unkinben
44cc3d847d
Traefik matches Gateway listener ports against entryPoint internal ports. websecure was on 8443 so port 443 listeners were rejected as PortUnavailable. Change websecure to listen on 443 and add NET_BIND_SERVICE capability to allow binding to privileged ports as a non-root user.
97 lines
1.7 KiB
YAML
97 lines
1.7 KiB
YAML
image:
|
|
tag: v3.7.0
|
|
|
|
|
|
podDisruptionBudget:
|
|
enabled: true
|
|
maxUnavailable: 1
|
|
|
|
gateway:
|
|
enabled: false
|
|
|
|
gatewayClass:
|
|
enabled: false
|
|
|
|
updateStrategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 1
|
|
|
|
providers:
|
|
kubernetesCRD:
|
|
enabled: false
|
|
kubernetesIngress:
|
|
enabled: false
|
|
kubernetesGateway:
|
|
enabled: true
|
|
experimentalChannel: false
|
|
namespaces: []
|
|
nativeLBByDefault: false
|
|
labelSelector: "traefik.io/instance=internal"
|
|
|
|
logs:
|
|
access:
|
|
enabled: true
|
|
|
|
global:
|
|
checkNewVersion: true
|
|
sendAnonymousUsage: false
|
|
notAppendXForwardedFor: false
|
|
|
|
service:
|
|
enabled: true
|
|
single: true
|
|
annotations:
|
|
purelb.io/service-group: "common"
|
|
purelb.io/addresses: 198.18.200.4
|
|
annotationsTCP: {}
|
|
annotationsUDP: {}
|
|
labels: {}
|
|
spec:
|
|
type: LoadBalancer
|
|
loadBalancerIP: "198.18.200.4"
|
|
additionalServices: {}
|
|
|
|
autoscaling:
|
|
enabled: true
|
|
minReplicas: 2
|
|
maxReplicas: 5
|
|
metrics: []
|
|
behavior: {}
|
|
scaleTargetRef:
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
name: "{{ template \"traefik.fullname\" . }}"
|
|
|
|
persistence:
|
|
enabled: false
|
|
|
|
affinity:
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: '{{ template "traefik.name" . }}'
|
|
app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
podSecurityContext:
|
|
runAsGroup: 65532
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
add: [NET_BIND_SERVICE]
|
|
readOnlyRootFilesystem: true
|
|
|
|
ports:
|
|
websecure:
|
|
port: 443
|
|
|
|
enabled: true
|