Update Helm release traefik to v42

v42.0.0

Compare Source

There are 3 breaking changes in this release

Upgrade Notes

1. Kubernetes v1.30+: The chart now requires Kubernetes v1.30 or higher (#​2030).
2. Traefik Hub Secret RBAC: Write verbs on Secrets (create, update, delete) are no longer granted cluster-wide.
   • A Role now grants them in the release namespace only, where Traefik Hub writes its Secrets (#​2028)
3. Transparency logs witnesses: (#​2018):
   • hub.transparencyLogs.witnessGroup.witnesses now defaults to null and threshold must be at least 1.
   • Setting threshold, timeout or failOpen without any witness now fails.

[!NOTE]
With hub.token, the chart now deploys a cluster-scoped ValidatingAdmissionPolicy that only allows Traefik Hub to write Opaque and kubernetes.io/tls Secrets.
Set hub.restrictSecretTypes: false if the installer cannot create cluster-scoped resources.

:boom: BREAKING CHANGES

• fix(tlogs)!: empty witness config #​2018 by @​LBF38
• feat(chart)!: require Kubernetes v1.30 or higher #​2030 by @​mloiseleur
• fix(rbac)!: 🐛 scope Traefik Hub secret write permissions to release namespace #​2028 by @​mloiseleur

:rocket: Features

• feat(hub): :rocket: support traefik hub v3.20.16 and v3.21.3 #​2032 by @​mloiseleur
• feat(hub): restrict Secret types written by Traefik Hub #​2031 by @​mloiseleur

:bug: Bug fixes

• fix(examples): fix outdated value schema used in additionalServices example #​2023 by @​jnoordsij

:package: Others

• chore(deps): update github actions #​2024 by @​renovate-with-github-actions[bot]
• chore(deps): update quay.io/helmpack/chart-testing docker tag to v3.15.0 #​2025 by @​renovate-with-github-actions[bot]
• docs(agents): document Traefik Hub version bump #​2033 by @​mloiseleur
• docs(examples): add Traefik Hub Gateway with the Traefik MCP server as a sidecar #​2007 by @​emilevauge
• chore(release): 🚀 publish 42.0.0 #​2034 by @​mloiseleur

👌 Traefik version support

• Traefik Proxy: v3.6.0 -> v3.7.14 (default)
• Traefik Hub: v3.19.3 -> v3.21.3