component-traefik-ingress

A standard Traefik Ingress for the project's web service, plus TLS via cert-manager.

Enable it

component-traefik-ingress:
  enabled: true
  labels:
    monitoring.onyourmarks.tech/probe: "true"
  hosts:
    - host: my-project.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: traefik-ingress-tls
      hosts: [my-project.example.com]

Every host listed under tls[].hosts gets a Let's Encrypt certificate through the letsencrypt-production cluster issuer. Issuance only succeeds once the name resolves to the cluster's load balancer (57.129.55.146), so add custom domains after DNS is in place. Hosts under *.k8s.instance.onyourmarks.tech resolve already.

Uptime monitoring label

labels."monitoring.onyourmarks.tech/probe" opts the ingress into the blackbox exporter:

Value	Probe
"true"	GET / over TLS must return 2xx
"allow-404"	2xx or 404 — for APIs that have nothing on /
absent	not monitored

Annotations

Defaults, always present:

annotations:
  cert-manager.io/cluster-issuer: letsencrypt-production
  traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
  traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect-https@kubernetescrd

User annotations are merged on top. Only the router.middlewares key replaces its default, so when you set it, re-list traefik-redirect-https@kubernetescrd yourself:

component-traefik-ingress:
  annotations:
    traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect-https@kubernetescrd,traefik-block-robots@kubernetescrd

Middlewares available cluster-wide (all in the traefik namespace, referenced as <name>@kubernetescrd):

Middleware	Use
traefik-redirect-https	http → https. Keep it.
traefik-block-robots	Adds X-Robots-Tag: noindex, nofollow, nosnippet, noarchive to every response. Put it on every *.k8s.instance.onyourmarks.tech host, never on a public domain.
traefik-redirect-to-www / traefik-redirect-to-non-www	Apex ↔ www canonicalisation.
traefik-security-headers	HSTS and friends.

Multiple hosts

hosts:
  - host: example.com
    paths: [{ path: /, pathType: Prefix }]
  - host: www.example.com
    paths: [{ path: /, pathType: Prefix }]
tls:
  - secretName: traefik-ingress-tls
    hosts: [example.com, www.example.com]

Routing a path to another service

By default every path goes to the app's Service (app-service, port 80). A path can target another Service in the namespace:

hosts:
  - host: example.com
    paths:
      - path: /
        pathType: Prefix
      - path: /metrics
        pathType: Prefix
        service:
          name: exporter-service
          port: 9100