's RBAC permissions to the target namespace instead of cluster-wide.

```yaml
rbac:
  namespaced: true
```

--------------------------------

### Apply Middlewares to Entrypoint

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/Changelog.md

This snippet demonstrates how to apply middlewares to an entrypoint. Middlewares can be used to modify requests or responses.

```yaml
    # One can apply Middlewares on an entrypoint
    # https://doc.traefik.io/traefik/middlewares/overview/
    # https://doc.traefik.io/traefik/routing/entrypoints/#middlewares
    # middlewares:
    #   - name: "my-middleware"
    #     namespace: "default"
    #     priority: 100

```

--------------------------------

### Enable HTTP3 with separate TCP/UDP services

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Enable HTTP3 on the websecure entrypoint and configure services to use separate TCP and UDP ports to avoid potential issues.

```yaml
ports:
  websecure:
    http3:
      enabled: true
service:
  single: false
```

--------------------------------

### Conventional Commit Message Examples

Source: https://github.com/traefik/traefik-helm-chart/blob/master/AGENTS.md

Use conventional commits with a required scope for all changes. These messages are used to generate the changelog.

```git
feat(deployment): support hostUsers field
fix(ingressroute): use spec.ingressClassName with Proxy v3.7+
chore(deps): update traefik image to v3.7.1
```

--------------------------------

### Environment Variables for Traefik Pods

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/Changelog.md

Configure environment variables to be passed to Traefik's binary. This example shows how to set POD_NAME and POD_NAMESPACE.

```yaml
- name: POD_NAME
  valueFrom:
    fieldRef:
      fieldPath: metadata.name
- name: POD_NAMESPACE
  valueFrom:
    fieldRef:
      fieldPath: metadata.namespace
```

--------------------------------

### Enable CrowdSec Plugin for Traefik

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Configure Traefik to use the CrowdSec bouncer plugin. This example uses an emptyDir for plugin storage by default.

```yaml
experimental:
  plugins:
    demo:
      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
      version: v1.3.5

```

--------------------------------

### Add Init Container for Volume Permissions

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/Changelog.md

This snippet demonstrates adding an init container to `values.yaml` to set proper permissions on the data volume, addressing potential permission issues.

```diff
diff --git a/traefik/values.yaml b/traefik/values.yaml
index 62e3a77..a7fb668 100644
--- a/traefik/values.yaml
+++ b/traefik/values.yaml
@@ -16,6 +16,16 @@ deployment:
   podAnnotations: {}
   # Additional containers (e.g. for metric offloading sidecars)
   additionalContainers: []
+  # Additional initContainers (e.g. for setting file permission as shown below)
+  initContainers: []
+    # The "volume-permissions" init container is required if you run into permission issues.
+    # Related issue: https://github.com/containous/traefik/issues/6972
+    # - name: volume-permissions
+    #   image: busybox:1.31.1
+    #   command: ["sh", "-c", "chmod -Rv 600 /data/*"]
+    #   volumeMounts:
+    #     - name: data
+    #       mountPath: /data
 
 # Pod disruption budget
podDisruptionBudget:

```

--------------------------------

### Install Gateway API CRDs

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Apply the Gateway API Custom Resource Definitions using kubectl. Ensure you use the correct release version.

```sh
# Install Gateway API CRDs from the Standard channel.
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.1/standard-install.yaml
```

--------------------------------

### Traefik on Host Network with Privileged Ports using Init Container

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Configure Traefik to run on the host network and bind to privileged ports using an init container to set capabilities on the Traefik binary. Requires specific podSecurityContext and securityContext settings.

```yaml
podSecurityContext:
  runAsGroup: 65532
  runAsNonRoot: false
  runAsUser: 65532
  seccompProfile:
    type: RuntimeDefault

securityContext:
  runAsNonRoot: true
  runAsUser: 65532
  allowPrivilegeEscalation: true
  capabilities:
    drop: [ALL]
    add: [NET_BIND_SERVICE]

hostNetwork: true

service:
  enabled: false

deployment:
  initContainers:
    - name: copy-binary
      image: traefik:v3.6.12
      command: ["cp", "/usr/local/bin/traefik", "/shared/traefik"]
      volumeMounts:
        - name: traefik-bin
          mountPath: /shared
    - name: setcap
      image: alpine:3.21
      command:
        - sh
        - -c
        - apk add --no-cache libcap && setcap cap_net_bind_service=+ep /shared/traefik
      securityContext:
        runAsUser: 0
        runAsNonRoot: false
      volumeMounts:
        - name: traefik-bin
          mountPath: /shared
  additionalVolumes:
    - name: traefik-bin
      emptyDir: {}

additionalVolumeMounts:
  - name: traefik-bin
    mountPath: /usr/local/bin
```

--------------------------------

### Resource Requirements and Limits for Traefik Containers

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/Changelog.md

Define CPU and memory requests and limits for Traefik containers. This example shows commented-out default values.

```yaml
# requests:
#   cpu: "100m"
#   memory: "50Mi"
# limits:
#   cpu: "300m"
#   memory: "150Mi"
```

--------------------------------

### Test Application with Traefik

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Test the application again, this time port-forwarding to Traefik, to verify it serves the same Ingress resources.

```bash
# Port-forward to Traefik
kubectl port-forward -n traefik deployment/traefik 8001:8000 &

# Test with Traefik (adjust the URL based on your setup)
curl http://whoami.docker.localhost:8001 -c /tmp/cookies.txt -b /tmp/cookies.txt
```

--------------------------------

### Generated Horizontal Pod Autoscaler (HPA) Manifest

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Example of a generated Horizontal Pod Autoscaler manifest for the Traefik deployment when used as a Helm dependency.

```yaml
---
# Source: foo/charts/traefik/templates/hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: release-name-traefik
  namespace: flux-system
  labels:
    app.kubernetes.io/name: traefik
    app.kubernetes.io/instance: release-name-flux-system
    helm.sh/chart: traefik-24.0.0
    app.kubernetes.io/managed-by: Helm
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: release-name-traefik
  maxReplicas: 3
```

--------------------------------

### Configure HTTP/3 and TLS on Traefik Entrypoints

Source: https://github.com/traefik/traefik-helm-chart/blob/master/traefik/Changelog.md

This snippet demonstrates how to configure HTTP/3 and TLS settings for Traefik entrypoints within the `values.yaml` file. It highlights the `http3.enabled` and `tls.enabled` parameters and notes potential limitations with dual TCP/UDP ports.

```yaml
ports:
    # The port protocol (TCP/UDP)
    protocol: TCP
    # nodePort: 32443
    # 
    ## Enable HTTP/3 on the entrypoint
    ## Enabling it will also enable http3 experimental feature
    ## https://doc.traefik.io/traefik/routing/entrypoints/#http3
    ## There are known limitations when trying to listen on same ports for
    ## TCP & UDP (Http3). There is a workaround in this chart using dual Service.
    ## https://github.com/kubernetes/kubernetes/issues/47249#issuecomment-587960741
    http3:
      enabled: false
    # advertisedPort: 4443
    # 
    ## Set TLS at the entrypoint
    ## https://doc.traefik.io/traefik/routing/entrypoints/#tls
    tls:
      enabled: true
      # this is the name of a TLSOption definition
      options: ""
```

--------------------------------

### Deploy Multiple Gateways with Single Traefik

Source: https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md

Configures a single Traefik installation to expose multiple gateways, such as 'internal' and 'external'. This involves defining ports and services for each gateway.

```yaml
# Ports for external gateway
ports:
  web-ext:
    port: 9080
    exposedPort: 80
    expose:
      external: true
  websecure-ext:
    port: 9443
    exposedPort: 443
    expose:
      external: true

gateway:
  enabled: true
  name: traefik-internal

gatewayClass:
  enabled: true

service:
  additionalServices:
    external:
      spec:
        type: LoadBalancer

providers:
  kubernetesGateway:
    enabled: true
    statusAddress:
      service:
        enabled: false
```

--------------------------------

### Verify Traefik Helm Chart (OCI Registry)

Source: https://github.com/traefik/traefik-helm-chart/blob/master/README.md

Verify a Traefik Helm chart fetched from an OCI registry using the downloaded public signing key. Replace `<VERSION>` with the specific chart version.

```bash
helm fetch --verify --keyring $HOME/.gnupg/traefik.pubring.gpg oci://ghcr.io/traefik/helm/traefik:<VERSION>
```