feat(helm)!: Update Chart traefik (37.4.0 → 38.0.2) #1113

pipelines-github-app · 2025-12-19T03:29:07Z

This PR contains the following updates:

Package	Update	Change
traefik (source)	major	`37.4.0` -> `38.0.2`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

traefik/traefik-helm-chart (traefik)

`v38.0.2`

Compare Source

Upgrades Notes

There is a breaking change on CRDs between Traefik Hub v3.18.0 and inferior and the CRDs of Traefik Hub v3.19.0+ preview versions (ea & rc).
With this release, we remove the CRDs of Traefik Hub v3.19.0 preview versions.

When Traefik Hub v3.19.0 is GA, we will release a new major version of this Chart that will only accept Traefik Hub v3.19.0+ versions.

🚀 Features

feat(deps): update traefik docker tag to v3.6.6 #1610 by @renovate[bot]

🐛 Bug fixes

fix(CRDs): enforce the fact that this Chart does not support Traefik Hub v3.19.0 #1616 by @mloiseleur
fix(security): set the seccomp profile to RuntimeDefault #1618 by @kkrypt0nn

📦 Others

docs(CRDs): add deprecation notice #1617 by @mloiseleur
chore(release): publish traefik 38.0.2 and crds 1.13.1 #1619 by @mloiseleur

New Contributors

@kkrypt0nn made their first contribution in #1618

Full Changelog: traefik/traefik-helm-chart@v38.0.1...v38.0.2

`v38.0.1`

Compare Source

🐛 Bug fixes

fix(ports): 🐛 http.encodedCharacters on custom entrypoints #1606 by @mloiseleur
fix(ports): 🐛 add missing http.maxHeaderBytes option #1604 by @mloiseleur

📦 Others

chore(release): 🚀 publish traefik 38.0.1 #1608 by @mloiseleur

`v38.0.0`

Compare Source

Upgrades Notes

[!IMPORTANT]
CRDs has to be upgraded before the Chart. See UPGRADING instructions.

There are two breaking changes in this release:

Traefik Proxy v3.6.4+ contains a security fix that is also a breaking change. See upstream documentation for more details.
PR #1596 align kubernetesIngressNginx provider setting with upstream. There is a before / after example in the PR description and PR #1587 align labelSelector syntax between providers

[!NOTE]
If you need to restore Traefik behavior of v3.6.3 or inferior, it can be set with values.

Here is an example on websecure entrypoint:

ports:
  websecure:
    http:
      encodedCharacters:
        allowEncodedSlash: true
        allowEncodedBackSlash: true
        allowEncodedNullCharacter: true
        allowEncodedSemicolon: true
        allowEncodedPercent: true
        allowEncodedQuestionMark: true
        allowEncodedHash: true
      sanitizePath: false

This is not recommended, it may expose you to GHSA-gm3x-23wp-hc2c.

💥 BREAKING CHANGES

fix(providers)!: align labelSelector for kubernetesGateway and knative #1587 by @shubhamch71
fix(nginx)!: 🐛 align provider settings and provide required rbac #1596 by @mloiseleur

🚀 Features

feat(CRDs): update Traefik Hub to v1.24.1, with required RBACs #1571 by @jspdown
feat(ports): enforce schema #1586 by @remyj38
feat(CRDs): update Traefik Hub to v1.24.2 #1585 by @traefiker
feat(providers): ✨ enforce schema #1595 by @mloiseleur
feat(security): ✨ 🔒️ add support for request path options of traefik 3.6.4+ #1594 by @mloiseleur
feat(deps): update traefik docker tag to v3.6.4 #1590 by @renovate[bot]
feat(deps): update traefik docker tag to v3.6.5 #1599 by @renovate[bot]

🐛 Bug fixes

fix: update error message for maxUnavailable validation #1591 by @lucasra1
fix(notes): minor typo #1593 by @rndmh3ro
fix(pvc): allow empty storageClassName #1579 by @fopina
fix(providers): ✨ enforce schema for all providers #1601 by @mloiseleur

📦 Others

chore(deps): update actions/checkout action to v6 #1573 by @renovate[bot]
docs: Update EXAMPLES.md with REGIONAL load balancer note for Digital Ocean #1574 by @kamikazechaser
chore(release): 🚀 publish traefik 38.0.0 and crds 1.13.0 #1600 by @mloiseleur

New Contributors

@shubhamch71 made their first contribution in #1587
@kamikazechaser made their first contribution in #1574
@lucasra1 made their first contribution in #1591
@remyj38 made their first contribution in #1586
@rndmh3ro made their first contribution in #1593
@fopina made their first contribution in #1579

Full Changelog: traefik/traefik-helm-chart@v37.4.0...v38.0.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

pipelines-github-app · 2025-12-19T03:29:24Z

--- main/traefik_gitops_manifests_traefik_genmachine_manifest_main.yaml	2026-02-12 04:55:08.154508504 +0000
+++ pr/traefik_gitops_manifests_traefik_genmachine_manifest_pr.yaml	2026-02-12 04:55:07.177522980 +0000
@@ -1,52 +1,52 @@
 ---
 # Source: traefik/charts/traefik/templates/poddisruptionbudget.yaml
 apiVersion: policy/v1beta1
 kind: PodDisruptionBudget
 metadata:
   name: traefik
   namespace: default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
 spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: traefik
       app.kubernetes.io/instance: traefik-default
   maxUnavailable: 1
 ---
 # Source: traefik/charts/traefik/templates/rbac/serviceaccount.yaml
 kind: ServiceAccount
 apiVersion: v1
 metadata:
   name: traefik
   namespace: default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
   annotations:
 automountServiceAccountToken: false
 ---
 # Source: traefik/charts/traefik/templates/rbac/clusterrole.yaml
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: traefik-default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
       - ""
     resources:
       - configmaps
       - nodes
       - services
     verbs:
       - get
@@ -84,20 +84,27 @@
       - list
       - watch
   - apiGroups:
       - extensions
       - networking.k8s.io
     resources:
       - ingresses/status
     verbs:
       - update
   - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - list
+      - watch
+  - apiGroups:
       - traefik.io
     resources:
       - ingressroutes
       - ingressroutetcps
       - ingressrouteudps
       - middlewares
       - middlewaretcps
       - serverstransports
       - serverstransporttcps
       - tlsoptions
@@ -109,42 +116,42 @@
       - watch
 ---
 # Source: traefik/charts/traefik/templates/rbac/clusterrolebinding.yaml
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: traefik-default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: traefik-default
 subjects:
   - kind: ServiceAccount
     name: traefik
     namespace: default
 ---
 # Source: traefik/charts/traefik/templates/service-metrics.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: traefik-metrics
   namespace: default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
     app.kubernetes.io/component: metrics
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
   annotations:
 spec:
   type: ClusterIP
   selector:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
   ports:
   - port: 9100
     name: metrics
@@ -153,21 +160,21 @@
 ---
 # Source: traefik/charts/traefik/templates/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: traefik
   namespace: default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
   annotations:
 spec:
   type: LoadBalancer
   selector:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
   ipFamilyPolicy: PreferDualStack
   ports:
   - port: 80
@@ -181,42 +188,42 @@
 ---
 # Source: traefik/charts/traefik/templates/deployment.yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: traefik
   namespace: default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
   annotations:
 spec:
   replicas: 2
   selector:
     matchLabels:
       app.kubernetes.io/name: traefik
       app.kubernetes.io/instance: traefik-default
   strategy:
     type: RollingUpdate
     rollingUpdate:
       maxUnavailable: 0
       maxSurge: 1
   minReadySeconds: 0
   template: 
     metadata:
       annotations:
       labels:
         app.kubernetes.io/name: traefik
         app.kubernetes.io/instance: traefik-default
-        helm.sh/chart: traefik-37.4.0
+        helm.sh/chart: traefik-38.0.2
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: traefik
       automountServiceAccountToken: true
       terminationGracePeriodSeconds: 60
       hostNetwork: false
       containers:
       - image: docker.io/traefik:v3.6.8
         imagePullPolicy: IfNotPresent
         name: traefik
@@ -315,31 +322,33 @@
           key: node-role.kubernetes.io/control-plane
           operator: Exists
         - effect: NoSchedule
           key: node-role.kubernetes.io/master
           operator: Exists
       priorityClassName: system-cluster-critical
       securityContext:
         runAsGroup: 65532
         runAsNonRoot: true
         runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
 ---
 # Source: traefik/charts/traefik/templates/ingressclass.yaml
 apiVersion: networking.k8s.io/v1
 kind: IngressClass
 metadata:
   annotations:
     ingressclass.kubernetes.io/is-default-class: "true"
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
   name: traefik
 spec:
   controller: traefik.io/ingress-controller
 ---
 # Source: traefik/templates/wildcard-genmachine.yaml
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: genmachine-wildcard
@@ -477,21 +486,21 @@
 # Source: traefik/charts/traefik/templates/servicemonitor.yaml
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: traefik
   namespace: default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
     app.kubernetes.io/component: metrics
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
     release: prometheus
 spec:
   jobLabel: traefik
   endpoints:
     - targetPort: metrics
       path: /metrics
   namespaceSelector:
     matchNames:
       - default
@@ -503,15 +512,15 @@
 ---
 # Source: traefik/charts/traefik/templates/tlsstore.yaml
 apiVersion: traefik.io/v1alpha1
 kind: TLSStore
 metadata:
   name: default
   namespace: default
   labels:
     app.kubernetes.io/name: traefik
     app.kubernetes.io/instance: traefik-default
-    helm.sh/chart: traefik-37.4.0
+    helm.sh/chart: traefik-38.0.2
     app.kubernetes.io/managed-by: Helm
 spec:
   defaultCertificate:
     secretName: genmachine-wildcard

| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | helm | traefik | 37.4.0 | 38.0.2 | Co-authored-by: renovate[bot] <renovate@whitesourcesoftware.com>

pipelines-github-app bot added app/traefik Changes made to Traefik application env/genmachine Changes made in the Talos cluster renovate/helm Changes related to Helm Chart update type/major labels Dec 19, 2025

pipelines-github-app bot force-pushed the renovate/major-38-traefik-genmachine branch 2 times, most recently from 44401c5 to e75719b Compare December 20, 2025 03:20

pipelines-github-app bot changed the title ~~feat(helm)!: Update Chart traefik (37.4.0 → 38.0.0)~~ feat(helm)!: Update Chart traefik (37.4.0 → 38.0.1) Dec 20, 2025

pipelines-github-app bot force-pushed the renovate/major-38-traefik-genmachine branch 5 times, most recently from 16f3e11 to 4ac8ee1 Compare December 26, 2025 03:56

pipelines-github-app bot force-pushed the renovate/major-38-traefik-genmachine branch 3 times, most recently from d7b5260 to 767385a Compare January 3, 2026 03:53

pipelines-github-app bot force-pushed the renovate/major-38-traefik-genmachine branch 5 times, most recently from 9242885 to 2a75ef1 Compare January 8, 2026 04:00

pipelines-github-app bot changed the title ~~feat(helm)!: Update Chart traefik (37.4.0 → 38.0.1)~~ feat(helm)!: Update Chart traefik (37.4.0 → 38.0.2) Jan 9, 2026

pipelines-github-app bot force-pushed the renovate/major-38-traefik-genmachine branch 5 times, most recently from b7b179e to 985aaef Compare January 14, 2026 04:07

pipelines-github-app bot force-pushed the renovate/major-38-traefik-genmachine branch 5 times, most recently from 9538769 to d3805ee Compare January 20, 2026 04:05

pipelines-github-app bot force-pushed the renovate/major-38-traefik-genmachine branch 4 times, most recently from 8d6364a to 3aca65b Compare January 28, 2026 04:04

pipelines-github-app bot force-pushed the renovate/major-38-traefik-genmachine branch 6 times, most recently from 8158469 to f90d422 Compare February 4, 2026 04:27

pipelines-github-app bot force-pushed the renovate/major-38-traefik-genmachine branch 5 times, most recently from 3c3a9ba to 9dd76d4 Compare February 11, 2026 04:58

feat(helm)!: Update Chart traefik (37.4.0 → 38.0.2)

217de19

| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | helm | traefik | 37.4.0 | 38.0.2 | Co-authored-by: renovate[bot] <renovate@whitesourcesoftware.com>

pipelines-github-app bot force-pushed the renovate/major-38-traefik-genmachine branch from 9dd76d4 to 217de19 Compare February 12, 2026 04:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(helm)!: Update Chart traefik (37.4.0 → 38.0.2) #1113

feat(helm)!: Update Chart traefik (37.4.0 → 38.0.2) #1113

pipelines-github-app bot commented Dec 19, 2025 •

edited

Loading

Uh oh!

pipelines-github-app bot commented Dec 19, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

feat(helm)!: Update Chart traefik (37.4.0 → 38.0.2) #1113

Are you sure you want to change the base?

feat(helm)!: Update Chart traefik (37.4.0 → 38.0.2) #1113

Conversation

pipelines-github-app bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v38.0.2

🚀 Features

🐛 Bug fixes

📦 Others

New Contributors

v38.0.1

🐛 Bug fixes

📦 Others

v38.0.0

💥 BREAKING CHANGES

🚀 Features

🐛 Bug fixes

📦 Others

New Contributors

Configuration

Uh oh!

pipelines-github-app bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

pipelines-github-app bot commented Dec 19, 2025 •

edited

Loading

`v38.0.2`

`v38.0.1`

`v38.0.0`

pipelines-github-app bot commented Dec 19, 2025 •

edited

Loading