kubernetes/infrastructure/traefik/helmrelease.yaml

@@ -44,21 +44,22 @@ spec:
   values:
     deployment:
       replicas: 2
-    # CrowdSec bouncer plugin (Yaegi). Traefik downloads the module source
-    # from GitHub at pod startup — the `ingress` namespace has no egress
-    # restriction so this succeeds, but if GitHub is unreachable at boot
-    # Traefik will not start. Pinned to a known-good release.
+    # CrowdSec bouncer plugin (Yaegi), loaded but NOT globally attached.
+    # Enforcement was disabled after it caused an IPv6 ingress outage on
+    # first deploy: Traefik sees a single shared/SNAT'd source IP for v6
+    # ingress (no real per-client IP), so one http-admin-interface-probing
+    # hit (the e2e scan) banned that shared IP and 403'd all v6 clients.
+    # Re-attach the bouncer (additionalArguments entrypoint middleware ->
+    # ingress-crowdsec-bouncer@kubernetescrd) only after fixing client-IP
+    # visibility (forwardedHeaders/trustedIPs or the v6 masquerade) and
+    # adding an internal/LAN whitelist. The plugin + crowdsec-middleware.yaml
+    # stay in place so re-enabling is a one-line change. Detection (the
+    # crowdsec agents parsing Traefik logs) remains on and is unaffected.
     experimental:
       plugins:
         bouncer:
           moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
           version: v1.6.0
-    # Attach the CrowdSec bouncer to every router on the websecure
-    # entrypoint (global enforcement). The chart's values schema (40.x) has
-    # no `ports.<ep>.middlewares` key, so set the entrypoint default
-    # middleware via static config CLI flag instead.
-    additionalArguments:
-      - "--entryPoints.websecure.http.middlewares=ingress-crowdsec-bouncer@kubernetescrd"
     ingressClass:
       enabled: true
       isDefaultClass: false