fix(traefik): bouncer middleware attachment used a schema-invalid key #78

2026-06-27T11:10:29Z

k.renner commented

2026-06-27 11:10:29 +00:00

Hotfix for #77. That PR attached the CrowdSec middleware via ports.websecure.middlewares, but the Traefik chart 40.x values schema has no such key:

at '/ports/websecure': additional properties 'middlewares' not allowed

Because Helm upgrades are atomic, the entire Traefik upgrade was rejected — so neither the plugin nor the middleware applied (old pods kept serving, no outage), and the failed HelmRelease degraded the infrastructure Flux kustomization, which in turn blocked dependents (home-assistant, matter-server, …) from reconciling.

Fix: attach the entrypoint default middleware via additionalArguments (a CLI flag → static config entryPoints.websecure.http.middlewares), which isn't schema-constrained. experimental.plugins validated fine and is unchanged.

⚠️ This is the change that actually triggers the Traefik restart + GitHub plugin download (the outage-risk moment #77 described). Watch the ingress/traefik rollout after merge; revert if pods don't go Ready. Merging this also unblocks the stuck infrastructure kustomization.

🤖 Generated with Claude Code

**Hotfix for #77.** That PR attached the CrowdSec middleware via `ports.websecure.middlewares`, but the Traefik chart 40.x values schema has no such key: ``` at '/ports/websecure': additional properties 'middlewares' not allowed ``` Because Helm upgrades are atomic, the **entire** Traefik upgrade was rejected — so neither the plugin nor the middleware applied (old pods kept serving, **no outage**), and the failed HelmRelease degraded the `infrastructure` Flux kustomization, which in turn blocked dependents (home-assistant, matter-server, …) from reconciling. Fix: attach the entrypoint default middleware via `additionalArguments` (a CLI flag → static config `entryPoints.websecure.http.middlewares`), which isn't schema-constrained. `experimental.plugins` validated fine and is unchanged. > ⚠️ This is the change that actually triggers the Traefik restart + GitHub plugin download (the outage-risk moment #77 described). Watch the `ingress/traefik` rollout after merge; revert if pods don't go Ready. Merging this also unblocks the stuck `infrastructure` kustomization. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

k.renner added 1 commit 2026-06-27 11:10:30 +00:00

traefik: fix bouncer middleware attachment (schema-invalid key) 3084bf0551

PR #77 used ports.websecure.middlewares, which chart 40.x's values schema rejects ('additional properties middlewares not allowed'), so the whole Helm upgrade failed and degraded the infrastructure kustomization. Attach the entrypoint default middleware via additionalArguments CLI flag instead (schema-free). experimental.plugins was fine and is unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit 76f8191658 into master

2026-06-27 11:11:55 +00:00

k.renner referenced this issue from a commit

2026-06-27 11:11:57 +00:00

Merge pull request 'fix(traefik): bouncer middleware attachment used a schema-invalid key' (#78) from fix-traefik-middleware-schema into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#78