Traefik Helm Chart

hub-manager is a self-hosted control plane for Traefik Hub. It allows you to replace the Traefik SaaS platform (platform.hub.traefik.io) by running the control plane inside your own Kubernetes cluster.

hub-manager stores its state in a PostgreSQL database and is accessed by Traefik instances via a Kubernetes Service. To link Traefik to your hub-manager, you must use an offline license token shared by both components.

The values.yaml file is optimized for user experience rather than strict structural mirroring.

• The structure of values.yaml does not need to match the final templated configuration if a different structure is more user-friendly.
• Value names do not need to correspond exactly to the fields in the templates if it improves usability.

To maintain a clean and valid Helm chart, follow these whitespace and structure rules:

• Template Whitespace: Avoid extra whitespace in templates by using whitespace chomping in conditionals. Use the {{- syntax to remove trailing/leading whitespace.
• Values Structure: In the values.yaml file, separate different feature blocks by including an empty commented line between each primary key.

{{- if .Values }}
{{- end }}

When installing on Azure, you can use a static IP from a specific resource group.

A common pattern is using Traefik's native Let's Encrypt feature with Azure DNS for the ACME DNS challenge. This requires:

• Enabling persistence for ACME storage.
• Configuring certificatesResolvers with the azuredns provider.
• Setting up environment variables for Azure credentials (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, etc.).
• Using an initContainer to ensure correct permissions on the ACME JSON file.
• Providing an extraObjects Secret containing the Azure client secret.

service:
  spec:
    loadBalancerIP: "1.2.3.4"
  annotations:
    service.beta.kubernetes.io/azure-load-balancer-resource-group: myResourceGroup

To allow managed Prometheus on AKS to scrape Traefik metrics, enable the ServiceMonitor option.

When using Azure Monitor, set disableAPICheck: true to skip the default CRD check, and specify the correct apiVersion (typically azmonitoring.coreos.com/v1) for both the serviceMonitor and prometheusRule.

metrics:
  prometheus:
    service:
      enabled: true
    # Set to true when using Azure Monitor to skip the CRD check (monitoring.coreos.com/v1)
    disableAPICheck: true
    serviceMonitor:
      enabled: true
      # Defaults to monitoring.coreos.com/v1
      apiVersion: "azmonitoring.coreos.com/v1"
    prometheusRule:
      # Defaults to monitoring.coreos.com/v1
      apiVersion: "azmonitoring.coreos.com/v1"

You can install Traefik on Google Cloud Platform (GCP) using three different methods depending on your networking requirements:

1. Regional IP with a Service: Use a static regional IP assigned to the LoadBalancer service.
2. Global IP on Ingress: Use a global static IP via a Kubernetes Ingress resource.
3. Global IP on a Gateway: Use the Kubernetes Gateway API with a global external managed gateway and continuous HTTPS encryption.

Note that for the Gateway API approach, you must include extraObjects to define the Gateway, HTTPRoute, and a HealthCheckPolicy to ensure proper connectivity.

# Example: Regional IP with a Service
service:
  spec:
    loadBalancerIP: "1.2.3.4"

To test or develop plugins locally without a public registry, you can load them from your filesystem.

Warning: The legacy hostPath configuration is deprecated. You should use the structured experimental.localPlugins.<name>.type configuration instead.

# Legacy Configuration (DEPRECATED)
experimental:
  localPlugins:
    legacy-demo:
      moduleName: github.com/traefik/legacydemo
      mountPath: /plugins-local/src/github.com/traefik/legacydemo
      hostPath: /path/to/plugin-source  # ⚠️ Deprecated - use type: hostPath instead

The dashboard is not exposed by default. To access it locally without exposing it to the internet:

1. Enable the dashboard IngressRoute in your values:

   ingressRoute:
   dashboard:
    enabled: true

2. Use `kubectl port-forward` to tunnel the admin port (8080) to your local machine.

NAMESPACE=traefik
kubectl port-forward $(kubectl get pods --selector "app.kubernetes.io/name=traefik" --output=name -n $NAMESPACE) 8080:8080 -n $NAMESPACE

Access it at: http://127.0.0.1:8080/dashboard/ (Note: the trailing slash is required).

To use the localPath plugin type, you must first define the volume in deployment.additionalVolumes and then reference it in experimental.localPlugins using the volumeName key.

deployment:
  additionalVolumes:
    - name: plugin-storage
      persistentVolumeClaim:
        claimName: plugin-storage-pvc

experimental:
  localPlugins:
    s3-plugin:
      moduleName: github.com/example/s3plugin
      mountPath: /plugins-local/src/github.com/example/s3plugin
      type: localPath
      volumeName: plugin-storage
      subPath: plugins/s3plugin