apiVersion: helm.cattle.io/v1 kind: HelmChartConfig metadata: name: traefik namespace: kube-system spec: failurePolicy: abort valuesContent: | logs: general: level: INFO providers: kubernetesCRD: enabled: true allowCrossNamespace: true allowExternalNameServices: true # ingressClass: traefik-internal # labelSelector: environment=production,method=traefik namespaces: - "default" - "kube-system" kubernetesIngress: enabled: true allowExternalNameServices: true allowEmptyServices: true # ingressClass: traefik-internal # labelSelector: environment=production,method=traefik namespaces: - "default" - "kube-system" # IP used for Kubernetes Ingress endpoints publishedService: enabled: true # Published Kubernetes Service to copy status from. Format: namespace/servicename # By default this Traefik service # pathOverride: "" service: enabled: true type: LoadBalancer annotations: "load-balancer.hetzner.cloud/name": "clank" # make hetzners load-balancer connect to our nodes via our private k3s "load-balancer.hetzner.cloud/use-private-ip": "true" # keep hetzner-ccm from exposing our private ingress ip, which in general isn't routeable from the public internet "load-balancer.hetzner.cloud/disable-private-ingress": "true" # disable ipv6 by default, because external-dns doesn't support AAAA for hcloud yet https://github.com/kubernetes-sigs/external-dns/issues/2044 "load-balancer.hetzner.cloud/ipv6-disabled": "true" "load-balancer.hetzner.cloud/location": "fsn1" "load-balancer.hetzner.cloud/type": "lb11" "load-balancer.hetzner.cloud/uses-proxyprotocol": "true" additionalArguments: - "--entryPoints.web.proxyProtocol.trustedIPs=127.0.0.1/32,10.0.0.0/8" - "--entryPoints.websecure.proxyProtocol.trustedIPs=127.0.0.1/32,10.0.0.0/8" - "--entryPoints.web.forwardedHeaders.trustedIPs=127.0.0.1/32,10.0.0.0/8" - "--entryPoints.websecure.forwardedHeaders.trustedIPs=127.0.0.1/32,10.0.0.0/8" - "--providers.kubernetescrd.allowCrossNamespace=true"