# Configuration of the Traefik that ships with k3s.
# Ingresses without a router.entrypoints annotation now use only "websecure", so
# plain HTTP is redirected to HTTPS by default (see http-redirect.yaml).
# To publish an Ingress over plain HTTP add the annotation
#   traefik.ingress.kubernetes.io/router.entrypoints: web
# (or "web,websecure" to serve both without a redirect).
apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    deployment:
      kind: DaemonSet
    service:
      spec:
        externalTrafficPolicy: Local
        # ServiceLB masquerades clients as pod traffic before the NodePort hop,
        # which bypasses externalTrafficPolicy. Prefer the ingress on this node
        # for that cluster-policy path as well.
        trafficDistribution: PreferSameNode
    tolerations:
      - key: workload
        operator: Equal
        value: ai
        effect: NoSchedule
    ports:
      websecure:
        asDefault: true