fix: 🐛 set disableIngressClassLookup until 3.1.4

traefik · Oct 3, 2024 · 91febf0 · 91febf0
1 parent 3b1860c
commit 91febf0
Show file tree

Hide file tree

Showing 3 changed files with 37 additions and 7 deletions.
diff --git a/traefik/templates/_podtemplate.tpl b/traefik/templates/_podtemplate.tpl
@@ -464,13 +464,13 @@
            {{- end }}
            {{- if .Values.providers.kubernetesCRD.allowEmptyServices }}
           - "--providers.kubernetescrd.allowEmptyServices=true"
-           {{- end }}
-           {{- if and .Values.rbac.namespaced (semverCompare ">=3.1.2-0" $version) }}
-          - "--providers.kubernetescrd.disableClusterScopeResources=true"
            {{- end }}
            {{- if .Values.providers.kubernetesCRD.nativeLBByDefault }}
           - "--providers.kubernetescrd.nativeLBByDefault=true"
            {{- end }}
+           {{- if and .Values.rbac.namespaced (semverCompare ">=3.1.2-0" $version) }}
+          - "--providers.kubernetescrd.disableClusterScopeResources=true"
+           {{- end }}
           {{- end }}
           {{- if .Values.providers.kubernetesIngress.enabled }}
           - "--providers.kubernetesingress"
@@ -490,8 +490,11 @@
           - "--providers.kubernetesingress.ingressClass={{ .Values.providers.kubernetesIngress.ingressClass }}"
            {{- end }}
            {{- if .Values.rbac.namespaced }}
-            {{- if semverCompare "<3.1.2-0" $version }}
+            {{- if semverCompare "<3.1.5-0" $version }}
           - "--providers.kubernetesingress.disableIngressClassLookup=true"
+              {{- if semverCompare ">=3.1.2-0" $version }}
+          - "--providers.kubernetesingress.disableClusterScopeResources=true"
+              {{- end }}
             {{- else }}
           - "--providers.kubernetesingress.disableClusterScopeResources=true"
             {{- end }}

diff --git a/traefik/tests/traefik-config_test.yaml b/traefik/tests/traefik-config_test.yaml
@@ -564,6 +564,33 @@ tests:
       - contains:
           path: spec.template.spec.containers[0].args
           content: "--providers.kubernetesingress.disableIngressClassLookup=true"
+  - it: should not set disableIngressClassLookup if version is >= v3.1.5+ and rbac are namespaced
+    set:
+      rbac:
+        namespaced: true
+      image:
+        tag: v3.1.5
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--providers.kubernetesingress.disableClusterScopeResources=true"
+
+      - notContains:
+          path: spec.template.spec.containers[0].args
+          content: "--providers.kubernetesingress.disableIngressClassLookup=true"
+  - it: should set disableIngressClassLookup if version is < v3.1.5+ and rbac are namespaced
+    set:
+      rbac:
+        namespaced: true
+      image:
+        tag: v3.1.4
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--providers.kubernetesingress.disableClusterScopeResources=true"
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--providers.kubernetesingress.disableIngressClassLookup=true"
   - it: should set disableClusterScopeResources when version > v3.1.2+ on both providers
     set:
       rbac:

diff --git a/traefik/values.yaml b/traefik/values.yaml
@@ -809,9 +809,9 @@ hostNetwork: false
 rbac:  # @schema additionalProperties: false
   enabled: true
   # When set to true:
-  # 1. Use `Role` and `RoleBinding` instead of `ClusterRole` and `ClusterRoleBinding`.
-  # 2. Set `disableIngressClassLookup` on Kubernetes Ingress providers with Traefik Proxy v3 until v3.1.1
-  # 3. Set `disableClusterScopeResources` on Kubernetes Ingress and CRD providers with Traefik Proxy v3.1.2+
+  # 1. it switches respectively the use of `ClusterRole` and `ClusterRoleBinding` to `Role` and `RoleBinding`.
+  # 2. it adds `disableIngressClassLookup` on Kubernetes Ingress with Traefik Proxy v3 until v3.1.4
+  # 3. it adds `disableClusterScopeResources` on Kubernetes Ingress and CRD providers with Traefik Proxy v3.1.2+
   # **NOTE**: `IngressClass`, `NodePortLB` and **Gateway** provider cannot be used with namespaced RBAC.
   # See [upstream documentation](https://doc.traefik.io/traefik/providers/kubernetes-ingress/#disableclusterscoperesources) for more details.
   namespaced: false