Update traefik to version 3.3.6 & helm chart to version 35.0.1

Reviewed-on: #2

.drone.yml

@@ -1,7 +1,7 @@
 ---
 kind: pipeline
 type: kubernetes
-#type: docker
+# type: docker
 name: default
 
 steps:

defaults/main.yml

@@ -1,19 +1,29 @@
 my_context: kubernetes
-traefik_version: "2.3"
+traefik_version: "3.3.6"
-traefik_domain: "local"
+traefik_helm_chart_version: "35.0.1"
+traefikcrds_helm_chart_version: "1.6.0"
+cluster_domain: "local"
 traefik_namespace: "traefik"
-#ingress_whitelist:
+traefik_service_type: LoadBalancer
+# ingress_whitelist:
 #   - 10.96.0.0/12
 #   - 10.244.0.0/16
 #   - 192.168.0.0/24
-#traefik_node_selector:
+# traefik_node_selector:
 #   - localhost
 traefik_cpu_limit: 500m
 traefik_memory_limit: 300Mi
-traefik_entrypoints:
+traefik_entrypoints: []
-    - { name: "http", port: 8000, proto: "TCP", hostport: 80 }
+#     - { name: "http", port: 8000, proto: "TCP", hostport: 80 middlewares: ["{{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd"] }
-    - { name: "https", port: 4443, proto: "TCP", hostport: 443, tls: true }
+#     - { name: "https", port: 4443, proto: "TCP", hostport: 443, tls: true middlewares: ["{{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd"] }
-    - { name: "traefik", port: 8080, proto: "TCP" }
+#     - { name: "traefik", port: 8080, proto: "TCP" }
+# traefik_external_ips: []
+#    - 1.2.3.4
 
 basic_auth: false
-#traefik_dashboard_certificate: wildcard-cluster
+# traefik_dashboard_certificate: wildcard-cluster
+
+crowdsec_namespace: "crowdsec"
+crowdsec_traefik_bouncer_chart_version: "0.1.3"
+
+traefik_sabblier_version: "1.9.0"

meta/main.yml

@@ -6,7 +6,7 @@ galaxy_info:
   galaxy_tags: []
   license: GPL2
   collections:
-    - community.kubernetes
+    - kubernetes.core
   platforms:
     - name: kubernetes
       version:

tasks/main.yml

@@ -1,7 +1,20 @@
 - name: traefik setup
   block:
+#    - name: Deploy Traefik CRDs
+#      kubernetes.core.k8s:
+#        state: present
+#        context: "{{ my_context }}"
+#        apply: true
+#        definition: "{{ lookup('url', item , split_lines=False) | from_yaml_all }}"
+#      with_items:
+##        - "https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml"
+#        - "https://raw.githubusercontent.com/traefik/traefik/v3.2/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml"
+##        - "https://raw.githubusercontent.com/traefik/traefik/v3.2/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml"
+##      ansible.builtin.command: >
+##        kubectl --context "{{ my_context }}" apply --server-side --force-conflicts -k
+##        https://github.com/traefik/traefik-helm-chart/tree/v{{ traefik_helm_chart_version }}/traefik/crds/
     - name: namespace
-    k8s:
+      kubernetes.core.k8s:
         state: present
         context: "{{ my_context }}"
         merge_type: merge
@@ -9,20 +22,20 @@
           api_version: v1
           kind: Namespace
           metadata:
-          name: traefik
+            name: '{{ traefik_namespace }}'
             labels:
               namespace: '{{ traefik_namespace }}'
 
     - name: Create a Secret object for basic authentification
-    k8s:
+      kubernetes.core.k8s:
         state: present
         context: "{{ my_context }}"
+        namespace: '{{ traefik_namespace }}'
         definition:
           apiVersion: v1
           kind: Secret
           metadata:
             name: basic-auth
-          namespace: '{{ traefik_namespace }}'
           type: Opaque
           data:
             basic_auth: "{{ basic_auth_data | b64encode }}"
@@ -30,7 +43,7 @@
         - basic_auth|bool
 
     - name: Add host label for traefik deployment
-    k8s:
+      kubernetes.core.k8s:
         state: present
         context: "{{ my_context }}"
         definition:
@@ -45,8 +58,36 @@
       when:
         - traefik_node_selector is defined
 
+    - name: Deploy latest version of CrowdSec Traefik bouncer
+      kubernetes.core.helm:
+        context: "{{ my_context }}"
+        name: crowdsec-traefik-bouncer
+        release_namespace: "{{ traefik_namespace }}"
+        create_namespace: true
+        chart_ref: crowdsec/crowdsec-traefik-bouncer
+        chart_version: "{{ crowdsec_traefik_bouncer_chart_version }}"
+        values:
+          image:
+            tag: "0.5.0"
+          bouncer:
+            crowdsec_bouncer_api_key: "{{ traefik_crowdsec_bouncer_apikey }}"
+            crowdsec_agent_host: "crowdsec-service.{{ crowdsec_namespace }}.svc.cluster.local:8080"
+            crowdsec_bouncer_gin_mode: "release"
+          replicaCount: 1
+          podSecurityContext:
+            fsGroup: 2000
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+      when:
+        - traefik_crowdsec_bouncer_apikey is defined
+
 #    - name: Get Deployment information object
-#    k8s_info:
+#      kubernetes.core.k8s_info:
 #        context: "{{ my_context }}"
 #        api_version: v1
 #        kind: DaemonSet
@@ -57,11 +98,11 @@
 #      register: traefik_actual_resources
 #
 #    - name: Retreive actual traefik version
-#    shell: echo "{{ traefik_actual_resources.resources }}" | sed "s/.*traefik:\([0-9]\.[0-9]*\).*/\1/" | uniq
+#      ansible.builtin.shell: echo "{{ traefik_actual_resources.resources }}" | sed "s/.*traefik:\([0-9]\.[0-9]*\).*/\1/" | uniq
 #      register: traefik_actual_version
 #
 #    - name: Remove old traefik version {{ traefik_actual_version.stdout }}
-#    k8s:
+#      kubernetes.core.k8s:
 #        state: "absent"
 #        context: "{{ my_context }}"
 #        resource_definition: "{{ lookup('template', item) | from_yaml }}"
@@ -73,62 +114,144 @@
 #        - not traefik_version == traefik_actual_version.stdout
 #        - traefik_actual_version.stdout is version(traefik_version, '>')
 
+# https://github.com/traefik/traefik-helm-chart
     - name: Defined traefik repository
-    community.kubernetes.helm_repository:
+      kubernetes.core.helm_repository:
         name: traefik
         repo_url: "https://helm.traefik.io/traefik"
-    tags: traefik
+    - name: Deploy Traefik CRDs
+      kubernetes.core.helm:
+        context: "{{ my_context }}"
+        name: traefik-crds
+        chart_ref: traefik/traefik-crds
+        chart_version: "{{ traefikcrds_helm_chart_version }}"
+        release_namespace: "{{ traefik_namespace }}"
+        create_namespace: true
+#    - name: show templating results
+#      ansible.builtin.debug:
+#        msg: "{{ lookup('ansible.builtin.template', 'traefik-helm-value.yaml.j2') }}"
     - name: Deploy latest version of Traefik
-    community.kubernetes.helm:
+      kubernetes.core.helm:
+        context: "{{ my_context }}"
         name: traefik
         chart_ref: traefik/traefik
-      release_namespace: traefik
+        chart_version: "{{ traefik_helm_chart_version }}"
-      values:
+        release_namespace: "{{ traefik_namespace }}"
-        image:
+        create_namespace: true
-          tag: "{{ traefik_version_2_3 }}"
+        skip_crds: true
-        additionalArguments:
+        values: "{{ lookup('template', 'traefik-helm-value.yaml.j2') | from_yaml }}"
-          - --configFile=/etc/traefik/traefik.yaml
-        podSecurityPolicy:
-          enabled: true
-        service:
-          enabled: false
-        ingressRoute:
-          dashboard:
-            enabled: false
-        ingressClass:
-          enabled: true
-          isDefaultClass: true
-        ports:
-          web:
-            redirectTo: websecure
-            hostPort: 80
-          websecure:
-            hostPort: 443
-        volumes:
-          - mountPath: /etc/traefik
-            name: traefik-conf
-            type: configMap
-          - mountPath: /etc/traefik/file
-            name: traefik-files
-            type: configMap
-          - mountPath: /etc/traefik/basic-auth
-            name: basic-auth
-            type: secret
 
     - name: Install traefik configuration
-    k8s:
+      kubernetes.core.k8s:
         state: "present"
         context: "{{ my_context }}"
         namespace: '{{ traefik_namespace }}'
 #        merge_type: merge
-      apply: yes
+        apply: true
-      resource_definition: "{{ lookup('template', item) | from_yaml }}"
+        resource_definition: "{{ lookup('template', item) | from_yaml_all }}"
       with_items:
+        - default-network-dns-policy.yaml.j2
 #        - "{{ lookup('vars', 'traefik_' + traefik_version | regex_replace('[.]','_') + '_list') }}"
+        - traefik-certificate.yml.j2
         - traefik-cm.yml.j2
         - traefik-files.yml.j2
 #        - traefik-sa.yml.j2
         - traefik-ingressroute.yml.j2
-      - traefik-svc.yml.j2
+#        - traefik-svc.yml.j2
+#        - traefik-defaultbackend.yml.j2
+
+    - name: Install traefik plugin's
+      kubernetes.core.k8s:
+        state: "present"
+        context: "{{ my_context }}"
+        namespace: '{{ traefik_namespace }}'
+#        merge_type: merge
+        apply: true
+        resource_definition: "{{ lookup('template', item) | from_yaml_all }}"
+      with_items:
+        - traefik-ondemand-plugin.yml.j2
+      when:
+        - traefik_ondemand is defined
+
+    - name: ReInstall traefik-hub certificate if already know
+      kubernetes.core.k8s:
+        state: "present"
+        context: "{{ my_context }}"
+        namespace: '{{ traefik_namespace }}'
+#        merge_type: merge
+#        apply: true
+        resource_definition: "{{ lookup('template', item) | from_yaml_all }}"
+      with_items:
+        - traefik-hub-certificate.yml.j2
+      when:
+        - traefik_hub_tlscrt is defined
+        - traefik_hub_tlskey is defined
+    - name: Defined traefik-hub repository
+      kubernetes.core.helm_repository:
+        name: traefik-hub
+        repo_url: "https://helm.traefik.io/hub"
+      when:
+        - traefik_hub_token is defined
+    - name: Deploy latest version of Traefik-hub
+      kubernetes.core.helm:
+        context: "{{ my_context }}"
+        name: hub-agent
+        chart_ref: traefik-hub/hub-agent
+        release_namespace: "{{ traefik_namespace }}"
+        values:
+          token: "{{ traefik_hub_token }}"
+      when:
+        - traefik_hub_token is defined
+
+# echo 'apiVersion: v1
+# kind: Service
+# metadata:
+#   annotations:
+# #    external-dns.alpha.kubernetes.io/endpoints-type: HostIP
+#     external-dns.alpha.kubernetes.io/hostname: traefik.ibm.reslinger.net
+#     external-dns.alpha.kubernetes.io/endpoints-type: NodeExternalIP
+# #    external-dns.alpha.kubernetes.io/target: "1.2.3.4"
+#   name: traefik-dns
+#   namespace: traefik
+# spec:
+#   clusterIP: None
+#   ports:
+#   - name: web
+#     port: 80
+#     protocol: TCP
+#     targetPort: web
+#   - name: websecure
+#     port: 443
+#     protocol: TCP
+#     targetPort: websecure
+#   selector:
+#     app.kubernetes.io/instance: traefik-traefik
+#     app.kubernetes.io/name: traefik' | kubectl --context kubeibm -n traefik apply -f -
+
+#     - name: Deploy latest version of Switchboard
+#       kubernetes.core.helm:
+#         context: "{{ my_context }}"
+#         name: switchboard
+#         chart_ref: oci://ghcr.io/borchero/charts/switchboard
+#         release_namespace: "{{ traefik_namespace }}"
+# #        values: "{{ lookup('template', 'traefik-helm-value.yaml.j2') | from_yaml }}"
+#         values:
+#           integrations:
+# #            certManager:
+# #              enabled: true
+# #              issuer: "letsencrypt-prod"
+#             externalDNS:
+#               enabled: true
+#               targetIPs: [10.144.217.172]
+
+    - name: Install traefik grafana dashboard
+      kubernetes.core.k8s:
+        state: "present"
+        context: "{{ my_context }}"
+        namespace: 'traefik'
+        apply: yes
+        resource_definition: "{{ lookup('file', item) | from_yaml_all }}"
+      with_items:
+        - grafana-dashboard.yml
 
   tags: traefik

templates/default-network-dns-policy.yaml.j2

@@ -0,0 +1,46 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: intra-namespace
+spec:
+  podSelector: {}
+  ingress:
+    - from:
+      - namespaceSelector:
+          matchLabels:
+            name: {{ traefik_namespace }}
+
+#---
+#apiVersion: networking.k8s.io/v1
+#kind: NetworkPolicy
+#metadata:
+#  name: allow-dns-access
+#spec:
+#  podSelector:
+#    matchLabels: {}
+#  policyTypes:
+#  - Egress
+#  egress:
+#  - to:
+#    - namespaceSelector:
+#        matchLabels:
+#          kubernetes.io/metadata.name: kube-system
+#      podSelector:
+#        matchLabels:
+#          k8s-app: kube-dns
+#    ports:
+#    - protocol: UDP
+#      port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-all-traefik-v121-ingress
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: traefik
+  ingress:
+  - {}
+  policyTypes:
+  - Ingress

templates/traefik-certificate.yml.j2

@@ -0,0 +1,12 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: traefik.{{ cluster_domain }}
+spec:
+  dnsNames:
+  - traefik.{{ cluster_domain }}
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  secretName: traefik.{{ cluster_domain }}

templates/traefik-cm.yml.j2

@@ -15,49 +15,111 @@ data:
       web:
         address: ":8000/tcp"
         http:
+    #      middlewares:
+    #        - auth@file
+    #        - secure_headers@file
+    #        - crowdsec-bouncer@file
+    #        - {{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd
           redirections:
             entryPoint:
               to: websecure
               scheme: https
+              permanent: true
       websecure:
-        address: ":8443/tcp"
+        address: ":8443"
         http:
           tls:
             options: default
+    #      middlewares:
+    #        - auth@file
+    #        - secure_headers@file
+    #        - crowdsec-bouncer@file
+        http3:
+          advertisedPort: 443
       traefik:
-        address: ":9000/tcp"
+        address: ":8080/tcp"
+      metrics:
+        address: ":9100/tcp"
+{% if traefik_hub_token is defined %}
+      traefikhub-api:
+        address: ":9900"
+      traefikhub-tunl:
+        address: ":9901/tcp"
+{% endif%}
 {% for traefik_entrypoint in traefik_entrypoints %}
       {{ traefik_entrypoint.name }}:
-        address: :{{ traefik_entrypoint.port }}
+{% if traefik_entrypoint.proto is defined %}
-{% if traefik_entrypoint.tls is defined and traefik_entrypoint.tls|bool %}
+        address: ":{{ traefik_entrypoint.port }}/{{ traefik_entrypoint.proto | lower }}"
+{% else %}
+        address: ":{{ traefik_entrypoint.port }}"
+{% endif %}
+{% if traefik_entrypoint.tls is defined or traefik_entrypoint.middlewares is defined %}
         http:
+{% if traefik_entrypoint.middlewares is defined %}
+          middlewares:
+{% for middleware in traefik_entrypoint.middlewares %}
+            - {{ middleware }}
+{% endfor %}
+{% endif %}
+{% if traefik_entrypoint.tls is defined and traefik_entrypoint.tls|bool %}
           tls: {}
 {% endif %}
+{% endif %}
 {% endfor %}
     providers:
       kubernetesCRD:
     #    ingressClass: "traefik"
         throttleDuration: 2s
+{% if traefik_ondemand is defined %}
+        allowEmptyServices: true
+{% endif%}
       kubernetesIngress:
         ingressClass: "traefik"
+{% if traefik_hub_token is defined %}
+        allowExternalNameServices: true
+{% endif%}
+{% if traefik_ondemand is defined %}
+        allowEmptyServices: true
+{% endif%}
+      kubernetesGateway: {}
       file:
         directory: /etc/traefik/file/
         watch: true
     metrics:
       prometheus:
-        entryPoint: traefik
+        entryPoint: metrics
+        addRoutersLabels: true
     ping:
       entryPoint: traefik
     api:
       dashboard: true
+{% if traefik_hub_token is defined %}
+    hub: {}
+{% endif %}
     log:
-      level: WARN
+      level: ERROR
-      format: json
+    #  format: json
-    accessLog:
+    accessLog: {}
-      format: json
+    #accessLog:
-      fields:
+    #  filePath: "/var/log/traefik/access.log"
-        names:
+    #  bufferingSize: 50
-          BackendAddr: keep
+    ##  format: json
-          BackendName: keep
+    ##  fields:
-          BackendURL: keep
+    ##    names:
-          FrontendName: keep
+    ##      BackendAddr: keep
+    ##      BackendName: keep
+    ##      BackendURL: keep
+    ##      FrontendName: keep
+{% if traefik_hub_token is defined or traefik_ondemand is defined %}
+    experimental:
+    #  kubernetesGateway: true
+{% if traefik_hub_token is defined %}
+      hub: true
+{% endif %}
+{% if traefik_ondemand is defined %}
+      plugins:
+        sablier:
+          moduleName: github.com/sablierapp/sablier
+          version: v{{ traefik_sabblier_version }}
+{% endif %}
+{% endif %}

templates/traefik-defaultbackend.yml.j2

@@ -0,0 +1,16 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cheese
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.priority: "1"
+    traefik.ingress.kubernetes.io/router.middlewares: security_headers@file,compress@file
+
+spec:
+  defaultBackend:
+    service:
+      name: stilton
+      port:
+        number: 80

templates/traefik-files.yml.j2

@@ -7,6 +7,21 @@ data:
   traefik-middlewares.yaml: |
     http:
       middlewares:
+        min_security:
+          chain:
+            middlewares:
+              - security_headers
+{% if ingress_whitelist is defined %}
+              - traefik-ipwhitelist
+{% endif %}
+              - rate-limit
+              - compress
+{% if false %}
+{% if basic_auth|bool %}
+              - basic-auth
+{% endif %}
+              - authelia
+{% endif %}
         compress:
           compress:
             excludedContentTypes: ["text/event-stream"]
@@ -17,7 +32,7 @@ data:
         security_headers:
           headers:
             accessControlAllowMethods: ["GET", "OPTIONS", "PUT"]
-            accessControlAllowOrigin: "origin-list-or-null"
+    #        accessControlAllowOrigin: "origin-list-or-null"
             accessControlMaxAge: 100
             addVaryHeader: true
             browserXssFilter: true
@@ -28,13 +43,15 @@ data:
             stsPreload: true
             customFrameOptionsValue: "SAMEORIGIN"
             referrerPolicy: "same-origin"
-            featurePolicy: "vibrate 'self'"
+    #        permissionsPolicy: "vibrate 'self'"
+            permissionsPolicy: "camera 'none'; microphone 'none'; geolocation 'none'; payment 'none';"
             stsSeconds: 315360000
-            sslRedirect: true
+    #        contentSecurityPolicy: "default-src 'self' 'unsafe-inline'"
-            contentSecurityPolicy: "default-src 'self' 'unsafe-inline'"
     #        customResponseHeaders:
     #          X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex,"
     #          server: ""
+            hostsProxyHeaders:
+              - "X-Forwarded-Host"
 {% if ingress_whitelist is defined %}
         traefik-ipwhitelist:
           ipWhiteList:
@@ -43,6 +60,19 @@ data:
               - {{ acl_whitelist }}
 {% endfor %}
 {% endif %}
+{% if traefik_ondemand is defined %}
+        ondemand:
+          plugin:
+            sablier:
+              #group: default
+              dynamic:
+                displayName: Application is starting
+                refreshFrequency: 5s
+                showDetails: "true"
+                theme: hacker-terminal
+              sablierUrl: http://sablier:10000
+              sessionDuration: 1m
+{% endif %}
 {% if basic_auth|bool %}
         basic-auth:
           basicAuth:
@@ -55,7 +85,30 @@ data:
           forwardAuth:
             address: "http://authelia:9091/api/verify?rd=https://login.example.com/"
             trustForwardHeader: true
-            authReponseHeaders: ["Remote-User", "Remote-Groups", "Remote-Name", "Remote-Email"]
+            authResponseHeaders:
+              - "Remote-User"
+              - "Remote-Groups"
+              - "Remote-Name"
+              - "Remote-Email"
+        authelia-basic:
+          forwardAuth:
+            address: "http://authelia:9091/api/verify?auth=basic"
+            trustForwardHeader: true
+            authResponseHeaders:
+              - "Remote-User"
+              - "Remote-Groups"
+              - "Remote-Name"
+              - "Remote-Email"
+        crowdsec-bouncer:
+          forwardAuth:
+            address: "http://crowdsec-traefik-bouncer-service/api/v1/forwardAuth"
+            trustForwardHeader: true
+
+  traefik-servers-transport.yaml: |
+    http:
+      serversTransports:
+        skip-verify-https-backend:
+          insecureSkipVerify: true
 
   traefik-tls-defaults-options.yaml: |
     tls:
@@ -70,3 +123,33 @@ data:
               - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
               - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
               - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
+            alpnProtocols:
+              - h2
+              - http/1.1
+{% if false %}
+      stores:
+        default:
+          defaultCertificate:
+            certFile: path/to/wildcardcert.crt
+            keyFile: path/to/wildcardcert.key
+
+      certificates:
+      - certFile: /path/to/domain.cert
+        keyFile: /path/to/domain.key
+      - certFile: /path/to/other-domain.cert
+        keyFile: /path/to/other-domain.key
+{% endif %}
+
+#  dashboard.yaml: |
+#    http:
+#      routers:
+#        traefik:
+#          rule: "Host(`traefik.{{ domain | lower }}`)"
+#          entryPoints:
+#            - "websecure"
+#          middlewares:
+#            - "min_security@file"
+#{% if basic_auth|bool %}
+#            - "basic-auth@file"
+#{% endif %}
+#          service: "api@internal"

templates/traefik-helm-value.yaml.j2

@@ -0,0 +1,184 @@
+# https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml
+{% if traefik_version is defined %}
+image:
+  tag: "{{ traefik_version }}"
+{% endif %}
+#fullnameOverride: "{{ my_context }}"
+additionalArguments:
+  - --configFile=/etc/traefik/traefik.yaml
+#podSecurityPolicy:
+#  enabled: true
+service:
+  type: {{ traefik_service_type }}
+{% if traefik_external_ips is defined %}
+  externalIPs:
+{% for external_ip in traefik_external_ips %}
+    - {{ external_ip }}
+{% endfor %}
+{% endif %}
+{% if traefik_service_type == "LoadBalancer" %}
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: traefik.{{ cluster_domain }}
+{% endif %}
+ingressRoute:
+  dashboard:
+    enabled: false
+podDisruptionBudget:
+  enabled: true
+  minAvailable: 1
+ingressClass:
+  enabled: true
+  isDefaultClass: true
+{% if false %}
+autoscaling:
+  enabled: true
+  minReplicas: 1
+  maxReplicas: 10
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        targetAverageUtilization: 60
+    - type: Resource
+      resource:
+        name: memory
+        targetAverageUtilization: 60
+{% endif %}
+{% if traefik_service_type == "NodePort" or (traefik_hostport is defined and traefik_hostport == true) or traefik_hub_token is defined %}
+ports:
+{% if traefik_service_type == "NodePort" or (traefik_hostport is defined and traefik_hostport == true) %}
+  web:
+#    redirectTo: websecure
+{% if traefik_hostport is defined and traefik_hostport == true %}
+    hostPort: 80
+{% endif %}
+{% if traefik_service_type == "NodePort" %}
+    nodePort: 80
+{% endif %}
+  websecure:
+{% if traefik_hostport is defined and traefik_hostport == true %}
+    hostPort: 443
+{% endif %}
+{% if traefik_service_type == "NodePort" %}
+    nodePort: 443
+{% endif %}
+    http3:
+      enabled: true
+      advertisedPort: 443
+#    tls:
+#      enabled: true
+#      options: default
+{% endif %}
+{% if traefik_hub_token is defined %}
+  traefikhub-tunl:
+    port: 9901
+    expose: true
+    exposedPort: 9901
+    protocol: "TCP"
+{% endif %}
+{% endif %}
+volumes:
+  - mountPath: /etc/traefik
+    name: traefik-conf
+    type: configMap
+  - mountPath: /etc/traefik/file
+    name: traefik-files
+    type: configMap
+  - mountPath: /etc/traefik/basic-auth
+    name: basic-auth
+    type: secret
+deployment:
+{% if traefik_hostport is defined and traefik_hostport == true %}
+  kind: DaemonSet
+{% else %}
+  replicas: 1
+{% endif %}
+  revisionHistoryLimit: 3
+#  podAnnotations: 
+#    prometheus.io/port: '9100'
+#    prometheus.io/scrape: 'true'
+#    prometheus.io/path: "/metrics"
+{% if traefik_hostport is defined and traefik_hostport == true %}
+updateStrategy:
+  type: OnDelete
+{% endif %}
+metrics:
+  prometheus:
+    service:
+      enabled: true
+    serviceMonitor:
+      metricRelabelings: []
+#      #  - sourceLabels: [__name__]
+#      #    separator: ;
+#      #    regex: ^fluentd_output_status_buffer_(oldest|newest)_.+
+#      #    replacement: $1
+#      #    action: drop
+      relabelings: []
+#      #  - sourceLabels: [__meta_kubernetes_pod_node_name]
+#      #    separator: ;
+#      #    regex: ^(.*)$
+#      #    targetLabel: nodename
+#      #    replacement: $1
+#      #    action: replace
+#      jobLabel: traefik
+#      interval: 30s
+#      honorLabels: true
+#      # (Optional)
+#      # scrapeTimeout: 5s
+#      # honorTimestamps: true
+#      # enableHttp2: true
+#      # followRedirects: true
+#      # additionalLabels:
+#      #   foo: bar
+#      # namespace: "another-namespace"
+#      # namespaceSelector: {}
+#     prometheusRule:
+#       enabled: true
+#       additionalLabels: {}
+#       namespace: "{{ traefik_namespace }}"
+#       rules:
+#         - alert: TraefikDown
+#           expr: up{job="traefik"} == 0
+#           for: 5m
+#           labels:
+#             context: traefik
+#             severity: warning
+#           annotations:
+#             summary: "Traefik Down"
+#             description: "{% raw %}{{ $labels.pod }} on {{ $labels.nodename }} is down{% endraw %}"
+experimental:
+{% if traefik_ondemand is defined %}
+  plugins:
+    sablier:
+      moduleName: "github.com/sablierapp/sablier"
+      version: "v1.8.1"
+{% endif %}
+{% if traefik_hub_token is defined %}
+  hub:
+    enabled: true
+{% endif %}
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: [ALL]
+  readOnlyRootFilesystem: true
+  seccompProfile: 
+    type: RuntimeDefault
+{% if false %}
+{% raw %}
+extraObjects:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: "extra"
+    data:
+      something: "extra"
+  - |
+    apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: "templated"
+    data:
+      something: {{ printf "templated" }}
+{% endraw %}
+{% endif %}

templates/traefik-hub-certificate.yml.j2

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: List
+items:
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    annotations:
+      app.kubernetes.io/managed-by: traefik-hub
+    name: hub-certificate
+    namespace: {{ traefik_namespace }}
+  type: kubernetes.io/tls
+  data:
+    tls.crt: {{ traefik_hub_tlscrt | b64encode }}
+    tls.key: {{ traefik_hub_tlskey | b64encode }}

templates/traefik-ingressroute.yml.j2

@@ -1,18 +1,29 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: traefik
   labels:
     app: traefik
+  annotations:
+    kubernetes.io/ingress.class: traefik
+{% if false %}
+    external-dns.alpha.kubernetes.io/hostname: traefik.{{ cluster_domain }}
+    external-dns.alpha.kubernetes.io/endpoints-type: NodeExternalIP
+    # external-dns.alpha.kubernetes.io/endpoints-type: HostIP
+    # external-dns.alpha.kubernetes.io/target: "1.2.3.4"
+
+    # external-dns.alpha.kubernetes.io/ttl: "120"
+    # external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
+{% endif %}
 
 spec:
   entryPoints:
-    - https
+    - websecure
   routes:
   # Match is the rule corresponding to an underlying router.
   # Later on, match could be the simple form of a path prefix, e.g. just "/bar",
   # but for now we only support a traefik style matching rule.
-  - match: Host(`traefik.{{ traefik_domain }}`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
+  - match: Host(`traefik.{{ cluster_domain }}`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
     # kind could eventually be one of "Rule", "Path", "Host", "Method", "Header",
     # "Parameter", etc, to support simpler forms of rule matching, but for now we
     # only support "Rule".
@@ -20,29 +31,31 @@ spec:
 {% if basic_auth is defined or ingress_whitelist is defined %}
     middlewares:
 {% if ingress_whitelist is defined %}
-      - name: traefik-ipwhitelist
+      - name: traefik-ipwhitelist@file
 {% endif %}
 {% if basic_auth is defined %}
-      - name: basic-auth
+      - name: basic-auth@file
 {% endif %}
 {% endif %}
     services:
     - name: api@internal
       kind: TraefikService
-  - match: Host(`traefik.{{ traefik_domain }}`) && PathPrefix(`/ping`)
+  - match: Host(`traefik.{{ cluster_domain }}`) && PathPrefix(`/ping`)
     kind: Rule
     services:
     - name: ping@internal
       kind: TraefikService
-  - match: Host(`traefik.{{ traefik_domain }}`) && PathPrefix(`/metrics`)
+#  - match: Host(`traefik.{{ cluster_domain }}`) && PathPrefix(`/metrics`)
-    kind: Rule
+#    kind: Rule
-    services:
+#    services:
-    - name: prometheus@internal
+#    - name: prometheus@internal
-      kind: TraefikService
+#      kind: TraefikService
 
 
 
   tls:
 {% if traefik_dashboard_certificate is defined %}
     secretName: {{ traefik_dashboard_certificate }}
+{% else %}
+    secretName: traefik.{{ cluster_domain }}
 {% endif %}

templates/traefik-middleware-ipwhitelist.yml.j2

@@ -1,12 +0,0 @@
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: traefik-ipwhitelist
-spec:
-  ipWhiteList:
-    sourceRange:
-{% if ingress_whitelist is defined %}
-{% for acl_whitelist in ingress_whitelist %}
-      - {{ acl_whitelist }}
-{% endfor %}
-{% endif %}

templates/traefik-ondemand-plugin.yml.j2

@@ -0,0 +1,134 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sablier
+  labels:
+    app.kubernetes.io/name: sablier
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: sablier
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: sablier
+    spec:
+      serviceAccountName: sablier
+      serviceAccount: sablier
+      containers:
+      - name: sablier
+        image: sablierapp/sablier:{{ traefik_sabblier_version }}
+        args:
+          - "start"
+          - "--provider.name=kubernetes"
+          - "--server.port=10000"
+          - "--storage.file=/dev/shm/state.json"
+        ports:
+          - containerPort: 10000
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: [ALL]
+          readOnlyRootFilesystem: true
+          seccompProfile:
+            type: RuntimeDefault
+      securityContext:
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+# --configFile=path/to/myconfigfile.yml 
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sablier
+spec:
+  selector:
+    app.kubernetes.io/name: sablier
+  ports:
+    - protocol: TCP
+      port: 10000
+      targetPort: 10000
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sablier
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: sablier
+#  namespace: {{ traefik_namespace }}
+rules:
+  - apiGroups:
+      - apps
+      - ""
+    resources:
+      - deployments
+      - statefulsets
+    verbs:
+      - get     # Retrieve info about specific dep
+      - list    # Events
+      - watch   # Events
+  - apiGroups:
+      - apps
+      - ""
+    resources:
+      - deployments/scale
+      - statefulsets/scale
+    verbs:
+      - patch   # Scale up and down
+      - get     # Retrieve info about specific dep
+      - update  # Scale up and down
+      - list    # Events
+      - watch   # Events
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: sablier
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: sablier
+subjects:
+  - kind: ServiceAccount
+    name: sablier
+    namespace: {{ traefik_namespace }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-traefik-to-sablier
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: sablier
+  ingress:
+  - ports:
+    - port: 10000
+    from:
+    - podSelector:
+        matchLabels:
+          app.kubernetes.io/name: traefik
+  policyTypes:
+  - Ingress
+#---
+#apiVersion: traefik.io/v1alpha1
+#kind: Middleware
+#metadata:
+#  name: ondemand
+#spec:
+#  plugin:
+#      names: toto                                              # Comma separated names of containers/services/deployments etc.
+#      group: default                                           # Group name to use to filter by label, ignored if names is set
+#      dynamic:
+#        displayName: My Title                                  # (Optional) Defaults to the middleware name
+#        refreshFrequency: 5s                                    # (Optional) The loading page refresh frequency
+#        showDetails: "true"                                    # (Optional) Set to true or false to show details specifcally for this middleware, unset to use Sablier server defaults
+#        theme: hacker-terminal                                  # (Optional) The theme to use
+#      sablierUrl: http://sablier.{{ traefik_namespace }}:10000 # The sablier URL service, must be reachable from the Traefik instance
+#      sessionDuration: 1m                                      # The session duration after which containers/services/deployments instances are shutdown
+

templates/traefik-svc.yml.j2

@@ -9,15 +9,23 @@ metadata:
 spec:
   ports:
   - name: web
-    hostPort: 80
     port: 80
     protocol: TCP
     targetPort: web
   - name: websecure
-    hostPort: 443
     port: 443
     protocol: TCP
     targetPort: websecure
+  - name: websecure-http3
+    port: 443
+    protocol: UDP
+    targetPort: websecure
+{% if traefik_external_ips is defined %}
+  externalIPs:
+{% for traefik_external_ip in traefik_external_ips %}
+    - {{ traefik_external_ip }}
+{% endfor %}
+{% endif %}
   selector:
     app.kubernetes.io/instance: traefik
     app.kubernetes.io/name: traefik

todo.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+cat << 'EOF' | kubectl --context my_context  apply -f -
+---
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+  name: traefik
+spec:
+  controller: traefik.io/ingress-controller
+EOF
+

vars/main.yml

@@ -1,12 +1 @@
-
+---
-traefik_version_2_3: 2.3.7
-traefik_2_3_list:
-  - 2.3/traefik-crd-ingressroutes.yml.j2
-  - 2.3/traefik-crd-ingressroutetcps.yml.j2
-  - 2.3/traefik-crd-ingressrouteudps.yml.j2
-  - 2.3/traefik-crd-middlewares.yml.j2
-  - 2.3/traefik-crd-tlsoptions.yml.j2
-  - 2.3/traefik-crd-tlsstores.yml.j2
-  - 2.3/traefik-crd-traefikservices.yml.j2
-  - 2.3/traefik-clusterrole.yml.j2
-  - 2.3/traefik-clusterrolebinding.yml.j2