[renovate]

This PR contains the following updates:

Package	Type	Update	Change
traefik (source)	HelmChart	major	41.7.1 → 42.1.3

---

Release Notes

traefik/traefik-helm-chart (traefik)

v42.1.3

Compare Source

🚀 Features

• feat(hub): 🚀 support traefik hub v3.20.19 and v3.21.6 #​2052 by @​darkweaver87

📦 Others

• chore(release): 🚀 publish 42.1.3 #​2053 by @​darkweaver87

👌 Traefik version support

• Traefik Proxy: v3.6.0 -> v3.7.16 (default)
• Traefik Hub: v3.19.3 -> v3.21.6

v42.1.2

Compare Source

🚀 Features

• feat(hub): 🚀 support traefik hub v3.20.18 and v3.21.5 #​2050 by @​darkweaver87

📦 Others

• chore(release): 🚀 publish 42.1.2 #​2051 by @​darkweaver87

👌 Traefik version support

• Traefik Proxy: v3.6.0 -> v3.7.16 (default)
• Traefik Hub: v3.19.3 -> v3.21.5

v42.1.1

Compare Source

🚀 Features

• feat(deps): update traefik docker tag to v3.7.16 #​2048 by @​darkweaver87

📦 Others

• chore(release): 🚀 publish 42.1.1 #​2049 by @​darkweaver87

👌 Traefik version support

• Traefik Proxy: v3.6.0 -> v3.7.16 (default)
• Traefik Hub: v3.19.3 -> v3.21.4

v42.1.0

Compare Source

🚀 Features

• feat(deps): update traefik docker tag to v3.7.15 #​2036 by @​renovate-with-github-actions[bot]
• feat(chart): support top-level and global imagePullSecrets #​2044 by @​thekoma
• feat(hub): 🚀 support traefik hub v3.20.17 and v3.21.4 #​2045 by @​darkweaver87

🐛 Bug fixes

• fix(gateway): remove unnecessary blank lines from generated Gateway #​2035 by @​pommetjehorlepiep

📦 Others

• chore(deps): update github actions #​2037 by @​renovate-with-github-actions[bot]
• chore(deps): update renovatebot/github-action action to v46.3.9 #​2041 by @​renovate-with-github-actions[bot]
• docs(examples): bump the Traefik MCP server sidecar to v0.2.0 #​2040 by @​emilevauge
• chore(release): 🚀 publish 42.1.0 #​2047 by @​darkweaver87

👌 Traefik version support

• Traefik Proxy: v3.6.0 -> v3.7.15 (default)
• Traefik Hub: v3.19.3 -> v3.21.4

v42.0.0

Compare Source

There are 3 breaking changes in this release

Upgrade Notes

1. Kubernetes v1.30+: The chart now requires Kubernetes v1.30 or higher (#​2030).
2. Traefik Hub Secret RBAC: Write verbs on Secrets (create, update, delete) are no longer granted cluster-wide.
   • A Role now grants them in the release namespace only, where Traefik Hub writes its Secrets (#​2028)
3. Transparency logs witnesses: (#​2018):
   • hub.transparencyLogs.witnessGroup.witnesses now defaults to null and threshold must be at least 1.
   • Setting threshold, timeout or failOpen without any witness now fails.

[!NOTE]
With hub.token, the chart now deploys a cluster-scoped ValidatingAdmissionPolicy that only allows Traefik Hub to write Opaque and kubernetes.io/tls Secrets.
Set hub.restrictSecretTypes: false if the installer cannot create cluster-scoped resources.

💥 BREAKING CHANGES

• fix(tlogs)!: empty witness config #​2018 by @​LBF38
• feat(chart)!: require Kubernetes v1.30 or higher #​2030 by @​mloiseleur
• fix(rbac)!: 🐛 scope Traefik Hub secret write permissions to release namespace #​2028 by @​mloiseleur

🚀 Features

• feat(hub): 🚀 support traefik hub v3.20.16 and v3.21.3 #​2032 by @​mloiseleur
• feat(hub): restrict Secret types written by Traefik Hub #​2031 by @​mloiseleur

🐛 Bug fixes

• fix(examples): fix outdated value schema used in additionalServices example #​2023 by @​jnoordsij

📦 Others

• chore(deps): update github actions #​2024 by @​renovate-with-github-actions[bot]
• chore(deps): update quay.io/helmpack/chart-testing docker tag to v3.15.0 #​2025 by @​renovate-with-github-actions[bot]
• docs(agents): document Traefik Hub version bump #​2033 by @​mloiseleur
• docs(examples): add Traefik Hub Gateway with the Traefik MCP server as a sidecar #​2007 by @​emilevauge
• chore(release): 🚀 publish 42.0.0 #​2034 by @​mloiseleur

👌 Traefik version support

• Traefik Proxy: v3.6.0 -> v3.7.14 (default)
• Traefik Hub: v3.19.3 -> v3.21.3

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

• Risk: LOW (major chart bump 41.6.0 → 42.0.0, but the breaking changes only touch Traefik Hub / old Kubernetes; blast radius is high if ingress breaks, as this bumps both traefik and traefik-internal)
• Breaking changes (from the v42.0.0 release notes, checked against both HelmReleases):
  • Chart now requires Kubernetes ≥ 1.30. I found no k3s version pinned in the repo, so please confirm the cluster is on 1.30+.
  • Traefik Hub Secret RBAC is now namespace-scoped. Not affected: neither HelmRelease sets hub.*.
  • Transparency-log witness defaults changed (hub.transparencyLogs.witnessGroup.*). Not affected: it is unused here.
  • New ValidatingAdmissionPolicy is only deployed with hub.token, so it is not deployed here.
  • The values in use (TLS secretName, nebula-conf volume, etc.) don't touch any renamed or removed keys. I only read the notes in the PR body and did not diff the chart's values.yaml.
• Action needed: none, safe to merge on green once the cluster is confirmed at Kubernetes 1.30+. Watch the Flux HelmRelease reconcile for both traefik releases.

[claude]

• Risk: MEDIUM — major chart bump (41.6.0 → 42.1.0), but only the breaking changes below are in play; Traefik is the cluster's public + internal ingress (traefik and traefik-internal), so a bad rollout means an ingress outage. Both HelmReleases are bumped.
• Breaking changes (from the 42.0.0 / 42.1.0 release notes in the PR body; I did not fetch upstream separately):
  • Kubernetes ≥ 1.30 required. I couldn't find the live k3s version in the repo (only archived v1.20 docs), so please confirm the cluster is ≥ 1.30.
  • Traefik Hub RBAC scoping and transparency-log witness changes: not affected, since neither release sets hub.*.
  • The new Hub ValidatingAdmissionPolicy applies only with hub.token, so it isn't deployed here.
  • Values used (ports.*.http.*, log/accessLog, providers.*, tlsStore, tlsOptions, deployment.additionalContainers, service.spec) aren't touched by 42.x notes.
  • 42.1.0 bumps Traefik proxy to v3.7.15 (minor jump within v3), plus a Gateway blank-line fix and imagePullSecrets support; neither affects this repo.
• Action needed: none beyond confirming the k8s version is ≥ 1.30. Otherwise safe to merge on green. Watch the traefik pod (nebula sidecar) and LB IPs after reconcile.

[claude]

• Risk: MEDIUM — major chart bump (41.6.0 → 42.1.1) plus Traefik Proxy 3.6 → 3.7.16, on the cluster's ingress controllers (public traefik and traefik-internal). A bad rollout takes down all ingress, though replicas=1 and the rollback path is simple.
• Breaking changes (v42.0.0 notes, checked against both HelmReleases):
  • Chart now requires Kubernetes ≥ 1.30. I could not verify the cluster version from the repo, so confirm it.
  • Hub Secret RBAC and transparency-log witness validation only affect hub.* values. This repo sets none, so it is not affected.
  • No value renames or removals are listed. The values this repo uses (ports.*.http.*, log/accessLog, providers.*, tlsStore, tlsOptions, additionalArguments, deployment.additionalContainers) are not mentioned in the notes. No CRD changes are listed, and upgrade.crds: CreateReplace already handles them.
  • Not a chart breaking change, but worth a glance: Proxy 3.7 is a minor upgrade of the proxy itself. I did not review the 3.7 proxy changelog.
• Action needed: none in the manifests. Before merging, confirm k8s ≥ 1.30. After merge, check that both HelmReleases reconcile and that the traefik pods (including the nebula sidecar) come up healthy. Source: GitHub release notes for v42.0.0, v42.1.0 and v42.1.1, which were reachable.

[claude]

• Risk: MEDIUM. Major chart bump (41.6.0 → 42.1.2) on both traefik (public ingress) and traefik-internal, so an ingress outage would hit every app. The changes themselves look small, and the Traefik Proxy default moves from v3.6.x to v3.7.16.
• Breaking changes (from the v42.0.0 release notes; v42.1.x only adds features and Hub support). None of these hit this repo's values:
  • The chart now needs Kubernetes ≥ 1.30. I couldn't check the cluster version from the repo, so please confirm.
  • Traefik Hub changes (Secret RBAC now namespace-scoped, hub.transparencyLogs.witnessGroup validation, a ValidatingAdmissionPolicy when hub.token is set). Neither HelmRelease sets any hub.* values, so these don't apply.
  • No values were removed or renamed in v42. The keys we use are already on the new schema: log/accessLog (v41), ports.*.http.tls, http.redirections.entryPoint, providers.*, tlsStore, tlsOptions, ingressClass.
  • Not covered by the v42 notes: the proxy jump to v3.7.x (several minor releases), which I did not review. Worth a skim for the allowExternalNameServices / allowEmptyServices and the forwarded-headers/proxyProtocol behavior we rely on.
• Action needed: None in the manifests. Before merging, confirm the cluster is on k8s ≥ 1.30. After merge, check that both Traefik pods roll cleanly and that Ingress routing still works, including the paperless outpost path (ExternalName backend). Flux CreateReplace will update the CRDs automatically.

[claude]

• Risk: MEDIUM. Major chart bump (41.7.1 → 42.1.2) on both traefik and traefik-internal, which are the cluster ingress. The breaking changes do not touch the values this repo uses.
• Breaking changes (from the v42.0.0 release notes quoted in the PR body; I did not open the upstream release pages separately):
  • Kubernetes ≥ 1.30 is now required. I could not find the k3s version pinned in this repo, so confirm the cluster is on 1.30 or newer.
  • Traefik Hub changes (secret RBAC scoping, ValidatingAdmissionPolicy, hub.transparencyLogs.witnessGroup defaults) only apply with hub.* values. traefik sets none. For traefik-internal I only grepped for hub/witness/restrictSecretTypes/imagePull and found nothing, so neither release is affected.
  • No renamed values. The values traefik sets (ports.*.http.*, providers.*, log/accessLog, tlsOptions, tlsStore, deployment.additionalContainers, service.spec) are not mentioned in the 42.x notes. The v40/v41 renames are already applied there. I did not read the traefik-internal values in full.
  • Traefik Proxy moves to v3.7.16 (chart default). The 42.x notes list no breaking changes for it, but it is a minor jump from the previous default.
• Action needed: none beyond the Kubernetes ≥ 1.30 check. Merge on green. The HelmReleases use crds: CreateReplace, so CRD updates apply automatically. After merge, check that the Traefik pods roll cleanly and that the nebula sidecar and the LB IP come back. With replicas: 1, expect a brief ingress blip.

[claude]

Traefik chart 41.7.1 → 42.1.3 (traefik + traefik-internal HelmReleases)

• Risk: MEDIUM — major chart bump, but the breaking changes don't touch this repo's values. Blast radius is high though: both ingress controllers (public LB + internal LB) are affected, and the public one carries the nebula sidecar.
• Breaking changes (per v42.0.0 release notes; checked against both helm-release.yaml files):
  • K8s floor is now ≥ 1.30. Confirm the k3s version meets this.
  • Hub Secret RBAC and hub.transparencyLogs.witnessGroup changes: N/A, no hub.* values are set.
  • No value renames/removals are listed. The values used here (ports.*.http.*, log/accessLog, providers.*, tlsStore, additionalContainers/Volumes) were already migrated in v40/v41.
  • Default Traefik Proxy moves to v3.7.16 (from v3.6.x), a minor jump. Worth a skim of the v3.7 notes, mainly because additionalArguments is used (--entrypoints.websecure.http.middlewares=, allowEmptyServices).
  • 42.1.x only adds features and fixes (imagePullSecrets, Gateway whitespace, Hub support).
• Action needed: none expected. Check the k3s version is ≥ 1.30, then merge on green. Watch both traefik pods and the nebula sidecar rollout afterwards. The Local externalTrafficPolicy means a brief blip is possible during the single-replica restart.

Notes were fetched from the GitHub release page for v42.0.0 and the PR body. I did not diff the rendered chart templates.

[claude]

• Risk: MEDIUM. Major chart bump (41.7.1 → 42.1.3) on both traefik (public LB) and traefik-internal, so an ingress outage would hit every app. The breaking changes in 42.0.0 appear not to touch this repo's values. Traefik Proxy goes to v3.7.16 as the chart default; that is the main behavioural change.
• Breaking changes (checked against the 42.0.0 notes in the PR body; I did not fetch the upstream release page separately):
  1. Kubernetes ≥ 1.30 required. Check the k3s version, because the chart will refuse or misbehave on older clusters. I can't see the cluster version from the repo.
  2. Hub Secret RBAC and hub.restrictSecretTypes. Both HelmReleases have no hub.* values, so the RBAC scoping, the new ValidatingAdmissionPolicy and the transparency-log witness changes don't apply here.
  3. Neither HelmRelease sets imagePullSecrets, so the new top-level and global imagePullSecrets support doesn't change anything.
  4. The 42.1.x changes are a gateway blank-line fix, imagePullSecrets support and Hub version bumps, none of which this repo uses.
• Values compatibility: the values already use the v40/v41 renamed keys (log, accessLog, http.redirections.entryPoint, http.tls), and 42.x doesn't rename them. deployment.additionalContainers and additionalVolumes (the nebula sidecar), ports.*, tlsStore and providers.* aren't mentioned in the notes.
• Action needed: none on values. Before merging, confirm k3s is ≥ 1.30. After merge, check that both traefik pods roll out Ready and that the LB IPs still serve traffic. The upgrade uses crds: CreateReplace, so CRDs update automatically.