feat(common): enable middlewares when referenced on ingress and add chart+common middlewares (#31535)

**Description**

Currently users have to enable the ingressMiddleware AND reference said
middleware under their ingress.
This adds additional work and is confusion when, for example, we include
our own middleware.

This PR checks if a disabled middleware, is referenced anywhere on an
enabled ingress with traefik-integration enabled.
It does so by excluding any external middlewares (with namespace
explicitly defined)

If it finds any that are not enabled, it will still enable/create them
regardless.

This PR also increases the places ingress-middleware can be referenced
on the ingress:

1. common-middlewares (.Values.global.traefik.commonMiddlewares)
Special bare-bones middlewares that are applied to all ingresses by
default, unless very explicitly overridden

2. chart-middlewares
($ingress.integrations.traefik.chartMiddlewares)
Special middlewares that are defined by the chart creator and should
always be loaded regardless of user middlewares, for example: nextcloud

3. user-middlewares
what we had already

**⚙️ Type of change**

- [x] ⚙️ Feature/App addition
- [ ] 🪛 Bugfix
- [ ] ⚠️ Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] 🔃 Refactor of current code

**🧪 How Has This Been Tested?**
<!--
Please describe the tests that you ran to verify your changes. Provide
instructions so we can reproduce. Please also list any relevant details
for your test configuration
-->

**📃 Notes:**
<!-- Please enter any other relevant information here -->

**✔️ Checklist:**

- [ ] ⚖️ My code follows the style guidelines of this project
- [ ] 👀 I have performed a self-review of my own code
- [ ] #️⃣ I have commented my code, particularly in hard-to-understand
areas
- [ ] 📄 I have made corresponding changes to the documentation
- [ ] ⚠️ My changes generate no new warnings
- [ ] 🧪 I have added tests to this description that prove my fix is
effective or that my feature works
- [ ] ⬆️ I increased versions for any altered app according to semantic
versioning
- [ ] I made sure the title starts with `feat(chart-name):`,
`fix(chart-name):` or `chore(chart-name):`

**➕ App addition**

If this PR is an app addition please make sure you have done the
following.

- [ ] 🖼️ I have added an icon in the Chart's root directory called
`icon.png`

---

_Please don't blindly check all the boxes. Read them and only check
those that apply.
Those checkboxes are there for the reviewer to see what is this all
about and
the status of this PR with a quick glance._

---------

Signed-off-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com>
Co-authored-by: Stavros Kois <s.kois@outlook.com>
Co-authored-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com>

charts/library/common/Chart.yaml

@@ -48,4 +48,4 @@ sources:
   - https://hub.docker.com/_/
   - https://hub.docker.com/r/mikefarah/yq
 type: library
-version: 26.0.3
+version: 26.1.0

charts/library/common/templates/lib/ingress/integrations/_traefik.tpl

@@ -22,7 +22,15 @@
     {{- $entrypoints := $traefik.entrypoints | default (list "websecure") -}}
     {{- $middlewares := list -}}
 
-    {{/* Add the user middlewares */}}
+    {{/* Add the user, common and chart middlewares */}}
+    {{- if $rootCtx.Values.global.traefik.commonMiddlewares -}}
+      {{- $middlewares = concat $middlewares $rootCtx.Values.global.traefik.commonMiddlewares -}}
+    {{- end -}}
+
+    {{- if $traefik.chartMiddlewares -}}
+      {{- $middlewares = concat $middlewares $traefik.chartMiddlewares -}}
+    {{- end -}}
+
     {{- if $traefik.middlewares -}}
       {{- $middlewares = concat $middlewares $traefik.middlewares -}}
     {{- end -}}
@@ -96,5 +104,10 @@
     {{- end -}}
   {{- end -}}
 
+  {{- if $traefik.chartMiddlewares -}}
+    {{- if not (kindIs "slice" $traefik.chartMiddlewares) -}}
+      {{- fail (printf "Ingress - Expected [integrations.traefik.chartMiddlewares] to be a [slice], but got [%s]" (kindOf $traefik.chartMiddlewares)) -}}
+    {{- end -}}
+  {{- end -}}
 
 {{- end -}}

charts/library/common/templates/spawner/traefik/_middleware.tpl

@@ -12,15 +12,82 @@
     {{- $_ := set $.Values.ingressMiddlewares "traefik" dict -}}
   {{- end -}}
 
+  {{- $filteredMiddlewares := dict -}}
+  {{- $hasIngressEnabled := false -}}
+  {{/* Go over all ingresses and get their defined middlewares */}}
+  {{- range $ingName, $ing := $.Values.ingress -}}
+    {{- $enabledIng := (include "tc.v1.common.lib.util.enabled" (dict
+      "rootCtx" $ "objectData" $ing
+      "name" $ingName "caller" "Ingress"
+      "key" "ingress")) -}}
+
+    {{/* Skip disabled ingresses or ingresses without traefik integration */}}
+    {{- if ne $enabledIng "true" -}}{{- continue -}}{{- end -}}
+    {{- if not $ing.integrations -}}
+      {{- $_ := set $ing "integrations" dict -}}
+    {{- end -}}
+    {{- if not $ing.integrations.traefik -}}
+      {{- $_ := set $ing.integrations "traefik" dict -}}
+    {{- end -}}
+    {{- $traefik := $ing.integrations.traefik -}}
+    {{- $enabledTraefikIntegration := "true" -}}
+    {{- if and (hasKey $traefik "enabled") (kindIs "bool" $traefik.enabled) -}}
+      {{- $enabledTraefikIntegration = $traefik.enabled | toString -}}
+    {{- end -}}
+    {{- if ne $enabledTraefikIntegration "true" }}{{- continue -}}{{- end -}}
+
+    {{- $hasIngressEnabled = true -}}
+
+    {{/* User middlewares */}}
+    {{- if and $traefik.middlewares (not (kindIs "slice" $traefik.middlewares)) -}}{{- continue -}}{{- end -}}
+    {{- range $mw := $traefik.middlewares -}}
+      {{- if $mw.namespace -}}{{- continue -}}{{- end -}}
+      {{- $_ := set $filteredMiddlewares $mw.name "user-mw" -}}
+    {{- end -}}
+
+    {{/* Chart middlewares */}}
+    {{- if and $traefik.chartMiddlewares (not (kindIs "slice" $traefik.chartMiddlewares)) -}}{{- continue -}}{{- end -}}
+    {{- range $mw := $traefik.chartMiddlewares -}}
+      {{- if $mw.namespace -}}{{- continue -}}{{- end -}}
+      {{- $_ := set $filteredMiddlewares $mw.name "chart-mw" -}}
+    {{- end -}}
+
+  {{- end -}}
+
+  {{- if $hasIngressEnabled -}}
+    {{/* Global Middlewares */}}
+    {{- range $mw := $.Values.global.traefik.commonMiddlewares -}}
+      {{- if $mw.namespace -}}{{- continue -}}{{- end -}}
+        {{- $_ := set $filteredMiddlewares $mw.name "global-mw" -}}
+    {{- end -}}
+  {{- end -}}
+
   {{- range $name, $middleware := $.Values.ingressMiddlewares.traefik -}}
 
     {{- $enabled := (include "tc.v1.common.lib.util.enabled" (dict
-                    "rootCtx" $ "objectData" $middleware
-                    "name" $name "caller" "Middleware"
-                    "key" "middlewares")) -}}
+        "rootCtx" $ "objectData" $middleware
+        "name" $name "caller" "Middleware"
+        "key" "middlewares"))
+    -}}
+
+    {{- if ne $enabled "true" -}}
+      {{- $indexedMid := get $filteredMiddlewares $name -}}
+      {{- if not $indexedMid -}}{{- continue -}}{{- end -}}
+
+      {{/*
+        If current middleware manifest is in the middlewares listed under one of the above sections
+        Forcefully enable it/render it.
+      */}}
+      {{- $enabled = "true" -}}
+
+      {{- if eq $indexedMid "user-mw" -}}
+        {{- include "add.warning" (dict "rootCtx" $ "warn" (printf
+          "WARNING: Because middleware [%s] was used in an ingress under traefik integration, it was forcefully enabled."
+        )) -}}
+      {{- end -}}
+    {{- end -}}
 
     {{- if eq $enabled "true" -}}
-
       {{/* Create a copy of the middleware */}}
       {{- $objectData := (mustDeepCopy $middleware) -}}
 

charts/library/common/values.yaml

@@ -63,6 +63,8 @@ global:
   traefik:
     # -- Adds traefik annotations to services (when needed)
     addServiceAnnotations: true
+    commonMiddlewares:
+      - name: tc-basic-secure-headers
   # -- Minimum nodePort value
   minNodePort: 9000
   # -- Enable to stop most pods and containers including cnpg