From 3084bf0551ef45601ca128115c75e0cbfd314778 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 27 Jun 2026 13:09:42 +0200 Subject: [PATCH] traefik: fix bouncer middleware attachment (schema-invalid key) PR #77 used ports.websecure.middlewares, which chart 40.x's values schema rejects ('additional properties middlewares not allowed'), so the whole Helm upgrade failed and degraded the infrastructure kustomization. Attach the entrypoint default middleware via additionalArguments CLI flag instead (schema-free). experimental.plugins was fine and is unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) --- kubernetes/infrastructure/traefik/helmrelease.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/kubernetes/infrastructure/traefik/helmrelease.yaml b/kubernetes/infrastructure/traefik/helmrelease.yaml index bb9c70e2..11837336 100644 --- a/kubernetes/infrastructure/traefik/helmrelease.yaml +++ b/kubernetes/infrastructure/traefik/helmrelease.yaml @@ -53,6 +53,12 @@ spec: bouncer: moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin version: v1.6.0 + # Attach the CrowdSec bouncer to every router on the websecure + # entrypoint (global enforcement). The chart's values schema (40.x) has + # no `ports..middlewares` key, so set the entrypoint default + # middleware via static config CLI flag instead. + additionalArguments: + - "--entryPoints.websecure.http.middlewares=ingress-crowdsec-bouncer@kubernetescrd" ingressClass: enabled: true isDefaultClass: false @@ -83,12 +89,6 @@ spec: scheme: https permanent: true websecure: - # Apply the CrowdSec bouncer to every router on this entrypoint — - # global enforcement, like the old ingress-nginx Lua bouncer. The - # Middleware itself is fail-open (see crowdsec-middleware.yaml), so - # a CrowdSec/LAPI outage never black-holes ingress. - middlewares: - - ingress-crowdsec-bouncer@kubernetescrd # HTTP/3 is the headline reason for this migration — ingress-nginx # cannot serve QUIC on UDP/443, so LAN clients that learned the # `alpn=h3` hint (DNS HTTPS RR / Alt-Svc) over Cloudflare get -- 2.54.0