traefik

Update Helm release traefik to v38

Michi Kofler-Häusler

21 Dec 2025 — 2 min read

No problems whatsoever deploying to Proxmox VE K3s Kubernetes cluster via Helm Chart and Flux V2 reconciliation in a GitOps approach with dependency update facilitated by Mend's Renovate Bot.

This MR contains the following updates:

Package	Update	Change
traefik (source)	major	`37.4.0` -> `38.0.1`

Release Notes

traefik/traefik-helm-chart (traefik)

`v38.0.1`

Compare Source

:bug: Bug fixes

fix(ports): 🐛 http.encodedCharacters on custom entrypoints #1606 by @mloiseleur
fix(ports): 🐛 add missing http.maxHeaderBytes option #1604 by @mloiseleur

:package: Others

chore(release): 🚀 publish traefik 38.0.1 #1608 by @mloiseleur

`v38.0.0`

Compare Source

Upgrades Notes

[!IMPORTANT]
CRDs has to be upgraded before the Chart. See UPGRADING instructions.

There are two breaking changes in this release:

Traefik Proxy v3.6.4+ contains a security fix that is also a breaking change. See upstream documentation for more details.
MR #1596 align kubernetesIngressNginx provider setting with upstream. There is a before / after example in the MR description and MR #1587 align labelSelector syntax between providers

[!NOTE]
If you need to restore Traefik behavior of v3.6.3 or inferior, it can be set with values.

Here is an example on websecure entrypoint:
ports:
  websecure:
    http:
      encodedCharacters:
        allowEncodedSlash: true
        allowEncodedBackSlash: true
        allowEncodedNullCharacter: true
        allowEncodedSemicolon: true
        allowEncodedPercent: true
        allowEncodedQuestionMark: true
        allowEncodedHash: true
      sanitizePath: false
This is not recommended, it may expose you to GHSA-gm3x-23wp-hc2c.

:boom: BREAKING CHANGES

fix(providers)!: align labelSelector for kubernetesGateway and knative #1587 by @shubhamch71
fix(nginx)!: 🐛 align provider settings and provide required rbac #1596 by @mloiseleur

:rocket: Features

feat(CRDs): update Traefik Hub to v1.24.1, with required RBACs #1571 by @jspdown
feat(ports): enforce schema #1586 by @remyj38
feat(CRDs): update Traefik Hub to v1.24.2 #1585 by @traefiker
feat(providers): ✨ enforce schema #1595 by @mloiseleur
feat(security): ✨ 🔒️ add support for request path options of traefik 3.6.4+ #1594 by @mloiseleur
feat(deps): update traefik docker tag to v3.6.4 #1590 by @renovate[bot]
feat(deps): update traefik docker tag to v3.6.5 #1599 by @renovate[bot]

:bug: Bug fixes

fix: update error message for maxUnavailable validation #1591 by @lucasra1
fix(notes): minor typo #1593 by @rndmh3ro
fix(pvc): allow empty storageClassName #1579 by @fopina
fix(providers): ✨ enforce schema for all providers #1601 by @mloiseleur

:package: Others

chore(deps): update actions/checkout action to v6 #1573 by @renovate[bot]
docs: Update EXAMPLES.md with REGIONAL load balancer note for Digital Ocean #1574 by @kamikazechaser
chore(release): 🚀 publish traefik 38.0.0 and crds 1.13.0 #1600 by @mloiseleur