refactor(charts): BREAKING CHANGE (#2836)

* Update Apps with new Common version

* Patch with the secret fixes from common

* fix amd

charts/stable/traefik/templates/_args.tpl

@@ -0,0 +1,155 @@
+{{/* Define the args */}}
+{{- define "traefik.args" -}}
+args:
+  {{/* merge all ports */}}
+  {{- $ports := dict }}
+  {{- range $.Values.service }}
+  {{- range $name, $value := .ports }}
+  {{- $_ := set $ports $name $value }}
+  {{- end }}
+  {{- end }}
+  {{/* start of actual arguments */}}
+  {{- with .Values.globalArguments }}
+  {{- range . }}
+  - {{ . | quote }}
+  {{- end }}
+  {{- end }}
+  {{- range $name, $config := $ports }}
+  {{- if $config }}
+  {{- if or ( eq $config.protocol "HTTP" ) ( eq $config.protocol "HTTPS" ) ( eq $config.protocol "TCP" ) }}
+  {{- $_ := set $config "protocol" "TCP" }}
+  {{- end }}
+  - "--entryPoints.{{$name}}.address=:{{ $config.port }}/{{ default "tcp" $config.protocol | lower }}"
+  {{- end }}
+  {{- end }}
+  - "--api.dashboard=true"
+  - "--ping=true"
+  {{- if .Values.metrics }}
+  {{- if .Values.metrics.datadog }}
+  - "--metrics.datadog=true"
+  - "--metrics.datadog.address={{ .Values.metrics.datadog.address }}"
+  {{- end }}
+  {{- if .Values.metrics.influxdb }}
+  - "--metrics.influxdb=true"
+  - "--metrics.influxdb.address={{ .Values.metrics.influxdb.address }}"
+  - "--metrics.influxdb.protocol={{ .Values.metrics.influxdb.protocol }}"
+  {{- end }}
+  {{- if .Values.metrics.prometheus }}
+  - "--metrics.prometheus=true"
+  - "--metrics.prometheus.entrypoint={{ .Values.metrics.prometheus.entryPoint }}"
+  {{- end }}
+  {{- if .Values.metrics.statsd }}
+  - "--metrics.statsd=true"
+  - "--metrics.statsd.address={{ .Values.metrics.statsd.address }}"
+  {{- end }}
+  {{- end }}
+  {{- if .Values.providers.kubernetesCRD.enabled }}
+  - "--providers.kubernetescrd"
+  {{- end }}
+  {{- if .Values.providers.kubernetesIngress.enabled }}
+  - "--providers.kubernetesingress"
+  {{- if .Values.providers.kubernetesIngress.publishedService.enabled }}
+  - "--providers.kubernetesingress.ingressendpoint.publishedservice={{ template "providers.kubernetesIngress.publishedServicePath" . }}"
+  {{- end }}
+  {{- if .Values.providers.kubernetesIngress.labelSelector }}
+  - "--providers.kubernetesingress.labelSelector={{ .Values.providers.kubernetesIngress.labelSelector }}"
+  {{- end }}
+  {{- end }}
+  {{- if and .Values.rbac.enabled .Values.rbac.namespaced }}
+  {{- if .Values.providers.kubernetesCRD.enabled }}
+  - "--providers.kubernetescrd.namespaces={{ template "providers.kubernetesCRD.namespaces" . }}"
+  {{- end }}
+  {{- if .Values.providers.kubernetesIngress.enabled }}
+  - "--providers.kubernetesingress.namespaces={{ template "providers.kubernetesIngress.namespaces" . }}"
+  {{- end }}
+  {{- end }}
+  {{- if .Values.ingressClass.enabled }}
+  - "--providers.kubernetesingress.ingressclass={{ .Release.Name }}"
+  {{- end }}
+  {{- range $entrypoint, $config := $ports }}
+  {{/* add args for forwardedHeaders support */}}
+  {{- if $config.forwardedHeaders.enabled }}
+  {{- if not ( empty $config.forwardedHeaders.trustedIPs ) }}
+  - "--entrypoints.{{ $entrypoint }}.forwardedHeaders.trustedIPs={{ join "," $config.forwardedHeaders.trustedIPs }}"
+  {{- end }}
+  {{- if $config.forwardedHeaders.insecureMode }}
+  - "--entrypoints.{{ $entrypoint }}.forwardedHeaders.insecure"
+  {{- end }}
+  {{- end }}
+  {{/* end forwardedHeaders configuration */}}
+  {{- if $config.redirectTo }}
+  {{- $toPort := index $ports $config.redirectTo }}
+  - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.to=:{{ $toPort.port }}"
+  - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.scheme=https"
+  {{- else if $config.redirectPort }}
+  {{ if gt $config.redirectPort 0.0 }}
+  - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.to=:{{ $config.redirectPort }}"
+  - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.scheme=https"
+  {{- end }}
+  {{- end }}
+  {{- if or ( $config.tls ) ( eq $config.protocol "HTTPS" ) }}
+  {{- if or ( $config.tls.enabled ) ( eq $config.protocol "HTTPS" ) }}
+  - "--entrypoints.{{ $entrypoint }}.http.tls=true"
+  {{- if $config.tls.options }}
+  - "--entrypoints.{{ $entrypoint }}.http.tls.options={{ $config.tls.options }}"
+  {{- end }}
+  {{- if $config.tls.certResolver }}
+  - "--entrypoints.{{ $entrypoint }}.http.tls.certResolver={{ $config.tls.certResolver }}"
+  {{- end }}
+  {{- if $config.tls.domains }}
+  {{- range $index, $domain := $config.tls.domains }}
+  {{- if $domain.main }}
+  - "--entrypoints.{{ $entrypoint }}.http.tls.domains[{{ $index }}].main={{ $domain.main }}"
+  {{- end }}
+  {{- if $domain.sans }}
+  - "--entrypoints.{{ $entrypoint }}.http.tls.domains[{{ $index }}].sans={{ join "," $domain.sans }}"
+  {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- with .Values.logs }}
+  - "--log.format={{ .general.format }}"
+  {{- if ne .general.level "ERROR" }}
+  - "--log.level={{ .general.level | upper }}"
+  {{- end }}
+  {{- if .access.enabled }}
+  - "--accesslog=true"
+  - "--accesslog.format={{ .access.format }}"
+  {{- if .access.bufferingsize }}
+  - "--accesslog.bufferingsize={{ .access.bufferingsize }}"
+  {{- end }}
+  {{- if .access.filters }}
+  {{- if .access.filters.statuscodes }}
+  - "--accesslog.filters.statuscodes={{ .access.filters.statuscodes }}"
+  {{- end }}
+  {{- if .access.filters.retryattempts }}
+  - "--accesslog.filters.retryattempts"
+  {{- end }}
+  {{- if .access.filters.minduration }}
+  - "--accesslog.filters.minduration={{ .access.filters.minduration }}"
+  {{- end }}
+  {{- end }}
+  - "--accesslog.fields.defaultmode={{ .access.fields.general.defaultmode }}"
+  {{- range $fieldname, $fieldaction := .access.fields.general.names }}
+  - "--accesslog.fields.names.{{ $fieldname }}={{ $fieldaction }}"
+  {{- end }}
+  - "--accesslog.fields.headers.defaultmode={{ .access.fields.headers.defaultmode }}"
+  {{- range $fieldname, $fieldaction := .access.fields.headers.names }}
+  - "--accesslog.fields.headers.names.{{ $fieldname }}={{ $fieldaction }}"
+  {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.pilot.enabled }}
+  - "--pilot.token={{ .Values.pilot.token }}"
+  {{- end }}
+  {{- if hasKey .Values.pilot "dashboard" }}
+  - "--pilot.dashboard={{ .Values.pilot.dashboard }}"
+  {{- end }}
+  {{- with .Values.additionalArguments }}
+  {{- range . }}
+  - {{ . | quote }}
+  {{- end }}
+  {{- end }}
+{{- end -}}

charts/stable/traefik/templates/_helpers.tpl

@@ -0,0 +1,22 @@
+{{/*
+Construct the path for the providers.kubernetesingress.ingressendpoint.publishedservice.
+By convention this will simply use the <namespace>/<service-name> to match the name of the
+service generated.
+Users can provide an override for an explicit service they want bound via `.Values.providers.kubernetesIngress.publishedService.pathOverride`
+*/}}
+{{- define "providers.kubernetesIngress.publishedServicePath" -}}
+{{- $fullName := include "tc.common.names.fullname" . -}}
+{{- $defServiceName := printf "%s/%s-tcp" .Release.Namespace $fullName -}}
+{{- $servicePath := default $defServiceName .Values.providers.kubernetesIngress.publishedService.pathOverride }}
+{{- print $servicePath | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Construct a comma-separated list of whitelisted namespaces
+*/}}
+{{- define "providers.kubernetesIngress.namespaces" -}}
+{{- default .Release.Namespace (join "," .Values.providers.kubernetesIngress.namespaces) }}
+{{- end -}}
+{{- define "providers.kubernetesCRD.namespaces" -}}
+{{- default .Release.Namespace (join "," .Values.providers.kubernetesCRD.namespaces) }}
+{{- end -}}

charts/stable/traefik/templates/_ingressclass.tpl

@@ -0,0 +1,24 @@
+{{/* Define the ingressClass */}}
+{{- define "traefik.ingressClass" -}}
+---
+{{ if .Values.ingressClass.enabled }}
+  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1/IngressClass" }}
+apiVersion: networking.k8s.io/v1
+  {{- else if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/IngressClass" }}
+apiVersion: networking.k8s.io/v1beta1
+  {{- else if or (eq .Values.ingressClass.fallbackApiVersion "v1beta1") (eq .Values.ingressClass.fallbackApiVersion "v1") }}
+apiVersion: {{ printf "networking.k8s.io/%s" .Values.ingressClass.fallbackApiVersion }}
+  {{- else }}
+  {{- fail "\n\n ERROR: You must have at least networking.k8s.io/v1beta1 to use ingressClass" }}
+  {{- end }}
+kind: IngressClass
+metadata:
+  annotations:
+    ingressclass.kubernetes.io/is-default-class: {{ .Values.ingressClass.isDefaultClass | quote }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+  name: {{ .Release.Name }}
+spec:
+  controller: traefik.io/ingress-controller
+{{- end }}
+{{- end }}

charts/stable/traefik/templates/_ingressroute.tpl

@@ -0,0 +1,25 @@
+{{/* Define the ingressRoute */}}
+{{- define "traefik.ingressRoute" -}}
+{{ if .Values.ingressRoute.dashboard.enabled }}
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: {{ include "tc.common.names.fullname" . }}-dashboard
+  annotations:
+  {{- with .Values.ingressRoute.dashboard.annotations }}
+  {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+spec:
+  entryPoints:
+    - main
+  routes:
+  - match: PathPrefix(`/dashboard`) || PathPrefix(`/api`)
+    kind: Rule
+    services:
+    - name: api@internal
+      kind: TraefikService
+{{ end }}
+{{- end -}}

charts/stable/traefik/templates/_portalhook.tpl

@@ -0,0 +1,26 @@
+{{/* Define the portalHook */}}
+{{- define "traefik.portalhook" -}}
+{{- if .Values.portalhook.enabled }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+---
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: portalhook
+  namespace: {{ $namespace }}
+data:
+  {{- $ports := dict }}
+  {{- range $.Values.service }}
+  {{- range $name, $value := .ports }}
+  {{- $_ := set $ports $name $value }}
+  {{- end }}
+  {{- end }}
+  {{- range $name, $value := $ports }}
+  {{ $name }}: {{ $value.port | quote }}
+  {{- end }}
+{{- end }}
+{{- end -}}

charts/stable/traefik/templates/_tlsoptions.tpl

@@ -0,0 +1,12 @@
+{{/* Define the tlsOptions */}}
+{{- define "traefik.tlsOptions" -}}
+{{- range $name, $config := .Values.tlsOptions }}
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: TLSOption
+metadata:
+  name: {{ $name }}
+spec:
+  {{- toYaml $config | nindent 2 }}
+{{- end }}
+{{- end -}}

charts/stable/traefik/templates/common.yaml

@@ -0,0 +1,24 @@
+{{/* Make sure all variables are set properly */}}
+{{- include "tc.common.loader.init" . }}
+
+{{- if .Values.metrics }}
+{{- if .Values.metrics.prometheus }}
+{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" "true" -}}
+{{- $_ := set .Values.podAnnotations "prometheus.io/path" "/metrics" -}}
+{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" "9180" -}}
+{{- end }}
+{{- end }}
+
+{{- $newArgs :=  (include "traefik.args" . | fromYaml) }}
+{{- $_ := set .Values "newArgs" $newArgs -}}
+{{- $mergedargs := concat .Values.args .Values.newArgs.args }}
+{{- $_ := set .Values "args" $mergedargs -}}
+
+{{- include "traefik.portalhook" . }}
+{{- include "traefik.tlsOptions" . }}
+{{- include "traefik.ingressRoute" . }}
+{{- include "traefik.ingressClass" . }}
+
+
+{{/* Render the templates */}}
+{{ include "tc.common.loader.apply" . }}

charts/stable/traefik/templates/middlewares/basic-middleware.yaml

@@ -0,0 +1,65 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: compress
+  namespace: {{ $namespace }}
+spec:
+  compress: {}
+---
+# Here, an average of 300 requests per second is allowed.
+# In addition, a burst of 200 requests is allowed.
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: basic-ratelimit
+  namespace: {{ $namespace }}
+spec:
+  rateLimit:
+    average: 600
+    burst: 400
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: basic-secure-headers
+  namespace: {{ $namespace }}
+spec:
+  headers:
+    accessControlAllowMethods:
+      - GET
+      - OPTIONS
+      - HEAD
+      - PUT
+    accessControlMaxAge: 100
+    sslRedirect: true
+    stsSeconds: 63072000
+    # stsIncludeSubdomains: false
+    # stsPreload: false
+    forceSTSHeader: true
+    contentTypeNosniff: true
+    browserXssFilter: true
+    sslForceHost: true
+    referrerPolicy: same-origin
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+    customResponseHeaders:
+      X-Robots-Tag: 'none'
+      server: ''
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: chain-basic
+  namespace: {{ $namespace }}
+spec:
+  chain:
+    middlewares:
+    - name: basic-ratelimit
+    - name: basic-secure-headers
+    - name: compress

charts/stable/traefik/templates/middlewares/basicauth.yaml

@@ -0,0 +1,34 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+{{ range $index, $middlewareData := .Values.middlewares.basicAuth }}
+---
+{{- $users := list }}
+{{ range $index, $userdata := $middlewareData.users }}
+    {{ $users = append $users ( htpasswd $userdata.username $userdata.password ) }}
+{{ end }}
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{printf "%v-%v" $middlewareData.name "secret" }}
+  namespace: {{ $namespace }}
+type: Opaque
+stringData:
+  users: |
+    {{- range $index, $user := $users }}
+    {{ printf "%s" $user }}
+    {{- end }}
+---
+# Declaring the user list
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ $middlewareData.name }}
+  namespace: {{ $namespace }}
+spec:
+  basicAuth:
+    secret: {{printf "%v-%v" $middlewareData.name "secret" }}
+{{ end }}

charts/stable/traefik/templates/middlewares/chain.yaml

@@ -0,0 +1,21 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+{{ range $index, $middlewareData := .Values.middlewares.chain }}
+
+---
+# Declaring the user list
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ $middlewareData.name }}
+  namespace: {{ $namespace }}
+spec:
+  chain:
+    middlewares:
+      {{ range $index, $middleware := .middlewares }}
+      - name: {{ printf "%v-%v@%v" $namespace $middleware "kubernetescrd" }}
+      {{ end }}
+{{ end }}

charts/stable/traefik/templates/middlewares/forwardauth.yaml

@@ -0,0 +1,30 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+{{ range $index, $middlewareData := .Values.middlewares.forwardAuth }}
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ $middlewareData.name }}
+  namespace: {{ $namespace }}
+spec:
+  forwardAuth:
+    address: {{ $middlewareData.address }}
+    {{- with $middlewareData.authResponseHeaders }}
+    authResponseHeaders:
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with $middlewareData.authRequestHeaders }}
+    authRequestHeaders:
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- if $middlewareData.authResponseHeadersRegex }}
+    authResponseHeadersRegex: {{ $middlewareData.authResponseHeadersRegex }}
+    {{- end }}
+    {{- if $middlewareData.trustForwardHeader }}
+    trustForwardHeader: true
+    {{- end }}
+{{ end }}

charts/stable/traefik/templates/middlewares/ipwhitelist.yaml

@@ -0,0 +1,33 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+{{ range $index, $middlewareData := .Values.middlewares.ipWhiteList }}
+
+---
+# Declaring the user list
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ $middlewareData.name }}
+  namespace: {{ $namespace }}
+spec:
+  ipWhiteList:
+    sourceRange:
+      {{- range $middlewareData.sourceRange }}
+      - {{ . }}
+      {{- end }}
+    {{- if $middlewareData.ipStrategy }}
+    ipStrategy:
+      {{- if $middlewareData.ipStrategy.depth }}
+      depth: {{ $middlewareData.ipStrategy.depth }}
+      {{- end }}
+      {{- if $middlewareData.ipStrategy.excludedIPs }}
+      excludedIPs:
+        {{- range $middlewareData.ipStrategy.excludedIPs }}
+        - {{ . }}
+        {{- end }}
+      {{- end }}
+    {{- end }}
+{{ end }}

charts/stable/traefik/templates/middlewares/ratelimit.yaml

@@ -0,0 +1,19 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+{{ range $index, $middlewareData := .Values.middlewares.rateLimit }}
+
+---
+# Declaring the user list
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ $middlewareData.name }}
+  namespace: {{ $namespace }}
+spec:
+  rateLimit:
+    average: {{ $middlewareData.average }}
+    burst: {{ $middlewareData.burst }}
+{{ end }}

charts/stable/traefik/templates/middlewares/redirectScheme.yaml

@@ -0,0 +1,19 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+{{ range $index, $middlewareData := .Values.middlewares.redirectScheme }}
+
+---
+# Declaring the user list
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ $middlewareData.name }}
+  namespace: {{ $namespace }}
+spec:
+  redirectScheme:
+    scheme: {{ $middlewareData.scheme }}
+    permanent: {{ $middlewareData.permanent }}
+{{ end }}

charts/stable/traefik/templates/middlewares/redirectregex.yaml

@@ -0,0 +1,20 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+{{ range $index, $middlewareData := .Values.middlewares.redirectRegex }}
+
+---
+# Declaring the user list
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ $middlewareData.name }}
+  namespace: {{ $namespace }}
+spec:
+  redirectRegex:
+    regex: {{ $middlewareData.regex | quote }}
+    replacement: {{ $middlewareData.replacement | quote }}
+    permanent: {{ $middlewareData.permanent }}
+{{ end }}

charts/stable/traefik/templates/middlewares/stripPrefixRegex.yaml

@@ -0,0 +1,20 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+
+{{ range $index, $middlewareData := .Values.middlewares.stripPrefixRegex }}
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ $middlewareData.name }}
+  namespace: {{ $namespace }}
+spec:
+  stripPrefixRegex:
+    regex:
+     {{- range $middlewareData.regex }}
+      - {{ . | quote }}
+     {{- end }}
+{{ end }}

charts/stable/traefik/templates/middlewares/tc-chains.yaml

@@ -0,0 +1,29 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-opencors-chain
+  namespace: {{ $namespace }}
+spec:
+  chain:
+    middlewares:
+    - name: basic-ratelimit
+    - name: tc-opencors-headers
+    - name: compress
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-closedcors-chain
+  namespace: {{ $namespace }}
+spec:
+  chain:
+    middlewares:
+    - name: basic-ratelimit
+    - name: tc-closedcors-headers
+    - name: compress

charts/stable/traefik/templates/middlewares/tc-headers.yaml

@@ -0,0 +1,64 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-opencors-headers
+  namespace: {{ $namespace }}
+spec:
+  headers:
+    accessControlAllowHeaders:
+    - '*'
+    accessControlAllowMethods:
+    - GET
+    - OPTIONS
+    - HEAD
+    - PUT
+    - POST
+    accessControlAllowOriginList:
+    - '*'
+    accessControlMaxAge: 100
+    browserXssFilter: true
+    contentTypeNosniff: true
+    customRequestHeaders:
+      X-Forwarded-Proto: https
+    customResponseHeaders:
+      X-Robots-Tag: none
+      server: ""
+    forceSTSHeader: true
+    referrerPolicy: same-origin
+    sslForceHost: true
+    sslRedirect: true
+    stsSeconds: 63072000
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-closedcors-headers
+  namespace: {{ $namespace }}
+spec:
+  headers:
+    accessControlAllowMethods:
+      - GET
+      - OPTIONS
+      - HEAD
+      - PUT
+    accessControlMaxAge: 100
+    sslRedirect: true
+    stsSeconds: 63072000
+    # stsIncludeSubdomains: false
+    # stsPreload: false
+    forceSTSHeader: true
+    contentTypeNosniff: true
+    browserXssFilter: true
+    sslForceHost: true
+    referrerPolicy: same-origin
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+    customResponseHeaders:
+      X-Robots-Tag: 'none'
+      server: ''

charts/stable/traefik/templates/middlewares/tc-nextcloud.yaml

@@ -0,0 +1,25 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-nextcloud-redirectregex-dav
+  namespace: {{ $namespace }}
+spec:
+  redirectRegex:
+    regex: "https://(.*)/.well-known/(card|cal)dav"
+    replacement: "https://${1}/remote.php/dav/"
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-nextcloud-chain
+  namespace: {{ $namespace }}
+spec:
+  chain:
+    middlewares:
+    - name: tc-nextcloud-redirectregex-dav