feat(helm)!: Update chart traefik (37.4.0 → 38.0.2) by ixxel-bot[bot] · Pull Request #1504 · ixxeL-DevOps/fullstack

ixxel-bot · 2026-04-26T19:27:24Z

This PR contains the following updates:

Package	Update	Change
traefik (source)	major	`37.4.0` → `38.0.2`

Release Notes

traefik/traefik-helm-chart (traefik)

`v38.0.2`

Compare Source

Upgrades Notes

There is a breaking change on CRDs between Traefik Hub v3.18.0 and inferior and the CRDs of Traefik Hub v3.19.0+ preview versions (ea & rc).
With this release, we remove the CRDs of Traefik Hub v3.19.0 preview versions.

When Traefik Hub v3.19.0 is GA, we will release a new major version of this Chart that will only accept Traefik Hub v3.19.0+ versions.

🚀 Features

feat(deps): update traefik docker tag to v3.6.6 #1610 by @renovate[bot]

🐛 Bug fixes

fix(CRDs): enforce the fact that this Chart does not support Traefik Hub v3.19.0 #1616 by @mloiseleur
fix(security): set the seccomp profile to RuntimeDefault #1618 by @kkrypt0nn

📦 Others

docs(CRDs): add deprecation notice #1617 by @mloiseleur
chore(release): publish traefik 38.0.2 and crds 1.13.1 #1619 by @mloiseleur

New Contributors

@kkrypt0nn made their first contribution in #1618

Full Changelog: traefik/traefik-helm-chart@v38.0.1...v38.0.2

`v38.0.1`

Compare Source

🐛 Bug fixes

fix(ports): 🐛 http.encodedCharacters on custom entrypoints #1606 by @mloiseleur
fix(ports): 🐛 add missing http.maxHeaderBytes option #1604 by @mloiseleur

📦 Others

chore(release): 🚀 publish traefik 38.0.1 #1608 by @mloiseleur

`v38.0.0`

Compare Source

Upgrades Notes

[!IMPORTANT]
CRDs has to be upgraded before the Chart. See UPGRADING instructions.

There are two breaking changes in this release:

Traefik Proxy v3.6.4+ contains a security fix that is also a breaking change. See upstream documentation for more details.
PR #1596 align kubernetesIngressNginx provider setting with upstream. There is a before / after example in the PR description and PR #1587 align labelSelector syntax between providers

[!NOTE]
If you need to restore Traefik behavior of v3.6.3 or inferior, it can be set with values.

Here is an example on websecure entrypoint:

ports:
  websecure:
    http:
      encodedCharacters:
        allowEncodedSlash: true
        allowEncodedBackSlash: true
        allowEncodedNullCharacter: true
        allowEncodedSemicolon: true
        allowEncodedPercent: true
        allowEncodedQuestionMark: true
        allowEncodedHash: true
      sanitizePath: false

This is not recommended, it may expose you to GHSA-gm3x-23wp-hc2c.

💥 BREAKING CHANGES

fix(providers)!: align labelSelector for kubernetesGateway and knative #1587 by @shubhamch71
fix(nginx)!: 🐛 align provider settings and provide required rbac #1596 by @mloiseleur

🚀 Features

feat(CRDs): update Traefik Hub to v1.24.1, with required RBACs #1571 by @jspdown
feat(ports): enforce schema #1586 by @remyj38
feat(CRDs): update Traefik Hub to v1.24.2 #1585 by @traefiker
feat(providers): ✨ enforce schema #1595 by @mloiseleur
feat(security): ✨ 🔒️ add support for request path options of traefik 3.6.4+ #1594 by @mloiseleur
feat(deps): update traefik docker tag to v3.6.4 #1590 by @renovate[bot]
feat(deps): update traefik docker tag to v3.6.5 #1599 by @renovate[bot]

🐛 Bug fixes

fix: update error message for maxUnavailable validation #1591 by @lucasra1
fix(notes): minor typo #1593 by @rndmh3ro
fix(pvc): allow empty storageClassName #1579 by @fopina
fix(providers): ✨ enforce schema for all providers #1601 by @mloiseleur

📦 Others

chore(deps): update actions/checkout action to v6 #1573 by @renovate[bot]
docs: Update EXAMPLES.md with REGIONAL load balancer note for Digital Ocean #1574 by @kamikazechaser
chore(release): 🚀 publish traefik 38.0.0 and crds 1.13.0 #1600 by @mloiseleur

New Contributors

@shubhamch71 made their first contribution in #1587
@kamikazechaser made their first contribution in #1574
@lucasra1 made their first contribution in #1591
@remyj38 made their first contribution in #1586
@rndmh3ro made their first contribution in #1593
@fopina made their first contribution in #1579

Full Changelog: traefik/traefik-helm-chart@v37.4.0...v38.0.0

Configuration

📅 Schedule: (in timezone Europe/Paris)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

ixxel-bot · 2026-04-26T19:27:39Z

--- main/traefik_gitops_manifests_traefik_beelink_manifest_main.yaml	2026-04-30 12:36:00.139390976 +0000
+++ pr/traefik_gitops_manifests_traefik_beelink_manifest_pr.yaml	2026-04-30 12:35:59.283396695 +0000
@@ -1,52 +1,52 @@
 ---
 # Source: traefik/charts/traefik/templates/poddisruptionbudget.yaml
 apiVersion: policy/v1beta1
 kind: PodDisruptionBudget
 metadata:
   name: traefik
   namespace: default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
 spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: traefik
       app.kubernetes.io/instance: traefik-default
   maxUnavailable: 1
 ---
 # Source: traefik/charts/traefik/templates/rbac/serviceaccount.yaml
 kind: ServiceAccount
 apiVersion: v1
 metadata:
   name: traefik
   namespace: default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
   annotations:
 automountServiceAccountToken: false
 ---
 # Source: traefik/charts/traefik/templates/rbac/clusterrole.yaml
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: traefik-default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
       - ""
     resources:
       - configmaps
       - nodes
       - services
     verbs:
       - get
@@ -84,20 +84,27 @@
       - list
       - watch
   - apiGroups:
       - extensions
       - networking.k8s.io
     resources:
       - ingresses/status
     verbs:
       - update
   - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - list
+      - watch
+  - apiGroups:
       - traefik.io
     resources:
       - ingressroutes
       - ingressroutetcps
       - ingressrouteudps
       - middlewares
       - middlewaretcps
       - serverstransports
       - serverstransporttcps
       - tlsoptions
@@ -109,41 +116,41 @@
       - watch
 ---
 # Source: traefik/charts/traefik/templates/rbac/clusterrolebinding.yaml
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: traefik-default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: traefik-default
 subjects:
   - kind: ServiceAccount
     name: traefik
     namespace: default
 ---
 # Source: traefik/charts/traefik/templates/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: traefik
   namespace: default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
   annotations:
 spec:
   type: LoadBalancer
   selector:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
   ipFamilyPolicy: PreferDualStack
   ports:
   - port: 80
@@ -157,21 +164,21 @@
 ---
 # Source: traefik/charts/traefik/templates/deployment.yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: traefik
   namespace: default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
   annotations:
 spec:
   replicas: 1
   selector:
     matchLabels:
       app.kubernetes.io/name: traefik
       app.kubernetes.io/instance: traefik-default
   strategy:
     type: RollingUpdate
@@ -181,21 +188,21 @@
   minReadySeconds: 0
   template: 
     metadata:
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/path: "/metrics"
         prometheus.io/port: "9100"
       labels:
         app.kubernetes.io/name: traefik
         app.kubernetes.io/instance: traefik-default
-        helm.sh/chart: traefik-37.4.0
+        helm.sh/chart: traefik-38.0.2
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: traefik
       automountServiceAccountToken: true
       terminationGracePeriodSeconds: 60
       hostNetwork: false
       containers:
       - image: docker.io/traefik:v3.6.15
         imagePullPolicy: IfNotPresent
         name: traefik
@@ -293,31 +300,33 @@
           key: node-role.kubernetes.io/control-plane
           operator: Exists
         - effect: NoSchedule
           key: node-role.kubernetes.io/master
           operator: Exists
       priorityClassName: system-cluster-critical
       securityContext:
         runAsGroup: 65532
         runAsNonRoot: true
         runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
 ---
 # Source: traefik/charts/traefik/templates/ingressclass.yaml
 apiVersion: networking.k8s.io/v1
 kind: IngressClass
 metadata:
   annotations:
     ingressclass.kubernetes.io/is-default-class: "true"
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
   name: traefik
 spec:
   controller: traefik.io/ingress-controller
 ---
 # Source: traefik/templates/extsecret-wildcard-cert.yaml
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: fredcorp-wildcard
@@ -438,15 +447,15 @@
 ---
 # Source: traefik/charts/traefik/templates/tlsstore.yaml
 apiVersion: traefik.io/v1alpha1
 kind: TLSStore
 metadata:
   name: default
   namespace: default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
 spec:
   defaultCertificate:
     secretName: k0s-fullstack-wildcard

| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | helm | traefik | 37.4.0 | 38.0.2 | Co-authored-by: renovate[bot] <renovate@whitesourcesoftware.com>

ixxel-bot Bot added app/traefik Changes made to Traefik application env/beelink Changes made in the k0s cluster renovate/helm type/major labels Apr 26, 2026

ixxel-bot Bot force-pushed the renovate/major-38-traefik-beelink branch 5 times, most recently from e0d3a04 to 8e7b834 Compare April 26, 2026 20:50

ixxel-bot Bot changed the title ~~feat(helm)!: Update Chart traefik (36.3.0 → 38.0.2)~~ feat(helm)!: Update Chart traefik (37.4.0 → 38.0.2) Apr 26, 2026

ixxel-bot Bot force-pushed the renovate/major-38-traefik-beelink branch 13 times, most recently from 4a77f89 to e980a29 Compare April 27, 2026 20:06

github-actions Bot removed the renovate/helm label Apr 27, 2026

ixxel-bot Bot force-pushed the renovate/major-38-traefik-beelink branch from e980a29 to f80d4b5 Compare April 27, 2026 20:46

ixxel-bot Bot changed the title ~~feat(helm)!: Update Chart traefik (37.4.0 → 38.0.2)~~ feat(helm)!: Update chart traefik (37.4.0 → 38.0.2) Apr 27, 2026

ixxel-bot Bot force-pushed the renovate/major-38-traefik-beelink branch 22 times, most recently from 43ec90c to 3da61c4 Compare April 30, 2026 11:51

feat(helm)!: Update chart traefik (37.4.0 → 38.0.2)

a330779

| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | helm | traefik | 37.4.0 | 38.0.2 | Co-authored-by: renovate[bot] <renovate@whitesourcesoftware.com>

ixxel-bot Bot force-pushed the renovate/major-38-traefik-beelink branch from 3da61c4 to a330779 Compare April 30, 2026 12:35

ixxeL2097 added this pull request to the merge queue May 13, 2026

Merged via the queue into main with commit 7102563 May 13, 2026
2 checks passed

ixxeL2097 deleted the renovate/major-38-traefik-beelink branch May 13, 2026 11:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(helm)!: Update chart traefik (37.4.0 → 38.0.2)#1504

feat(helm)!: Update chart traefik (37.4.0 → 38.0.2)#1504
ixxeL2097 merged 1 commit into
mainfrom
renovate/major-38-traefik-beelink

ixxel-bot Bot commented Apr 26, 2026 •

edited

Loading

Uh oh!

ixxel-bot Bot commented Apr 26, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

ixxel-bot Bot commented Apr 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v38.0.2

🚀 Features

🐛 Bug fixes

📦 Others

New Contributors

v38.0.1

🐛 Bug fixes

📦 Others

v38.0.0

💥 BREAKING CHANGES

🚀 Features

🐛 Bug fixes

📦 Others

New Contributors

Configuration

Uh oh!

ixxel-bot Bot commented Apr 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ixxel-bot Bot commented Apr 26, 2026 •

edited

Loading

`v38.0.2`

`v38.0.1`

`v38.0.0`

ixxel-bot Bot commented Apr 26, 2026 •

edited

Loading