2026-06-27 11:11:55 +00:00
1 changed files with 6 additions and 6 deletions
@@ -53,6 +53,12 @@ spec:
        bouncer:
          moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
          version: v1.6.0
+    # Attach the CrowdSec bouncer to every router on the websecure
+    # entrypoint (global enforcement). The chart's values schema (40.x) has
+    # no `ports.<ep>.middlewares` key, so set the entrypoint default
+    # middleware via static config CLI flag instead.
+    additionalArguments:
+      - "--entryPoints.websecure.http.middlewares=ingress-crowdsec-bouncer@kubernetescrd"
    ingressClass:
      enabled: true
      isDefaultClass: false
@@ -83,12 +89,6 @@ spec:
              scheme: https
              permanent: true
      websecure:
-        # Apply the CrowdSec bouncer to every router on this entrypoint —
-        # global enforcement, like the old ingress-nginx Lua bouncer. The
-        # Middleware itself is fail-open (see crowdsec-middleware.yaml), so
-        # a CrowdSec/LAPI outage never black-holes ingress.
-        middlewares:
-          - ingress-crowdsec-bouncer@kubernetescrd
        # HTTP/3 is the headline reason for this migration — ingress-nginx
        # cannot serve QUIC on UDP/443, so LAN clients that learned the
        # `alpn=h3` hint (DNS HTTPS RR / Alt-Svc) over Cloudflare get