Add traefik

infrastructure/base/traefik/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+
+resources:
+  - repository.yaml
+  - release.yaml

infrastructure/base/traefik/release.yaml

@@ -0,0 +1,17 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: traefik
+      version: 28.2.0
+      sourceRef:
+        kind: HelmRepository
+        name: traefik
+      interval: 10m
+  values:
+    replicaCount: 2

infrastructure/base/traefik/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: traefik-helm-repo
+  namespace: kube-system
+spec:
+  interval: 10m
+  url: https://helm.traefik.io/traefik

infrastructure/prod/traefik/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base/podinfo
+patches:
+  - path: podinfo-values.yaml
+    target:
+      kind: HelmRelease

infrastructure/prod/traefik/values.yaml

@@ -0,0 +1,73 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  values:        
+    deployment:
+      initContainers:
+      - name: volume-permissions
+        image: busybox:1.36@sha256:34b191d63fbc93e25e275bfccf1b5365664e5ac28f06d974e8d50090fbb49f41
+        command: ["sh", "-c", "touch /data/acme.json; chown 65532:65532 /data/acme.json; chmod -v 600 /data/acme.json; chown -R 65532:65532 /var/log/traefik"]
+        securityContext:
+          runAsNonRoot: false
+          runAsGroup: 0
+          runAsUser: 0
+        volumeMounts:
+          - name: data
+            mountPath: /data
+          - name: access-log
+            mountPath: /var/log/traefik
+      additionalVolumes:
+      - name: access-log
+        hostPath:
+          path:  /var/log/traefik/
+    certResolvers:
+      letsencrypt:
+        email: admin@example.com
+        dnsChallenge:
+          provider: cloudflare
+          delayBeforeCheck: 30
+          resolvers:
+          - 1.1.1.1
+          - 8.8.8.8
+        storage: /data/acme.json
+    envFrom:
+    - secretRef:
+        name: traefik-cf-secret
+    additionalVolumeMounts:
+    - name: access-log
+      mountPath: /var/log/traefik/
+    logs:
+      access:
+        enabled: true
+        filePath: /var/log/traefik/access.log
+    ingressRoute:
+      dashboard:
+        enabled: true
+        matchRule: Host(`traefik.namesny.com`)
+        entryPoints: ["websecure"]
+        middlewares:
+          - name: "auth-authelia@kubernetescrd"
+    providers:
+      kubernetesCRD:
+        allowCrossNamespace: true
+    persistence:
+      enabled: true
+      storageClass: retain-local-path
+    ports:
+      websecure:
+        tls:
+          enabled: true
+          certResolver: letsencrypt
+          domains:
+          - main: namesny.com
+            sans:
+            - "*.namesny.com"
+      web:
+        redirectTo:
+          port: websecure
+    service:
+      spec:
+        externalTrafficPolicy: Local