chore(release): 🚀 publish v36.0.0

Author: mloiseleur

traefik/Changelog.md

@@ -1,5 +1,101 @@
 # Change Log
 
+## 36.0.0  ![AppVersion: v3.4.1](https://img.shields.io/static/v1?label=AppVersion&message=v3.4.1&color=success&logo=) ![Kubernetes: >=1.22.0-0](https://img.shields.io/static/v1?label=Kubernetes&message=%3E%3D1.22.0-0&color=informational&logo=kubernetes) ![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+**Release date:** 2025-06-06
+
+* fix(notes): update condition to display certificate persistence warning
+* fix(Traefik Proxy): supported `ingressRoute.*.annotations` breaks templating
+* fix(Traefik Proxy)!: strict opt-in on data collection
+* feat(deps): update traefik docker tag to v3.4.1
+* feat(Traefik Hub): add offline flag
+* chore(schema): 🔧 update following latest upstream release
+* chore(release): 🚀 publish v36.0.0
+
+**Upgrade Notes**
+
+There is a breaking change on `globalArguments` which has been replaced by `global.xx`, following upstream.
+See PR [#1436](https://github.com/traefik/traefik-helm-chart/pull/1436) for details.
+
+Following GDPR, anonymous stats usage has been disabled by default.
+Please take time to consider whether or not you wish to share anonymous data to help TraefikLabs improve Traefik Proxy.
+
+### Default value changes
+
+```diff
+diff --git a/traefik/values.yaml b/traefik/values.yaml
+index a9b74a3..9bcb400 100644
+--- a/traefik/values.yaml
++++ b/traefik/values.yaml
+@@ -185,6 +185,7 @@ gatewayClass:  # @schema additionalProperties: false
+   # -- Additional gatewayClass labels (e.g. for filtering gateway objects by custom labels)
+   labels: {}
+ 
++# -- Only dashboard & healthcheck IngressRoute are supported. It's recommended to create workloads CR outside of this Chart.
+ ingressRoute:
+   dashboard:
+     # -- Create an IngressRoute for the dashboard
+@@ -596,10 +597,25 @@ tracing:  # @schema additionalProperties: false
+         # -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
+         insecureSkipVerify: false
+ 
+-# -- Global command arguments to be passed to all traefik's pods
+-globalArguments:
+-  - "--global.checknewversion"
+-  - "--global.sendanonymoususage"
++global:  # @schema additionalProperties: false
++  checkNewVersion: true
++  # -- Please take time to consider whether or not you wish to share anonymous data with us
++  # See https://doc.traefik.io/traefik/contributing/data-collection/
++  sendAnonymousUsage: false
++  # -- Required for Azure Marketplace integration.
++  # See https://learn.microsoft.com/en-us/partner-center/marketplace-offers/azure-container-technical-assets-kubernetes?tabs=linux,linux2#update-the-helm-chart
++  azure:
++    # -- Enable specific values for Azure Marketplace
++    enabled: false
++    images:
++      proxy:
++        image: traefik
++        tag: latest
++        registry: docker.io/library
++      hub:
++        image: traefik-hub
++        tag: latest
++        registry: ghcr.io/traefik
+ 
+ # -- Additional arguments to be passed at Traefik's binary
+ # See [CLI Reference](https://docs.traefik.io/reference/static-configuration/cli/)
+@@ -941,6 +957,8 @@ hub:
+   # -- Name of `Secret` with key 'token' set to a valid license token.
+   # It enables API Gateway.
+   token: ""
++  # -- Disables all external network connections.
++  offline: false
+   # -- By default, Traefik Hub provider watches all namespaces. When using `rbac.namespaced`, it will watch helm release namespace and namespaces listed in this array.
+   namespaces: []  # @schema required:true
+   apimanagement:
+@@ -1109,19 +1127,3 @@ oci_meta:
+     hub:
+       image: traefik-hub
+       tag: latest
+-
+-# -- Required for Azure Marketplace integration.
+-# See https://learn.microsoft.com/en-us/partner-center/marketplace-offers/azure-container-technical-assets-kubernetes?tabs=linux,linux2#update-the-helm-chart
+-global:
+-  azure:
+-    # -- Enable specific values for Azure Marketplace
+-    enabled: false
+-    images:
+-      proxy:
+-        image: traefik
+-        tag: latest
+-        registry: docker.io/library
+-      hub:
+-        image: traefik-hub
+-        tag: latest
+-        registry: ghcr.io/traefik
+```
+
 ## 35.4.0  ![AppVersion: v3.4.0](https://img.shields.io/static/v1?label=AppVersion&message=v3.4.0&color=success&logo=) ![Kubernetes: >=1.22.0-0](https://img.shields.io/static/v1?label=Kubernetes&message=%3E%3D1.22.0-0&color=informational&logo=kubernetes) ![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
 
 **Release date:** 2025-05-23

traefik/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: traefik
 description: A Traefik based Kubernetes ingress controller
 type: application
-version: 35.4.0
+version: 36.0.0
 # renovate: image=traefik
 appVersion: v3.4.1
 kubeVersion: ">=1.22.0-0"
@@ -23,6 +23,10 @@ maintainers:
 icon: https://raw.githubusercontent.com/traefik/traefik/v2.3/docs/content/assets/img/traefik.logo.png
 annotations:
   artifacthub.io/changes: |
-    - "fix(CRDs): validation check on RootCA for both servertransport"
-    - "feat(Traefik Hub): :sparkles: automatically restart API Management pods on admission certificate change"
-    - "chore(release): :rocket: publish v35.4.0 and CRDs v1.8.1"
+    - "fix(notes): update condition to display certificate persistence warning"
+    - "fix(Traefik Proxy): supported `ingressRoute.*.annotations` breaks templating"
+    - "fix(Traefik Proxy)!: strict opt-in on data collection"
+    - "feat(deps): update traefik docker tag to v3.4.1"
+    - "feat(Traefik Hub): add offline flag"
+    - "chore(schema): 🔧 update following latest upstream release"
+    - "chore(release): 🚀 publish v36.0.0"

traefik/VALUES.md

@@ -1,6 +1,6 @@
 # traefik
 
-![Version: 35.4.0](https://img.shields.io/badge/Version-35.4.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v3.4.1](https://img.shields.io/badge/AppVersion-v3.4.1-informational?style=flat-square)
+![Version: 36.0.0](https://img.shields.io/badge/Version-36.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v3.4.1](https://img.shields.io/badge/AppVersion-v3.4.1-informational?style=flat-square)
 
 A Traefik based Kubernetes ingress controller
 
@@ -79,9 +79,10 @@ Kubernetes: `>=1.22.0-0`
 | gatewayClass.enabled | bool | `true` | When providers.kubernetesGateway.enabled and gateway.enabled, deploy a default gatewayClass |
 | gatewayClass.labels | object | `{}` | Additional gatewayClass labels (e.g. for filtering gateway objects by custom labels) |
 | gatewayClass.name | string | `""` | Set a custom name to GatewayClass |
-| global | object | `{"azure":{"enabled":false,"images":{"hub":{"image":"traefik-hub","registry":"ghcr.io/traefik","tag":"latest"},"proxy":{"image":"traefik","registry":"docker.io/library","tag":"latest"}}}}` | Required for Azure Marketplace integration. See https://learn.microsoft.com/en-us/partner-center/marketplace-offers/azure-container-technical-assets-kubernetes?tabs=linux,linux2#update-the-helm-chart |
+| global.azure | object | `{"enabled":false,"images":{"hub":{"image":"traefik-hub","registry":"ghcr.io/traefik","tag":"latest"},"proxy":{"image":"traefik","registry":"docker.io/library","tag":"latest"}}}` | Required for Azure Marketplace integration. See https://learn.microsoft.com/en-us/partner-center/marketplace-offers/azure-container-technical-assets-kubernetes?tabs=linux,linux2#update-the-helm-chart |
 | global.azure.enabled | bool | `false` | Enable specific values for Azure Marketplace |
-| globalArguments | list | `["--global.checknewversion","--global.sendanonymoususage"]` | Global command arguments to be passed to all traefik's pods |
+| global.checkNewVersion | bool | `true` |  |
+| global.sendAnonymousUsage | bool | `false` | Please take time to consider whether or not you wish to share anonymous data with us See https://doc.traefik.io/traefik/contributing/data-collection/ |
 | hostNetwork | bool | `false` | If hostNetwork is true, runs traefik in the host network namespace To prevent unschedulable pods due to port collisions, if hostNetwork=true and replicas>1, a pod anti-affinity is recommended and will be set if the affinity is left as default. |
 | hub.apimanagement.admission.customWebhookCertificate | object | `{}` | Set custom certificate for the WebHook admission server. The certificate should be specified with _tls.crt_ and _tls.key_ in base64 encoding. |
 | hub.apimanagement.admission.listenAddr | string | `""` | WebHook admission server listen address. Default: "0.0.0.0:9943". |
@@ -156,6 +157,7 @@ Kubernetes: `>=1.22.0-0`
 | image.repository | string | `"traefik"` | Traefik image repository |
 | image.tag | string | `nil` | defaults to appVersion. It's used for version checking, even prefixed with experimental- or latest-. When a digest is required, `versionOverride` can be used to set the version. |
 | ingressClass | object | `{"enabled":true,"isDefaultClass":true,"name":""}` | Create a default IngressClass for Traefik |
+| ingressRoute | object | `{"dashboard":{"annotations":{},"enabled":false,"entryPoints":["traefik"],"labels":{},"matchRule":"PathPrefix(`/dashboard`) || PathPrefix(`/api`)","middlewares":[],"services":[{"kind":"TraefikService","name":"api@internal"}],"tls":{}},"healthcheck":{"annotations":{},"enabled":false,"entryPoints":["traefik"],"labels":{},"matchRule":"PathPrefix(`/ping`)","middlewares":[],"services":[{"kind":"TraefikService","name":"ping@internal"}],"tls":{}}}` | Only dashboard & healthcheck IngressRoute are supported. It's recommended to create workloads CR outside of this Chart. |
 | ingressRoute.dashboard.annotations | object | `{}` | Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class) |
 | ingressRoute.dashboard.enabled | bool | `false` | Create an IngressRoute for the dashboard |
 | ingressRoute.dashboard.entryPoints | list | `["traefik"]` | Specify the allowed entrypoints to use for the dashboard ingress route, (e.g. traefik, web, websecure). By default, it's using traefik entrypoint, which is not exposed. /!\ Do not expose your dashboard without any protection over the internet /!\ |