Traefik

HTTP reverse proxy and ingress controller. MIT. linux/amd64.

Pin this image by digest.

published Latest tag v3.7.14-tpio.1. Pin by digest. Usage is on this page.

Pin by digest

oci.thepeoples.io/hardened/traefik@sha256:409042a74e0c1a0f882dc90c7694b4933e13ade589defe4e814882a151427ef5

Pull:

podman pull oci.thepeoples.io/hardened/traefik@sha256:409042a74e0c1a0f882dc90c7694b4933e13ade589defe4e814882a151427ef5

Verify:

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/traefik@sha256:409042a74e0c1a0f882dc90c7694b4933e13ade589defe4e814882a151427ef5

Published 2026-10-11T02:09:08Z108.0 MiB compressed

Usage

TLS certificates come from the in-cluster ClusterIssuer private-ca, bootstrapped by a namespaced SelfSigned Issuer. This batch does not use Let's Encrypt or any external ACME endpoint. Metrics are on in the values below; comments mark the production settings.

Example, not validated on this page until a matching published digest is recorded.

Image pin overlay:

image:
  registry: oci.thepeoples.io
  repository: hardened/traefik
  tag: "v3.7.14-tpio.1"
  digest: "sha256:409042a74e0c1a0f882dc90c7694b4933e13ade589defe4e814882a151427ef5"
  # versionOverride so the chart's version check knows this is v3.7.14 (digest cannot be parsed)
# TLS: mount a cert issued by the in-cluster private CA (SelfSigned -> CA Issuer). Do not enable Let's Encrypt / acme.httpChallenge.

Production Helm values (metrics on, private CA only where TLS applies):

# Production-oriented Helm values for Traefik Labs chart 41.7.1 (proxy pin v3.7.14).
# Image pins come from catalog/image-meta.json chart_values and the generated
# values-images overlay. CI-only overlays stay out of this file.
# TLS uses the in-cluster private CA (ClusterIssuer private-ca in
# validate/manifests/private-ca.yaml). No external ACME; leave
# certificatesResolvers empty. Turn metrics off with metrics.prometheus: null.

# Chart version check cannot parse a digest; set versionOverride to the proxy
# version when pinning by image.digest.
# https://doc.traefik.io/traefik/v3.7/reference/install-configuration/observability/metrics/
# https://github.com/traefik/traefik-helm-chart/blob/v41.7.1/traefik/VALUES.md
# https://artifacthub.io/packages/helm/traefik/traefik/41.7.1
versionOverride: "v3.7.14"

deployment:
  kind: Deployment
  replicas: 2
  # Soft anti-affinity spreads replicas when the cluster has enough nodes.
  # https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

podDisruptionBudget:
  enabled: true
  minAvailable: 1

# Prometheus is on by default on the dedicated metrics entrypoint (port 9100).
# Do not expose that port on the LoadBalancer; scrape in-cluster.
# https://doc.traefik.io/traefik/v3.7/reference/install-configuration/observability/metrics/#prometheus
metrics:
  prometheus:
    entryPoint: metrics
    addEntryPointsLabels: true
    addRoutersLabels: true # extra cardinality; set false to skip router labels
    addServicesLabels: true
    service:
      enabled: true # set false to skip the dedicated metrics Service
    serviceMonitor:
      enabled: false # set true only when Prometheus Operator CRDs are installed

ports:
  traefik:
    expose:
      default: false # dashboard/API; keep cluster-internal
  web:
    port: 8000
    expose:
      default: true
    exposedPort: 80
    observability:
      metrics: true
  websecure:
    port: 8443
    expose:
      default: true
    exposedPort: 443
    http:
      tls:
        enabled: true # default certificate from tlsStore below
    observability:
      metrics: true
  metrics:
    port: 9100
    expose:
      default: false # scrape via the metrics Service, not the LB
    observability:
      metrics: true

# Default certificate is the leaf issued by ClusterIssuer private-ca
# (Certificate ingress-tls in validate/manifests/private-ca.yaml).
# https://doc.traefik.io/traefik/v3.7/reference/routing-configuration/kubernetes/crd/http/tlsstore/
# https://cert-manager.io/docs/configuration/ca/
tlsStore:
  default:
    defaultCertificate:
      secretName: ingress-tls

# Empty on purpose: no ACME certificate resolvers.
# https://doc.traefik.io/traefik/v3.7/reference/install-configuration/tls/certificate-resolvers/acme/
certificatesResolvers: {}

persistence:
  enabled: false # ACME storage is unused; cert-manager owns the Secret

# https://doc.traefik.io/traefik/v3.7/reference/install-configuration/observability/logs-and-accesslogs/
log:
  format: json
  level: INFO
accessLog:
  enabled: true
  format: json

ingressClass:
  enabled: true
  isDefaultClass: false # do not steal the cluster default

providers:
  kubernetesCRD:
    enabled: true
    allowCrossNamespace: false
    allowExternalNameServices: false
  kubernetesIngress:
    enabled: true
    publishedService:
      enabled: true
  kubernetesGateway:
    enabled: false

# Chart defaults already drop ALL capabilities and run as 65532.
# https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
  readOnlyRootFilesystem: true
podSecurityContext:
  runAsGroup: 65532
  runAsNonRoot: true
  runAsUser: 65532
  seccompProfile:
    type: RuntimeDefault

resources:
  requests: {cpu: 100m, memory: 128Mi}
  limits: {cpu: 1, memory: 512Mi}

hub:
  enabled: false # Traefik Hub is not this batch

In-cluster issuer (SelfSigned bootstrap → ClusterIssuer private-ca):

# In-cluster private CA used by Traefik and Envoy TLS, and by the cert-manager
# Certificate check. A namespaced SelfSigned Issuer bootstraps CA certificate
# private-ca; ClusterIssuer private-ca then signs leaf certificates in any
# namespace (clusterResourceNamespace = cert-manager release namespace).
# No external ACME. Validation evidence must name issuerRef.name: private-ca.
# https://cert-manager.io/docs/configuration/selfsigned/
# https://cert-manager.io/docs/configuration/ca/
# https://cert-manager.io/docs/usage/certificate/
apiVersion: v1
kind: Namespace
metadata:
  name: cert-manager
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: selfsigned-bootstrap
  namespace: cert-manager
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: private-ca
  namespace: cert-manager
spec:
  isCA: true
  commonName: hardened-oci-private-ca
  secretName: private-ca
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: selfsigned-bootstrap
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: private-ca
spec:
  ca:
    secretName: private-ca
---
# Demo leaf for Traefik tlsStore.default.defaultCertificate and Envoy Gateway
# TLS. Issue a copy in the ingress namespace (or reference this Secret) so
# Traefik/Envoy can mount it. issuerRef.name is private-ca.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ingress-tls
  namespace: cert-manager
spec:
  secretName: ingress-tls
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  commonName: whoami.hardened.example
  dnsNames:
    - whoami.hardened.example
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: private-ca
    kind: ClusterIssuer
    group: cert-manager.io

helm repo add traefik https://traefik.github.io/charts
helm upgrade --install traefik traefik/traefik --version 41.7.1 \
  --namespace traefik --create-namespace -f values-hardened.yaml

Verify the latest published digest

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/traefik@sha256:409042a74e0c1a0f882dc90c7694b4933e13ade589defe4e814882a151427ef5
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/hardened-gate/v1 oci.thepeoples.io/hardened/traefik@sha256:409042a74e0c1a0f882dc90c7694b4933e13ade589defe4e814882a151427ef5

The report views show the predicate types and commands for SPDX, scanner and optional OpenVEX attestations. Inspect the verified predicates as well as the signature.

This image is here as the Ingress proxy. Depends on cert-manager (dependency).

Status: published. Platform: linux/amd64.

Available tags and scan history

oci.thepeoples.io/hardened/traefik@sha256:409042a74e0c1a0f882dc90c7694b4933e13ade589defe4e814882a151427ef5

Rebuild and licence

Ladder a+b+c: FROM v3.7.14, rebuild traefik with Go 1.26.9 + x/net@v0.60.0, apk upgrade.

Licence: MIT.

Traefik is MIT. Alpine base packages keep their own licenses.

Upstream source