Stable traefik fix kv upgrade (#9808)

* [stable/traefik] Fixes helm upgrades for kv providers

This will run the storeconfig job also on upgrades but without the `traefikConfiguration.GlobalConfiguration.ACME.OverrideCertificates=true` parameter, so the configuration gets updated but the certs are left alone.

It's still possible to override the certificates by importing an
`acme.json` file and using the `kvprovider.importAcme=true` parameter.

Fixes: #7172

Signed-off-by: Alwin Mark <a.mark@crowdfox.com>

* [stable/traefik] Don't delete storeconfig job

Rather add revision to the job to make it unique, so its possible to get
logs from it, even if it succeeded

Signed-off-by: Alwin Mark <a.mark@crowdfox.com>

stable/traefik/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: traefik
-version: 1.57.1
+version: 1.58.0
 appVersion: 1.7.6
 description: A Traefik based Kubernetes ingress controller with Let's Encrypt support
 keywords:

stable/traefik/templates/configmap.yaml

@@ -235,6 +235,9 @@ data:
     {{- if .Values.kvprovider.importAcme }}
     storageFile = "/acme/acme.json"
     {{- end }}
+    {{- if or (.Values.kvprovider.importAcme) (eq .Release.Revision 1) }}
+    OverrideCertificates = true
+    {{- end }}
     {{- else }}
     storage = "/acme/acme.json"
     {{- end }}

stable/traefik/templates/storeconfig-job.yaml

@@ -2,17 +2,16 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: "storeconfig-job"
+  name: "storeconfig-job-{{ .Release.Revision }}"
   annotations:
-    "helm.sh/hook": post-install
-    "helm.sh/hook-delete-policy": hook-succeeded
+    "helm.sh/hook": post-install,post-upgrade
   labels:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
     app: {{ template "traefik.name" . }}
 spec:
   template:
     metadata: 
-      name: "storeconfig-job"
+      name: "storeconfig-job-{{ .Release.Revision }}"
       labels:
         app: {{ template "traefik.name" . }}
         chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"

stable/traefik/values.yaml

@@ -246,8 +246,10 @@ acme:
       AWS_SECRET_ACCESS_KEY: ""
     vultr:
       VULTR_API_KEY: ""
-  ## Save ACME certs to a persistent volume. WARNING: If you do not do this, you will re-request
-  ## certs every time a pod (re-)starts and you WILL be rate limited!
+  ## Save ACME certs to a persistent volume.
+  ## WARNING: If you do not do this and you did not have configured
+  ## a kvprovider, you will re-request certs every time a pod (re-)starts
+  ## and you WILL be rate limited!
   persistence:
     enabled: true
     annotations: {}