[stable/traefik] Use unprivileged ports (#13361)

Signed-off-by: Sebastian Poehn <sebastian.poehn@gmail.com>

stable/traefik/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: traefik
-version: 1.71.2
+version: 1.72.0
 appVersion: 1.7.12
 description: A Traefik based Kubernetes ingress controller with Let's Encrypt support
 keywords:

stable/traefik/README.md

@@ -108,6 +108,7 @@ The following table lists the configurable parameters of the Traefik chart and t
 | `rbac.enabled`                         | Whether to enable RBAC with a specific cluster role and binding for Traefik                                                  | `false`                                           |
 | `deploymentStrategy`                   | Specify deployment spec rollout strategy                                                                                     | `{}`                                              |
 | `securityContext`                      | Security context                                                                                                             | `{}`                                              |
+| `useNonPriviledgedPorts`               | Use non privileged ports to listen. Needed if container is not running as root                                               | `false`                                           |
 | `env`                                  | Environment variables for the container                                                                                      | `{}`                                              |
 | `nodeSelector`                         | Node labels for pod assignment                                                                                               | `{}`                                              |
 | `affinity`                             | Affinity settings                                                                                                            | `{}`                                              |

stable/traefik/templates/_helpers.tpl

@@ -113,6 +113,7 @@ Create custom cipherSuites block
           ]
 {{- end -}}
 
+{{/*
 Create the block for RootCAs.
 */}}
 {{- define "traefik.rootCAs" -}}
@@ -123,3 +124,25 @@ Create the block for RootCAs.
 	   {{- end -}}
          ]
 {{- end -}}
+
+{{/*
+Helper for containerPort (http)
+*/}}
+{{- define "traefik.containerPort.http" -}}
+	{{- if .Values.useNonPriviledgedPorts -}}
+	6080
+	{{- else -}}
+	80
+	{{- end -}}
+{{- end -}}
+
+{{/*
+Helper for containerPort (https)
+*/}}
+{{- define "traefik.containerPort.https" -}}
+	{{- if .Values.useNonPriviledgedPorts -}}
+	6443
+	{{- else -}}
+	443
+	{{- end -}}
+{{- end -}}

stable/traefik/templates/configmap.yaml

@@ -31,7 +31,7 @@ data:
     {{- end }}
     [entryPoints]
       [entryPoints.http]
-      address = ":80"
+      address = ":{{ template "traefik.containerPort.http" . }}"
       compress = {{ .Values.gzip.enabled }}
       {{- if .Values.forwardAuth }}
       {{- if has "http" .Values.forwardAuth.entryPoints }}
@@ -64,7 +64,7 @@ data:
       {{- if .Values.whiteListSourceRange }}
       {{ template "traefik.whiteListSourceRange" . }}
       {{- end }}
-      address = ":443"
+      address = ":{{ template "traefik.containerPort.https" . }}"
       compress = {{ .Values.gzip.enabled }}
       {{- if .Values.forwardAuth }}
       {{- if has "https" .Values.forwardAuth.entryPoints }}

stable/traefik/templates/deployment.yaml

@@ -84,7 +84,7 @@ spec:
         readinessProbe:
           httpGet:
             path: /ping
-            port: 80
+            port: {{ template "traefik.containerPort.http" . }}
           failureThreshold: 1
           initialDelaySeconds: 10
           periodSeconds: 10
@@ -93,7 +93,7 @@ spec:
         livenessProbe:
           httpGet:
             path: /ping
-            port: 80
+            port: {{ template "traefik.containerPort.http" . }}
           failureThreshold: 3
           initialDelaySeconds: 10
           periodSeconds: 10
@@ -139,7 +139,7 @@ spec:
         {{- end }}
         ports:
         - name: http
-          containerPort: 80
+          containerPort: {{ template "traefik.containerPort.http" . }}
           {{- if .Values.deployment.hostPort.httpEnabled }}
           hostPort: {{ default 80 .Values.deployment.hostPort.httpPort }}
           {{- end }}
@@ -148,7 +148,7 @@ spec:
           containerPort: 8880
           protocol: TCP
         - name: https
-          containerPort: 443
+          containerPort: {{ template "traefik.containerPort.https" . }}
           {{- if .Values.deployment.hostPort.httpsEnabled }}
           hostPort: {{ default 443 .Values.deployment.hostPort.httpsPort }}
           {{- end }}

stable/traefik/values.yaml

@@ -46,6 +46,7 @@ deploymentStrategy: {}
   # type: RollingUpdate
 
 securityContext: {}
+useNonPriviledgedPorts: false
 env: {}
 
 nodeSelector: {}