feat(traefik): Clean up Traefik config after certs are handled by Cert-manager

Remove PV for Traefik certs and trimmed values.yaml

infra/traefik/kustomization.yaml

@@ -6,9 +6,7 @@ resources:
   - cloudflare-token-cert-manager.yaml
   - cloudflare-issuer.yaml
   - cloudflare-cert.yaml
-  - pv-certs.yaml
   - traefik-forward-auth
-  - ingress-route.yaml
 
 helmCharts:
   - name: traefik

infra/traefik/pv-certs.yaml

@@ -1,24 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  finalizers:
-    - kubernetes.io/pv-protection
-  name: traefik-cert-pv
-spec:
-  capacity:
-    storage: 128Mi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: cert-storage
-  local:
-    path: /disk/etc/traefik/certs
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-        - matchExpressions:
-            - key: kubernetes.io/hostname
-              operator: In
-              values:
-                - gauss

infra/traefik/traefik-forward-auth/ingress.yaml

@@ -1,7 +1,7 @@
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: traefik-dashboard
+  name: traefik-dashboard-auth
   namespace: traefik-system
 spec:
   entryPoints:
@@ -12,12 +12,5 @@ spec:
       services:
         - name: traefik-forward-auth
           port: 4181
-      middlewares:
-        - name: traefik-forward-auth
-    - match: Host(`traefik.stonegarden.dev`)
-      kind: Rule
-      services:
-        - name: api@internal
-          kind: TraefikService
       middlewares:
         - name: traefik-forward-auth

infra/traefik/traefik-forward-auth/kustomization.yaml

@@ -9,6 +9,7 @@ resources:
   - service.yaml
   - deployment.yaml
   - middleware.yaml
+  - ingress.yaml
 
 configMapGenerator:
   - name: configs

infra/traefik/values.yaml

@@ -1,13 +1,4 @@
 deployment:
-  initContainers:
-    # The "volume-permissions" init container is required if you run into permission issues.
-    # Related issue: https://github.com/traefik/traefik/issues/6972
-    - name: volume-permissions
-      image: busybox:1.31.1
-      command: [ "sh", "-c", "chmod -Rv 600 /data/*" ]
-      volumeMounts:
-        - name: data
-          mountPath: /data
   dnsConfig:
     nameservers:
       - 192.168.1.153
@@ -17,30 +8,13 @@ service:
   annotations:
     io.cilium/lb-ipam-ips: 192.168.1.142
 
-providers:
-  kubernetesCRD:
-    allowCrossNamespace: true
-  kubernetesIngress:
-    publishedService:
-      enabled: true
-      # Need to override path since otherwise the namespace is set as default
-      pathOverride: traefik-system/traefik
-
-additionalArguments:
-  - "--log.level=ERROR"
-  - "--api.insecure"
-
 ingressRoute:
   dashboard:
-    enabled: false
-
-persistence:
-  enabled: true
-  name: data
-  accessMode: ReadWriteOnce
-  size: 128Mi
-  storageClass: cert-storage
-  path: /data
+    entryPoints:
+      - websecure
+    matchRule: Host(`traefik.stonegarden.dev`)
+    middlewares:
+      - name: traefik-forward-auth
 
 tlsStore:
   default: