diff --git a/stable/traefik/Chart.yaml b/stable/traefik/Chart.yaml index 998e1b6f65..a4e2eaa94e 100644 --- a/stable/traefik/Chart.yaml +++ b/stable/traefik/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: traefik -version: 1.73.1 +version: 1.74.0 appVersion: 1.7.12 description: A Traefik based Kubernetes ingress controller with Let's Encrypt support keywords: diff --git a/stable/traefik/README.md b/stable/traefik/README.md index a3934f1d5c..5537f2b29c 100644 --- a/stable/traefik/README.md +++ b/stable/traefik/README.md @@ -134,6 +134,9 @@ The following table lists the configurable parameters of the Traefik chart and t | `ssl.defaultCert` | Base64 encoded default certificate | A self-signed certificate | | `ssl.defaultKey` | Base64 encoded private key for the certificate above | The private key for the certificate above | | `ssl.auth.basic` | Basic auth for all SSL endpoints, see Authentication section | unset by default; this means basic auth is disabled | +| `ssl.mtls.enabled` | Whether to enable mutual TLS. See [here](https://docs.traefik.io/configuration/entrypoints/#tls-mutual-authentication). | false | +| `ssl.mtls.optional` | When ssl.mtls.enabled is set, whether to accept client certificates not signed by one of the CAs specified in ssl.mtls.clientCaCerts. | false | +| `ssl.mtls.clientCaCerts` | When ssl.mtls.enabled is set, an array of client CA certificates, each in PEM format. | [] | | `acme.enabled` | Whether to use Let's Encrypt to obtain certificates | `false` | | `acme.keyType` | KeyType used for generating certificate private key. Allow value 'EC256', 'EC384', 'RSA2048', 'RSA4096', 'RSA8192'. | `RSA4096` | | `acme.challengeType` | Type of ACME challenge to perform domain validation. `tls-sni-01` (deprecated), `tls-alpn-01` (recommended), `http-01` or `dns-01` | `tls-sni-01` | diff --git a/stable/traefik/templates/_helpers.tpl b/stable/traefik/templates/_helpers.tpl index 128e89ee77..939212ec5a 100644 --- a/stable/traefik/templates/_helpers.tpl +++ b/stable/traefik/templates/_helpers.tpl @@ -125,6 +125,18 @@ Create the block for RootCAs. ] {{- end -}} +{{/* +Create the block for mTLS ClientCAs. +*/}} +{{- define "traefik.ssl.mtls.clientCAs" -}} + files = [ + {{- range $idx, $_ := .Values.ssl.mtls.clientCaCerts }} + {{- if $idx }}, {{ end }} + {{- printf "/mtls/clientCaCert-%d.crt" $idx | quote }} + {{- end -}} + ] +{{- end -}} + {{/* Helper for containerPort (http) */}} diff --git a/stable/traefik/templates/client-ca-configmap.yaml b/stable/traefik/templates/client-ca-configmap.yaml new file mode 100644 index 0000000000..99f01b3144 --- /dev/null +++ b/stable/traefik/templates/client-ca-configmap.yaml @@ -0,0 +1,18 @@ +{{- if and .Values.ssl.enabled .Values.ssl.mtls }} +{{- if .Values.ssl.mtls.enabled }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "traefik.fullname" . }}-client-ca-certs + labels: + app: {{ template "traefik.name" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: {{ .Release.Name | quote }} + heritage: {{ .Release.Service | quote }} +type: Opaque +data: +{{- range $idx, $caCert := .Values.ssl.mtls.clientCaCerts }} + clientCaCert-{{ $idx }}.crt: {{ $caCert | quote }} +{{- end }} +{{- end }} +{{- end }} diff --git a/stable/traefik/templates/configmap.yaml b/stable/traefik/templates/configmap.yaml index 4d79823743..f76e02ff03 100644 --- a/stable/traefik/templates/configmap.yaml +++ b/stable/traefik/templates/configmap.yaml @@ -92,6 +92,13 @@ data: {{- if .Values.ssl.sniStrict }} sniStrict = true {{- end }} + {{- if .Values.ssl.mtls }} + {{- if .Values.ssl.mtls.enabled }} + [entryPoints.https.tls.ClientCA] + {{ template "traefik.ssl.mtls.clientCAs" . }} + optional = {{ .Values.ssl.mtls.optional }} + {{- end }} + {{- end }} [[entryPoints.https.tls.certificates]] CertFile = "/ssl/tls.crt" KeyFile = "/ssl/tls.key" diff --git a/stable/traefik/templates/deployment.yaml b/stable/traefik/templates/deployment.yaml index 28c338030c..3cbb19b257 100644 --- a/stable/traefik/templates/deployment.yaml +++ b/stable/traefik/templates/deployment.yaml @@ -122,10 +122,18 @@ spec: {{- if .Values.extraVolumeMounts }}{{ toYaml .Values.extraVolumeMounts | trim | nindent 8 }}{{ end }} - mountPath: /config name: config - {{- if and .Values.ssl.enabled (not .Values.ssl.upstream) }} + {{- if .Values.ssl.enabled }} + {{- if not .Values.ssl.upstream }} - mountPath: /ssl name: ssl {{- end }} + {{- if .Values.ssl.mtls }} + {{- if .Values.ssl.mtls.enabled }} + - mountPath: /mtls + name: mtls + {{- end }} + {{- end }} + {{- end }} {{- if .Values.acme.enabled }} - mountPath: /acme name: acme @@ -173,11 +181,20 @@ spec: - name: config configMap: name: {{ template "traefik.fullname" . }} - {{- if and .Values.ssl.enabled (not .Values.ssl.upstream) }} + {{- if .Values.ssl.enabled }} + {{- if not .Values.ssl.upstream }} - name: ssl secret: secretName: {{ template "traefik.fullname" . }}-default-cert {{- end }} + {{- if .Values.ssl.mtls }} + {{- if .Values.ssl.mtls.enabled }} + - name: mtls + configMap: + name: {{ template "traefik.fullname" . }}-client-ca-certs + {{- end }} + {{- end }} + {{- end }} {{- if .Values.acme.enabled }} - name: acme {{- if .Values.acme.persistence.enabled }} diff --git a/stable/traefik/values.yaml b/stable/traefik/values.yaml index 9b4bedd679..c313c27174 100644 --- a/stable/traefik/values.yaml +++ b/stable/traefik/values.yaml @@ -141,6 +141,14 @@ ssl: # basic: # testuser: $apr1$JXRA7j2s$LpVns9vsme8FHN0r.aSt11 + # mtls: + # enabled: true + # optional: false + # clientCaCerts: [] + # # When mTLS is enabled, the set of CA certificates used to validate client TLS certificates. + # # https://docs.traefik.io/configuration/entrypoints/#tls-mutual-authentication + # # CA certificates should be in PEM format. + kvprovider: ## If you want to run Traefik in HA mode, you will need to setup a KV Provider. Therefore you can choose one of ## * etcd