.drone.yml

@@ -1,7 +1,7 @@
 ---
 kind: pipeline
 type: kubernetes
-# type: docker
+#type: docker
 name: default
 
 steps:

defaults/main.yml

@@ -1,29 +1,19 @@
 my_context: kubernetes
-traefik_version: "3.3.6"
+traefik_version: "2.3"
-traefik_helm_chart_version: "35.0.1"
+traefik_domain: "local"
-traefikcrds_helm_chart_version: "1.6.0"
-cluster_domain: "local"
 traefik_namespace: "traefik"
-traefik_service_type: LoadBalancer
+#ingress_whitelist:
-# ingress_whitelist:
+#  - 10.96.0.0/12
-#   - 10.96.0.0/12
+#  - 10.244.0.0/16
-#   - 10.244.0.0/16
+#  - 192.168.0.0/24
-#   - 192.168.0.0/24
+#traefik_node_selector:
-# traefik_node_selector:
+#  - localhost
-#   - localhost
 traefik_cpu_limit: 500m
 traefik_memory_limit: 300Mi
-traefik_entrypoints: []
+traefik_entrypoints:
-#     - { name: "http", port: 8000, proto: "TCP", hostport: 80 middlewares: ["{{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd"] }
+    - { name: "http", port: 8000, proto: "TCP", hostport: 80 }
-#     - { name: "https", port: 4443, proto: "TCP", hostport: 443, tls: true middlewares: ["{{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd"] }
+    - { name: "https", port: 4443, proto: "TCP", hostport: 443, tls: true }
-#     - { name: "traefik", port: 8080, proto: "TCP" }
+    - { name: "traefik", port: 8080, proto: "TCP" }
-# traefik_external_ips: []
-#    - 1.2.3.4
 
 basic_auth: false
-# traefik_dashboard_certificate: wildcard-cluster
+#traefik_dashboard_certificate: wildcard-cluster
-
-crowdsec_namespace: "crowdsec"
-crowdsec_traefik_bouncer_chart_version: "0.1.3"
-
-traefik_sabblier_version: "1.9.0"

meta/main.yml

@@ -6,8 +6,8 @@ galaxy_info:
   galaxy_tags: []
   license: GPL2
   collections:
-    - kubernetes.core
+    - community.kubernetes
   platforms:
-    - name: kubernetes
+  - name: kubernetes
-      version:
+    version:
-        - all
+    - all

tasks/main.yml

@@ -1,257 +1,134 @@
 - name: traefik setup
   block:
-#    - name: Deploy Traefik CRDs
+  - name: namespace
-#      kubernetes.core.k8s:
+    k8s:
-#        state: present
+      state: present
-#        context: "{{ my_context }}"
+      context: "{{ my_context }}"
-#        apply: true
+      merge_type: merge
-#        definition: "{{ lookup('url', item , split_lines=False) | from_yaml_all }}"
+      definition:
-#      with_items:
+        api_version: v1
-##        - "https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml"
+        kind: Namespace
-#        - "https://raw.githubusercontent.com/traefik/traefik/v3.2/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml"
+        metadata:
-##        - "https://raw.githubusercontent.com/traefik/traefik/v3.2/docs/content/reference/dynamic-configuration/kubernetes-crd-rbac.yml"
+          name: traefik
-##      ansible.builtin.command: >
+          labels:
-##        kubectl --context "{{ my_context }}" apply --server-side --force-conflicts -k
+            namespace: '{{ traefik_namespace }}'
-##        https://github.com/traefik/traefik-helm-chart/tree/v{{ traefik_helm_chart_version }}/traefik/crds/
-    - name: namespace
-      kubernetes.core.k8s:
-        state: present
-        context: "{{ my_context }}"
-        merge_type: merge
-        definition:
-          api_version: v1
-          kind: Namespace
-          metadata:
-            name: '{{ traefik_namespace }}'
-            labels:
-              namespace: '{{ traefik_namespace }}'
 
-    - name: Create a Secret object for basic authentification
+  - name: Create a Secret object for basic authentification
-      kubernetes.core.k8s:
+    k8s:
-        state: present
+      state: present
-        context: "{{ my_context }}"
+      context: "{{ my_context }}"
-        namespace: '{{ traefik_namespace }}'
+      definition:
-        definition:
+        apiVersion: v1
-          apiVersion: v1
+        kind: Secret
-          kind: Secret
+        metadata:
-          metadata:
+          name: basic-auth
+          namespace: '{{ traefik_namespace }}'
+        type: Opaque
+        data:
+          basic_auth: "{{ basic_auth_data | b64encode }}"
+    when:
+      - basic_auth|bool
+
+  - name: Add host label for traefik deployment
+    k8s:
+      state: present
+      context: "{{ my_context }}"
+      definition:
+        apiVersion: v1
+        kind: Node
+        metadata:
+          name: "{{ item }}"
+          labels:
+            entrypoint: traefik
+    with_items:
+      - '{{ traefik_node_selector }}'
+    when:
+      - traefik_node_selector is defined
+
+#  - name: Get Deployment information object
+#    k8s_info:
+#      context: "{{ my_context }}"
+#      api_version: v1
+#      kind: DaemonSet
+#      name: traefik
+#      namespace: '{{ traefik_namespace }}'
+#      field_selectors:
+#        - spec.template.spec.containers.image
+#    register: traefik_actual_resources
+#
+#  - name: Retreive actual traefik version
+#    shell: echo "{{ traefik_actual_resources.resources }}" | sed "s/.*traefik:\([0-9]\.[0-9]*\).*/\1/" | uniq
+#    register: traefik_actual_version
+#
+#  - name: Remove old traefik version {{ traefik_actual_version.stdout }}
+#    k8s:
+#      state: "absent"
+#      context: "{{ my_context }}"
+#      resource_definition: "{{ lookup('template', item) | from_yaml }}"
+#    with_items:
+#      - "{{ lookup('vars', 'traefik_' + traefik_actual_version.stdout | regex_replace('[.]','_') + '_list') | reverse | list }}"
+##      - hostvars[inventory_hostname]['traefik_' + traefik_actual_version.stdout + '_list'] | reverse
+#    when:
+#      - not traefik_actual_version.stdout == "[]"
+#      - not traefik_version == traefik_actual_version.stdout
+#      - traefik_actual_version.stdout is version(traefik_version, '>')
+
+  - name: Defined traefik repository
+    community.kubernetes.helm_repository:
+      name: traefik
+      repo_url: "https://helm.traefik.io/traefik"
+    tags: traefik
+  - name: Deploy latest version of Traefik
+    community.kubernetes.helm:
+      name: traefik
+      chart_ref: traefik/traefik
+      release_namespace: traefik
+      values:
+        image:
+          tag: "{{ traefik_version_2_3 }}"
+        additionalArguments:
+          - --configFile=/etc/traefik/traefik.yaml
+        podSecurityPolicy:
+          enabled: true
+        service:
+          enabled: false
+        ingressRoute:
+          dashboard:
+            enabled: false
+        ingressClass:
+          enabled: true
+          isDefaultClass: true
+        ports:
+          web:
+            redirectTo: websecure
+            hostPort: 80
+          websecure:
+            hostPort: 443
+        volumes:
+          - mountPath: /etc/traefik
+            name: traefik-conf
+            type: configMap
+          - mountPath: /etc/traefik/file
+            name: traefik-files
+            type: configMap
+          - mountPath: /etc/traefik/basic-auth
             name: basic-auth
-          type: Opaque
+            type: secret
-          data:
-            basic_auth: "{{ basic_auth_data | b64encode }}"
-      when:
-        - basic_auth|bool
 
-    - name: Add host label for traefik deployment
+  - name: Install traefik configuration
-      kubernetes.core.k8s:
+    k8s:
-        state: present
+      state: "present"
-        context: "{{ my_context }}"
+      context: "{{ my_context }}"
-        definition:
+      namespace: '{{ traefik_namespace }}'
-          apiVersion: v1
+#      merge_type: merge
-          kind: Node
+      apply: yes
-          metadata:
+      resource_definition: "{{ lookup('template', item) | from_yaml }}"
-            name: "{{ item }}"
+    with_items:
-            labels:
+#      - "{{ lookup('vars', 'traefik_' + traefik_version | regex_replace('[.]','_') + '_list') }}"
-              entrypoint: traefik
+      - traefik-cm.yml.j2
-      with_items:
+      - traefik-files.yml.j2
-        - '{{ traefik_node_selector }}'
+#      - traefik-sa.yml.j2
-      when:
+      - traefik-ingressroute.yml.j2
-        - traefik_node_selector is defined
+      - traefik-svc.yml.j2
-
-    - name: Deploy latest version of CrowdSec Traefik bouncer
-      kubernetes.core.helm:
-        context: "{{ my_context }}"
-        name: crowdsec-traefik-bouncer
-        release_namespace: "{{ traefik_namespace }}"
-        create_namespace: true
-        chart_ref: crowdsec/crowdsec-traefik-bouncer
-        chart_version: "{{ crowdsec_traefik_bouncer_chart_version }}"
-        values:
-          image:
-            tag: "0.5.0"
-          bouncer:
-            crowdsec_bouncer_api_key: "{{ traefik_crowdsec_bouncer_apikey }}"
-            crowdsec_agent_host: "crowdsec-service.{{ crowdsec_namespace }}.svc.cluster.local:8080"
-            crowdsec_bouncer_gin_mode: "release"
-          replicaCount: 1
-          podSecurityContext:
-            fsGroup: 2000
-          securityContext:
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            runAsUser: 1000
-      when:
-        - traefik_crowdsec_bouncer_apikey is defined
-
-#    - name: Get Deployment information object
-#      kubernetes.core.k8s_info:
-#        context: "{{ my_context }}"
-#        api_version: v1
-#        kind: DaemonSet
-#        name: traefik
-#        namespace: '{{ traefik_namespace }}'
-#        field_selectors:
-#          - spec.template.spec.containers.image
-#      register: traefik_actual_resources
-#
-#    - name: Retreive actual traefik version
-#      ansible.builtin.shell: echo "{{ traefik_actual_resources.resources }}" | sed "s/.*traefik:\([0-9]\.[0-9]*\).*/\1/" | uniq
-#      register: traefik_actual_version
-#
-#    - name: Remove old traefik version {{ traefik_actual_version.stdout }}
-#      kubernetes.core.k8s:
-#        state: "absent"
-#        context: "{{ my_context }}"
-#        resource_definition: "{{ lookup('template', item) | from_yaml }}"
-#      with_items:
-#        - "{{ lookup('vars', 'traefik_' + traefik_actual_version.stdout | regex_replace('[.]','_') + '_list') | reverse | list }}"
-##        - hostvars[inventory_hostname]['traefik_' + traefik_actual_version.stdout + '_list'] | reverse
-#      when:
-#        - not traefik_actual_version.stdout == "[]"
-#        - not traefik_version == traefik_actual_version.stdout
-#        - traefik_actual_version.stdout is version(traefik_version, '>')
-
-# https://github.com/traefik/traefik-helm-chart
-    - name: Defined traefik repository
-      kubernetes.core.helm_repository:
-        name: traefik
-        repo_url: "https://helm.traefik.io/traefik"
-    - name: Deploy Traefik CRDs
-      kubernetes.core.helm:
-        context: "{{ my_context }}"
-        name: traefik-crds
-        chart_ref: traefik/traefik-crds
-        chart_version: "{{ traefikcrds_helm_chart_version }}"
-        release_namespace: "{{ traefik_namespace }}"
-        create_namespace: true
-#    - name: show templating results
-#      ansible.builtin.debug:
-#        msg: "{{ lookup('ansible.builtin.template', 'traefik-helm-value.yaml.j2') }}"
-    - name: Deploy latest version of Traefik
-      kubernetes.core.helm:
-        context: "{{ my_context }}"
-        name: traefik
-        chart_ref: traefik/traefik
-        chart_version: "{{ traefik_helm_chart_version }}"
-        release_namespace: "{{ traefik_namespace }}"
-        create_namespace: true
-        skip_crds: true
-        values: "{{ lookup('template', 'traefik-helm-value.yaml.j2') | from_yaml }}"
-
-    - name: Install traefik configuration
-      kubernetes.core.k8s:
-        state: "present"
-        context: "{{ my_context }}"
-        namespace: '{{ traefik_namespace }}'
-#        merge_type: merge
-        apply: true
-        resource_definition: "{{ lookup('template', item) | from_yaml_all }}"
-      with_items:
-        - default-network-dns-policy.yaml.j2
-#        - "{{ lookup('vars', 'traefik_' + traefik_version | regex_replace('[.]','_') + '_list') }}"
-        - traefik-certificate.yml.j2
-        - traefik-cm.yml.j2
-        - traefik-files.yml.j2
-#        - traefik-sa.yml.j2
-        - traefik-ingressroute.yml.j2
-#        - traefik-svc.yml.j2
-#        - traefik-defaultbackend.yml.j2
-
-    - name: Install traefik plugin's
-      kubernetes.core.k8s:
-        state: "present"
-        context: "{{ my_context }}"
-        namespace: '{{ traefik_namespace }}'
-#        merge_type: merge
-        apply: true
-        resource_definition: "{{ lookup('template', item) | from_yaml_all }}"
-      with_items:
-        - traefik-ondemand-plugin.yml.j2
-      when:
-        - traefik_ondemand is defined
-
-    - name: ReInstall traefik-hub certificate if already know
-      kubernetes.core.k8s:
-        state: "present"
-        context: "{{ my_context }}"
-        namespace: '{{ traefik_namespace }}'
-#        merge_type: merge
-#        apply: true
-        resource_definition: "{{ lookup('template', item) | from_yaml_all }}"
-      with_items:
-        - traefik-hub-certificate.yml.j2
-      when:
-        - traefik_hub_tlscrt is defined
-        - traefik_hub_tlskey is defined
-    - name: Defined traefik-hub repository
-      kubernetes.core.helm_repository:
-        name: traefik-hub
-        repo_url: "https://helm.traefik.io/hub"
-      when:
-        - traefik_hub_token is defined
-    - name: Deploy latest version of Traefik-hub
-      kubernetes.core.helm:
-        context: "{{ my_context }}"
-        name: hub-agent
-        chart_ref: traefik-hub/hub-agent
-        release_namespace: "{{ traefik_namespace }}"
-        values:
-          token: "{{ traefik_hub_token }}"
-      when:
-        - traefik_hub_token is defined
-
-# echo 'apiVersion: v1
-# kind: Service
-# metadata:
-#   annotations:
-# #    external-dns.alpha.kubernetes.io/endpoints-type: HostIP
-#     external-dns.alpha.kubernetes.io/hostname: traefik.ibm.reslinger.net
-#     external-dns.alpha.kubernetes.io/endpoints-type: NodeExternalIP
-# #    external-dns.alpha.kubernetes.io/target: "1.2.3.4"
-#   name: traefik-dns
-#   namespace: traefik
-# spec:
-#   clusterIP: None
-#   ports:
-#   - name: web
-#     port: 80
-#     protocol: TCP
-#     targetPort: web
-#   - name: websecure
-#     port: 443
-#     protocol: TCP
-#     targetPort: websecure
-#   selector:
-#     app.kubernetes.io/instance: traefik-traefik
-#     app.kubernetes.io/name: traefik' | kubectl --context kubeibm -n traefik apply -f -
-
-#     - name: Deploy latest version of Switchboard
-#       kubernetes.core.helm:
-#         context: "{{ my_context }}"
-#         name: switchboard
-#         chart_ref: oci://ghcr.io/borchero/charts/switchboard
-#         release_namespace: "{{ traefik_namespace }}"
-# #        values: "{{ lookup('template', 'traefik-helm-value.yaml.j2') | from_yaml }}"
-#         values:
-#           integrations:
-# #            certManager:
-# #              enabled: true
-# #              issuer: "letsencrypt-prod"
-#             externalDNS:
-#               enabled: true
-#               targetIPs: [10.144.217.172]
-
-    - name: Install traefik grafana dashboard
-      kubernetes.core.k8s:
-        state: "present"
-        context: "{{ my_context }}"
-        namespace: 'traefik'
-        apply: yes
-        resource_definition: "{{ lookup('file', item) | from_yaml_all }}"
-      with_items:
-        - grafana-dashboard.yml
 
   tags: traefik

templates/default-network-dns-policy.yaml.j2

@@ -1,46 +0,0 @@
-kind: NetworkPolicy
-apiVersion: networking.k8s.io/v1
-metadata:
-  name: intra-namespace
-spec:
-  podSelector: {}
-  ingress:
-    - from:
-      - namespaceSelector:
-          matchLabels:
-            name: {{ traefik_namespace }}
-
-#---
-#apiVersion: networking.k8s.io/v1
-#kind: NetworkPolicy
-#metadata:
-#  name: allow-dns-access
-#spec:
-#  podSelector:
-#    matchLabels: {}
-#  policyTypes:
-#  - Egress
-#  egress:
-#  - to:
-#    - namespaceSelector:
-#        matchLabels:
-#          kubernetes.io/metadata.name: kube-system
-#      podSelector:
-#        matchLabels:
-#          k8s-app: kube-dns
-#    ports:
-#    - protocol: UDP
-#      port: 53
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-all-traefik-v121-ingress
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: traefik
-  ingress:
-  - {}
-  policyTypes:
-  - Ingress

templates/traefik-certificate.yml.j2

@@ -1,12 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: traefik.{{ cluster_domain }}
-spec:
-  dnsNames:
-  - traefik.{{ cluster_domain }}
-  issuerRef:
-    name: letsencrypt-prod
-    kind: ClusterIssuer
-  secretName: traefik.{{ cluster_domain }}

templates/traefik-cm.yml.j2

@@ -15,111 +15,49 @@ data:
       web:
         address: ":8000/tcp"
         http:
-    #      middlewares:
-    #        - auth@file
-    #        - secure_headers@file
-    #        - crowdsec-bouncer@file
-    #        - {{ traefik_namespace }}-crowdsec-traefik-bouncer@kubernetescrd
           redirections:
             entryPoint:
               to: websecure
               scheme: https
-              permanent: true
       websecure:
-        address: ":8443"
+        address: ":8443/tcp"
         http:
           tls:
             options: default
-    #      middlewares:
-    #        - auth@file
-    #        - secure_headers@file
-    #        - crowdsec-bouncer@file
-        http3:
-          advertisedPort: 443
       traefik:
-        address: ":8080/tcp"
+        address: ":9000/tcp"
-      metrics:
-        address: ":9100/tcp"
-{% if traefik_hub_token is defined %}
-      traefikhub-api:
-        address: ":9900"
-      traefikhub-tunl:
-        address: ":9901/tcp"
-{% endif%}
 {% for traefik_entrypoint in traefik_entrypoints %}
       {{ traefik_entrypoint.name }}:
-{% if traefik_entrypoint.proto is defined %}
+        address: :{{ traefik_entrypoint.port }}
-        address: ":{{ traefik_entrypoint.port }}/{{ traefik_entrypoint.proto | lower }}"
-{% else %}
-        address: ":{{ traefik_entrypoint.port }}"
-{% endif %}
-{% if traefik_entrypoint.tls is defined or traefik_entrypoint.middlewares is defined %}
-        http:
-{% if traefik_entrypoint.middlewares is defined %}
-          middlewares:
-{% for middleware in traefik_entrypoint.middlewares %}
-            - {{ middleware }}
-{% endfor %}
-{% endif %}
 {% if traefik_entrypoint.tls is defined and traefik_entrypoint.tls|bool %}
+        http:
           tls: {}
 {% endif %}
-{% endif %}
 {% endfor %}
     providers:
       kubernetesCRD:
     #    ingressClass: "traefik"
         throttleDuration: 2s
-{% if traefik_ondemand is defined %}
-        allowEmptyServices: true
-{% endif%}
       kubernetesIngress:
         ingressClass: "traefik"
-{% if traefik_hub_token is defined %}
-        allowExternalNameServices: true
-{% endif%}
-{% if traefik_ondemand is defined %}
-        allowEmptyServices: true
-{% endif%}
-      kubernetesGateway: {}
       file:
         directory: /etc/traefik/file/
         watch: true
     metrics:
       prometheus:
-        entryPoint: metrics
+        entryPoint: traefik
-        addRoutersLabels: true
     ping:
       entryPoint: traefik
     api:
       dashboard: true
-{% if traefik_hub_token is defined %}
-    hub: {}
-{% endif %}
     log:
-      level: ERROR
+      level: WARN
-    #  format: json
+      format: json
-    accessLog: {}
+    accessLog:
-    #accessLog:
+      format: json
-    #  filePath: "/var/log/traefik/access.log"
+      fields:
-    #  bufferingSize: 50
+        names:
-    ##  format: json
+          BackendAddr: keep
-    ##  fields:
+          BackendName: keep
-    ##    names:
+          BackendURL: keep
-    ##      BackendAddr: keep
+          FrontendName: keep
-    ##      BackendName: keep
-    ##      BackendURL: keep
-    ##      FrontendName: keep
-{% if traefik_hub_token is defined or traefik_ondemand is defined %}
-    experimental:
-    #  kubernetesGateway: true
-{% if traefik_hub_token is defined %}
-      hub: true
-{% endif %}
-{% if traefik_ondemand is defined %}
-      plugins:
-        sablier:
-          moduleName: github.com/sablierapp/sablier
-          version: v{{ traefik_sabblier_version }}
-{% endif %}
-{% endif %}

templates/traefik-defaultbackend.yml.j2

@@ -1,16 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: cheese
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-    traefik.ingress.kubernetes.io/router.priority: "1"
-    traefik.ingress.kubernetes.io/router.middlewares: security_headers@file,compress@file
-
-spec:
-  defaultBackend:
-    service:
-      name: stilton
-      port:
-        number: 80

templates/traefik-files.yml.j2

@@ -7,21 +7,6 @@ data:
   traefik-middlewares.yaml: |
     http:
       middlewares:
-        min_security:
-          chain:
-            middlewares:
-              - security_headers
-{% if ingress_whitelist is defined %}
-              - traefik-ipwhitelist
-{% endif %}
-              - rate-limit
-              - compress
-{% if false %}
-{% if basic_auth|bool %}
-              - basic-auth
-{% endif %}
-              - authelia
-{% endif %}
         compress:
           compress:
             excludedContentTypes: ["text/event-stream"]
@@ -32,7 +17,7 @@ data:
         security_headers:
           headers:
             accessControlAllowMethods: ["GET", "OPTIONS", "PUT"]
-    #        accessControlAllowOrigin: "origin-list-or-null"
+            accessControlAllowOrigin: "origin-list-or-null"
             accessControlMaxAge: 100
             addVaryHeader: true
             browserXssFilter: true
@@ -43,15 +28,13 @@ data:
             stsPreload: true
             customFrameOptionsValue: "SAMEORIGIN"
             referrerPolicy: "same-origin"
-    #        permissionsPolicy: "vibrate 'self'"
+            featurePolicy: "vibrate 'self'"
-            permissionsPolicy: "camera 'none'; microphone 'none'; geolocation 'none'; payment 'none';"
             stsSeconds: 315360000
-    #        contentSecurityPolicy: "default-src 'self' 'unsafe-inline'"
+            sslRedirect: true
+            contentSecurityPolicy: "default-src 'self' 'unsafe-inline'"
     #        customResponseHeaders:
     #          X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex,"
     #          server: ""
-            hostsProxyHeaders:
-              - "X-Forwarded-Host"
 {% if ingress_whitelist is defined %}
         traefik-ipwhitelist:
           ipWhiteList:
@@ -60,19 +43,6 @@ data:
               - {{ acl_whitelist }}
 {% endfor %}
 {% endif %}
-{% if traefik_ondemand is defined %}
-        ondemand:
-          plugin:
-            sablier:
-              #group: default
-              dynamic:
-                displayName: Application is starting
-                refreshFrequency: 5s
-                showDetails: "true"
-                theme: hacker-terminal
-              sablierUrl: http://sablier:10000
-              sessionDuration: 1m
-{% endif %}
 {% if basic_auth|bool %}
         basic-auth:
           basicAuth:
@@ -85,30 +55,7 @@ data:
           forwardAuth:
             address: "http://authelia:9091/api/verify?rd=https://login.example.com/"
             trustForwardHeader: true
-            authResponseHeaders:
+            authReponseHeaders: ["Remote-User", "Remote-Groups", "Remote-Name", "Remote-Email"]
-              - "Remote-User"
-              - "Remote-Groups"
-              - "Remote-Name"
-              - "Remote-Email"
-        authelia-basic:
-          forwardAuth:
-            address: "http://authelia:9091/api/verify?auth=basic"
-            trustForwardHeader: true
-            authResponseHeaders:
-              - "Remote-User"
-              - "Remote-Groups"
-              - "Remote-Name"
-              - "Remote-Email"
-        crowdsec-bouncer:
-          forwardAuth:
-            address: "http://crowdsec-traefik-bouncer-service/api/v1/forwardAuth"
-            trustForwardHeader: true
-
-  traefik-servers-transport.yaml: |
-    http:
-      serversTransports:
-        skip-verify-https-backend:
-          insecureSkipVerify: true
 
   traefik-tls-defaults-options.yaml: |
     tls:
@@ -123,33 +70,3 @@ data:
               - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
               - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
               - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
-            alpnProtocols:
-              - h2
-              - http/1.1
-{% if false %}
-      stores:
-        default:
-          defaultCertificate:
-            certFile: path/to/wildcardcert.crt
-            keyFile: path/to/wildcardcert.key
-
-      certificates:
-      - certFile: /path/to/domain.cert
-        keyFile: /path/to/domain.key
-      - certFile: /path/to/other-domain.cert
-        keyFile: /path/to/other-domain.key
-{% endif %}
-
-#  dashboard.yaml: |
-#    http:
-#      routers:
-#        traefik:
-#          rule: "Host(`traefik.{{ domain | lower }}`)"
-#          entryPoints:
-#            - "websecure"
-#          middlewares:
-#            - "min_security@file"
-#{% if basic_auth|bool %}
-#            - "basic-auth@file"
-#{% endif %}
-#          service: "api@internal"

templates/traefik-helm-value.yaml.j2

@@ -1,184 +0,0 @@
-# https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml
-{% if traefik_version is defined %}
-image:
-  tag: "{{ traefik_version }}"
-{% endif %}
-#fullnameOverride: "{{ my_context }}"
-additionalArguments:
-  - --configFile=/etc/traefik/traefik.yaml
-#podSecurityPolicy:
-#  enabled: true
-service:
-  type: {{ traefik_service_type }}
-{% if traefik_external_ips is defined %}
-  externalIPs:
-{% for external_ip in traefik_external_ips %}
-    - {{ external_ip }}
-{% endfor %}
-{% endif %}
-{% if traefik_service_type == "LoadBalancer" %}
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: traefik.{{ cluster_domain }}
-{% endif %}
-ingressRoute:
-  dashboard:
-    enabled: false
-podDisruptionBudget:
-  enabled: true
-  minAvailable: 1
-ingressClass:
-  enabled: true
-  isDefaultClass: true
-{% if false %}
-autoscaling:
-  enabled: true
-  minReplicas: 1
-  maxReplicas: 10
-  metrics:
-    - type: Resource
-      resource:
-        name: cpu
-        targetAverageUtilization: 60
-    - type: Resource
-      resource:
-        name: memory
-        targetAverageUtilization: 60
-{% endif %}
-{% if traefik_service_type == "NodePort" or (traefik_hostport is defined and traefik_hostport == true) or traefik_hub_token is defined %}
-ports:
-{% if traefik_service_type == "NodePort" or (traefik_hostport is defined and traefik_hostport == true) %}
-  web:
-#    redirectTo: websecure
-{% if traefik_hostport is defined and traefik_hostport == true %}
-    hostPort: 80
-{% endif %}
-{% if traefik_service_type == "NodePort" %}
-    nodePort: 80
-{% endif %}
-  websecure:
-{% if traefik_hostport is defined and traefik_hostport == true %}
-    hostPort: 443
-{% endif %}
-{% if traefik_service_type == "NodePort" %}
-    nodePort: 443
-{% endif %}
-    http3:
-      enabled: true
-      advertisedPort: 443
-#    tls:
-#      enabled: true
-#      options: default
-{% endif %}
-{% if traefik_hub_token is defined %}
-  traefikhub-tunl:
-    port: 9901
-    expose: true
-    exposedPort: 9901
-    protocol: "TCP"
-{% endif %}
-{% endif %}
-volumes:
-  - mountPath: /etc/traefik
-    name: traefik-conf
-    type: configMap
-  - mountPath: /etc/traefik/file
-    name: traefik-files
-    type: configMap
-  - mountPath: /etc/traefik/basic-auth
-    name: basic-auth
-    type: secret
-deployment:
-{% if traefik_hostport is defined and traefik_hostport == true %}
-  kind: DaemonSet
-{% else %}
-  replicas: 1
-{% endif %}
-  revisionHistoryLimit: 3
-#  podAnnotations: 
-#    prometheus.io/port: '9100'
-#    prometheus.io/scrape: 'true'
-#    prometheus.io/path: "/metrics"
-{% if traefik_hostport is defined and traefik_hostport == true %}
-updateStrategy:
-  type: OnDelete
-{% endif %}
-metrics:
-  prometheus:
-    service:
-      enabled: true
-    serviceMonitor:
-      metricRelabelings: []
-#      #  - sourceLabels: [__name__]
-#      #    separator: ;
-#      #    regex: ^fluentd_output_status_buffer_(oldest|newest)_.+
-#      #    replacement: $1
-#      #    action: drop
-      relabelings: []
-#      #  - sourceLabels: [__meta_kubernetes_pod_node_name]
-#      #    separator: ;
-#      #    regex: ^(.*)$
-#      #    targetLabel: nodename
-#      #    replacement: $1
-#      #    action: replace
-#      jobLabel: traefik
-#      interval: 30s
-#      honorLabels: true
-#      # (Optional)
-#      # scrapeTimeout: 5s
-#      # honorTimestamps: true
-#      # enableHttp2: true
-#      # followRedirects: true
-#      # additionalLabels:
-#      #   foo: bar
-#      # namespace: "another-namespace"
-#      # namespaceSelector: {}
-#     prometheusRule:
-#       enabled: true
-#       additionalLabels: {}
-#       namespace: "{{ traefik_namespace }}"
-#       rules:
-#         - alert: TraefikDown
-#           expr: up{job="traefik"} == 0
-#           for: 5m
-#           labels:
-#             context: traefik
-#             severity: warning
-#           annotations:
-#             summary: "Traefik Down"
-#             description: "{% raw %}{{ $labels.pod }} on {{ $labels.nodename }} is down{% endraw %}"
-experimental:
-{% if traefik_ondemand is defined %}
-  plugins:
-    sablier:
-      moduleName: "github.com/sablierapp/sablier"
-      version: "v1.8.1"
-{% endif %}
-{% if traefik_hub_token is defined %}
-  hub:
-    enabled: true
-{% endif %}
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop: [ALL]
-  readOnlyRootFilesystem: true
-  seccompProfile: 
-    type: RuntimeDefault
-{% if false %}
-{% raw %}
-extraObjects:
-  - apiVersion: v1
-    kind: ConfigMap
-    metadata:
-      name: "extra"
-    data:
-      something: "extra"
-  - |
-    apiVersion: v1
-    kind: ConfigMap
-    metadata:
-      name: "templated"
-    data:
-      something: {{ printf "templated" }}
-{% endraw %}
-{% endif %}

templates/traefik-hub-certificate.yml.j2

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: List
-items:
-- apiVersion: v1
-  kind: Secret
-  metadata:
-    annotations:
-      app.kubernetes.io/managed-by: traefik-hub
-    name: hub-certificate
-    namespace: {{ traefik_namespace }}
-  type: kubernetes.io/tls
-  data:
-    tls.crt: {{ traefik_hub_tlscrt | b64encode }}
-    tls.key: {{ traefik_hub_tlskey | b64encode }}

templates/traefik-ingressroute.yml.j2

@@ -1,29 +1,18 @@
-apiVersion: traefik.io/v1alpha1
+apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
   name: traefik
   labels:
     app: traefik
-  annotations:
-    kubernetes.io/ingress.class: traefik
-{% if false %}
-    external-dns.alpha.kubernetes.io/hostname: traefik.{{ cluster_domain }}
-    external-dns.alpha.kubernetes.io/endpoints-type: NodeExternalIP
-    # external-dns.alpha.kubernetes.io/endpoints-type: HostIP
-    # external-dns.alpha.kubernetes.io/target: "1.2.3.4"
-
-    # external-dns.alpha.kubernetes.io/ttl: "120"
-    # external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
-{% endif %}
 
 spec:
   entryPoints:
-    - websecure
+    - https
   routes:
   # Match is the rule corresponding to an underlying router.
   # Later on, match could be the simple form of a path prefix, e.g. just "/bar",
   # but for now we only support a traefik style matching rule.
-  - match: Host(`traefik.{{ cluster_domain }}`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
+  - match: Host(`traefik.{{ traefik_domain }}`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
     # kind could eventually be one of "Rule", "Path", "Host", "Method", "Header",
     # "Parameter", etc, to support simpler forms of rule matching, but for now we
     # only support "Rule".
@@ -31,31 +20,29 @@ spec:
 {% if basic_auth is defined or ingress_whitelist is defined %}
     middlewares:
 {% if ingress_whitelist is defined %}
-      - name: traefik-ipwhitelist@file
+      - name: traefik-ipwhitelist
 {% endif %}
 {% if basic_auth is defined %}
-      - name: basic-auth@file
+      - name: basic-auth
 {% endif %}
 {% endif %}
     services:
     - name: api@internal
       kind: TraefikService
-  - match: Host(`traefik.{{ cluster_domain }}`) && PathPrefix(`/ping`)
+  - match: Host(`traefik.{{ traefik_domain }}`) && PathPrefix(`/ping`)
     kind: Rule
     services:
     - name: ping@internal
       kind: TraefikService
-#  - match: Host(`traefik.{{ cluster_domain }}`) && PathPrefix(`/metrics`)
+  - match: Host(`traefik.{{ traefik_domain }}`) && PathPrefix(`/metrics`)
-#    kind: Rule
+    kind: Rule
-#    services:
+    services:
-#    - name: prometheus@internal
+    - name: prometheus@internal
-#      kind: TraefikService
+      kind: TraefikService
 
 
 
   tls:
 {% if traefik_dashboard_certificate is defined %}
     secretName: {{ traefik_dashboard_certificate }}
-{% else %}
-    secretName: traefik.{{ cluster_domain }}
 {% endif %}

templates/traefik-middleware-ipwhitelist.yml.j2

@@ -0,0 +1,12 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: traefik-ipwhitelist
+spec:
+  ipWhiteList:
+    sourceRange:
+{% if ingress_whitelist is defined %}
+{% for acl_whitelist in ingress_whitelist %}
+      - {{ acl_whitelist }}
+{% endfor %}
+{% endif %}

templates/traefik-ondemand-plugin.yml.j2

@@ -1,134 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: sablier
-  labels:
-    app.kubernetes.io/name: sablier
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: sablier
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: sablier
-    spec:
-      serviceAccountName: sablier
-      serviceAccount: sablier
-      containers:
-      - name: sablier
-        image: sablierapp/sablier:{{ traefik_sabblier_version }}
-        args:
-          - "start"
-          - "--provider.name=kubernetes"
-          - "--server.port=10000"
-          - "--storage.file=/dev/shm/state.json"
-        ports:
-          - containerPort: 10000
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop: [ALL]
-          readOnlyRootFilesystem: true
-          seccompProfile:
-            type: RuntimeDefault
-      securityContext:
-        runAsGroup: 65532
-        runAsNonRoot: true
-        runAsUser: 65532
-# --configFile=path/to/myconfigfile.yml 
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: sablier
-spec:
-  selector:
-    app.kubernetes.io/name: sablier
-  ports:
-    - protocol: TCP
-      port: 10000
-      targetPort: 10000
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: sablier
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: sablier
-#  namespace: {{ traefik_namespace }}
-rules:
-  - apiGroups:
-      - apps
-      - ""
-    resources:
-      - deployments
-      - statefulsets
-    verbs:
-      - get     # Retrieve info about specific dep
-      - list    # Events
-      - watch   # Events
-  - apiGroups:
-      - apps
-      - ""
-    resources:
-      - deployments/scale
-      - statefulsets/scale
-    verbs:
-      - patch   # Scale up and down
-      - get     # Retrieve info about specific dep
-      - update  # Scale up and down
-      - list    # Events
-      - watch   # Events
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: sablier
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: sablier
-subjects:
-  - kind: ServiceAccount
-    name: sablier
-    namespace: {{ traefik_namespace }}
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-traefik-to-sablier
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: sablier
-  ingress:
-  - ports:
-    - port: 10000
-    from:
-    - podSelector:
-        matchLabels:
-          app.kubernetes.io/name: traefik
-  policyTypes:
-  - Ingress
-#---
-#apiVersion: traefik.io/v1alpha1
-#kind: Middleware
-#metadata:
-#  name: ondemand
-#spec:
-#  plugin:
-#      names: toto                                              # Comma separated names of containers/services/deployments etc.
-#      group: default                                           # Group name to use to filter by label, ignored if names is set
-#      dynamic:
-#        displayName: My Title                                  # (Optional) Defaults to the middleware name
-#        refreshFrequency: 5s                                    # (Optional) The loading page refresh frequency
-#        showDetails: "true"                                    # (Optional) Set to true or false to show details specifcally for this middleware, unset to use Sablier server defaults
-#        theme: hacker-terminal                                  # (Optional) The theme to use
-#      sablierUrl: http://sablier.{{ traefik_namespace }}:10000 # The sablier URL service, must be reachable from the Traefik instance
-#      sessionDuration: 1m                                      # The session duration after which containers/services/deployments instances are shutdown
-

templates/traefik-svc.yml.j2

@@ -9,23 +9,15 @@ metadata:
 spec:
   ports:
   - name: web
+    hostPort: 80
     port: 80
     protocol: TCP
     targetPort: web
   - name: websecure
+    hostPort: 443
     port: 443
     protocol: TCP
     targetPort: websecure
-  - name: websecure-http3
-    port: 443
-    protocol: UDP
-    targetPort: websecure
-{% if traefik_external_ips is defined %}
-  externalIPs:
-{% for traefik_external_ip in traefik_external_ips %}
-    - {{ traefik_external_ip }}
-{% endfor %}
-{% endif %}
   selector:
     app.kubernetes.io/instance: traefik
     app.kubernetes.io/name: traefik

todo.sh

@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-
-cat << 'EOF' | kubectl --context my_context  apply -f -
----
-apiVersion: networking.k8s.io/v1
-kind: IngressClass
-metadata:
-  name: traefik
-spec:
-  controller: traefik.io/ingress-controller
-EOF
-

vars/main.yml

@@ -1 +1,12 @@
----
+
+traefik_version_2_3: 2.3.7
+traefik_2_3_list:
+  - 2.3/traefik-crd-ingressroutes.yml.j2
+  - 2.3/traefik-crd-ingressroutetcps.yml.j2
+  - 2.3/traefik-crd-ingressrouteudps.yml.j2
+  - 2.3/traefik-crd-middlewares.yml.j2
+  - 2.3/traefik-crd-tlsoptions.yml.j2
+  - 2.3/traefik-crd-tlsstores.yml.j2
+  - 2.3/traefik-crd-traefikservices.yml.j2
+  - 2.3/traefik-clusterrole.yml.j2
+  - 2.3/traefik-clusterrolebinding.yml.j2