From 5073eed8e5b8e294a10479803235f4c92cffcc72 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 27 Jun 2026 16:10:59 +0200 Subject: [PATCH] traefik: disable global CrowdSec enforcement (caused v6 ingress outage) The global bouncer middleware banned all IPv6 ingress: Traefik sees one shared/SNAT'd v6 source, so a single http-admin-interface-probing hit (the e2e scan) 403'd every v6 client. Remove the global entrypoint-middleware attachment; keep the plugin + Middleware CRD inert so re-enabling is one line after fixing client-IP visibility + adding an internal whitelist. Detection (agents) stays on. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../infrastructure/traefik/helmrelease.yaml | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/kubernetes/infrastructure/traefik/helmrelease.yaml b/kubernetes/infrastructure/traefik/helmrelease.yaml index 11837336..be73fcc1 100644 --- a/kubernetes/infrastructure/traefik/helmrelease.yaml +++ b/kubernetes/infrastructure/traefik/helmrelease.yaml @@ -44,21 +44,22 @@ spec: values: deployment: replicas: 2 - # CrowdSec bouncer plugin (Yaegi). Traefik downloads the module source - # from GitHub at pod startup — the `ingress` namespace has no egress - # restriction so this succeeds, but if GitHub is unreachable at boot - # Traefik will not start. Pinned to a known-good release. + # CrowdSec bouncer plugin (Yaegi), loaded but NOT globally attached. + # Enforcement was disabled after it caused an IPv6 ingress outage on + # first deploy: Traefik sees a single shared/SNAT'd source IP for v6 + # ingress (no real per-client IP), so one http-admin-interface-probing + # hit (the e2e scan) banned that shared IP and 403'd all v6 clients. + # Re-attach the bouncer (additionalArguments entrypoint middleware -> + # ingress-crowdsec-bouncer@kubernetescrd) only after fixing client-IP + # visibility (forwardedHeaders/trustedIPs or the v6 masquerade) and + # adding an internal/LAN whitelist. The plugin + crowdsec-middleware.yaml + # stay in place so re-enabling is a one-line change. Detection (the + # crowdsec agents parsing Traefik logs) remains on and is unaffected. experimental: plugins: bouncer: moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin version: v1.6.0 - # Attach the CrowdSec bouncer to every router on the websecure - # entrypoint (global enforcement). The chart's values schema (40.x) has - # no `ports..middlewares` key, so set the entrypoint default - # middleware via static config CLI flag instead. - additionalArguments: - - "--entryPoints.websecure.http.middlewares=ingress-crowdsec-bouncer@kubernetescrd" ingressClass: enabled: true isDefaultClass: false -- 2.54.0