fix(plane-ce): stop forcing TLS on the Traefik ingress #296
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -156,6 +156,135 @@ The default value is `"traefik"`. If you previously relied on the implicit defau | |
| | `ingress.ingressClass` | `traefik` | Selects which template is active (see table above). | | ||
| | `ingress.traefik.*` | see values | Traefik-only settings (middleware body limit). Ignored when using the standard `Ingress`. | | ||
| | `ingress.ingress_annotations` | `{}` | Standard `Ingress` annotations. Ignored when `ingressClass` starts with `traefik`. | | ||
| | `ingress.traefik.entryPoints` | `[]` | Traefik entrypoints for the `IngressRoute`s. Empty derives them from your SSL settings — see below. | | ||
| | `ssl.externalTermination` | `false` | Declare that TLS is terminated in front of Plane — see below. | | ||
|
|
||
| ### TLS options: choosing how HTTPS is handled | ||
|
|
||
| TLS is **optional**. Your `ssl.*` settings decide which Traefik entrypoint the | ||
| `IngressRoute`s bind to and whether a `tls:` block is emitted. Find the row that | ||
| matches your environment: | ||
|
|
||
| | Your setup | Set | Entrypoint | `tls:` block | | ||
| | --- | --- | :---: | :---: | | ||
| | No certificate yet — trial, internal network | *nothing* (default) | `web` | — | | ||
| | You already hold a TLS Secret | `ssl.tls_secret_name` | `websecure` | your Secret | | ||
| | Let cert-manager issue one | `ssl.createIssuer` + `ssl.generateCerts` | `websecure` | `<release>-ssl-cert` | | ||
| | TLS terminated in front of Plane | `ssl.externalTermination: true` | `websecure` | — | | ||
|
|
||
| Only the `tls:` block needs a Secret this chart can actually see, which is why the | ||
| last row emits none — the chart never names a Secret it does not create. All three | ||
| `IngressRoute`s (app, MinIO, RabbitMQ) follow the same rule. | ||
|
|
||
| #### Option 1 — No TLS, plain HTTP | ||
|
|
||
| The default. Leave the `ssl` block alone and Plane is reachable at | ||
| `http://<appHost>`: | ||
|
|
||
| ```yaml | ||
| ingress: | ||
| appHost: plane.example.com | ||
| ingressClass: traefik | ||
| ``` | ||
|
|
||
| Good for a quick trial, an internal network, or while you are still sorting out | ||
| DNS and certificates. **Read the entrypoint caveat below before relying on it** — | ||
| and terminate TLS somewhere before exposing Plane on the public internet. | ||
|
|
||
| #### Option 2 — Bring your own certificate | ||
|
|
||
| ```bash | ||
| kubectl create secret tls my-tls-secret \ | ||
| --cert=fullchain.pem --key=privkey.pem -n plane-ns | ||
| ``` | ||
|
|
||
| ```yaml | ||
| ssl: | ||
| tls_secret_name: my-tls-secret | ||
| ``` | ||
|
|
||
| #### Option 3 — Let cert-manager issue the certificate | ||
|
|
||
| Requires cert-manager in the cluster. **Both** flags are needed — `createIssuer` | ||
| alone creates an Issuer but no Certificate, and the chart then treats the install | ||
| as having no certificate at all: | ||
|
|
||
| ```yaml | ||
| ssl: | ||
| createIssuer: true | ||
| generateCerts: true | ||
| issuer: http # or cloudflare / digitalocean | ||
| email: you@example.com | ||
| # token: <dns-provider-api-token> # required for cloudflare / digitalocean | ||
| ``` | ||
|
|
||
| #### Option 4 — TLS terminated in front of Plane | ||
|
|
||
| Use this when something ahead of Plane already terminates TLS and this chart | ||
| manages no certificate: a cloud load balancer, Cloudflare, a service mesh, or a | ||
| Traefik entrypoint carrying its own certificate (`websecure.http.tls=true`). | ||
|
|
||
| ```yaml | ||
| ssl: | ||
| externalTermination: true | ||
| ``` | ||
|
|
||
| The `IngressRoute`s bind to `websecure`, but no `tls:` block is emitted — Traefik | ||
| serves whatever certificate its entrypoint is configured with. Leave it `false` if | ||
| you set `ssl.tls_secret_name` or `ssl.generateCerts`; those already imply HTTPS. | ||
|
|
||
|
Comment on lines
+232
to
+235
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win Require both cert-manager flags in this condition.
Also applies to: 530-530 🤖 Prompt for AI Agents |
||
| #### Overriding the entrypoint names | ||
|
|
||
| Only needed if your Traefik installation renamed the default `web` / `websecure` | ||
| entrypoints, or you want to serve both schemes at once: | ||
|
|
||
| ```yaml | ||
| ingress: | ||
| traefik: | ||
| entryPoints: ["websecure", "web"] # a bare string also works | ||
| ``` | ||
|
|
||
| Leave it empty (the default) to derive the entrypoint from the table above. This | ||
| controls the entrypoint *only* — whether a `tls:` block is emitted still follows | ||
| your `ssl.*` configuration. | ||
|
Comment on lines
+241
to
+249
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- README context ---'
sed -n '215,265p' charts/plane-ce/README.md
printf '%s\n' '--- Traefik-related templates and references ---'
rg -n -C 5 'entryPoints|entrypoints|spec:\s*$|tls:|chartManagedCert|IngressRoute|serve both|both schemes|websecure|web' charts/plane-ce charts/plane-enterprise 2>/dev/null | head -n 500
printf '%s\n' '--- Candidate template files ---'
fd -i 'traefik|ingress' charts/plane-ce charts/plane-enterprise 2>/dev/null | head -n 100Repository: makeplane/helm-charts Length of output: 48645 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- Traefik template outline ---'
ast-grep outline charts/plane-ce/templates/ingress-traefik.yaml --view expanded 2>/dev/null || true
printf '%s\n' '--- Traefik template ---'
cat -n charts/plane-ce/templates/ingress-traefik.yaml
printf '%s\n' '--- Helper references ---'
rg -n -C 8 'chartManagedCert|entryPoints|entrypoints' charts/plane-ce/templates charts/plane-ce/_helpers.tpl charts/plane-ce 2>/dev/null | head -n 300Repository: makeplane/helm-charts Length of output: 36389 🌐 Web query:
💡 Result: In Traefik, including a tls field in an HTTP router's definition instructs Traefik that the router is dedicated to handling HTTPS requests [1][2]. When this field is present, the router will process only TLS traffic and ignore non-TLS (HTTP) requests [1][2]. By default, a router configured with a tls field will terminate the TLS connection, meaning Traefik handles the decryption and forwards the decrypted data to your services [1][2]. Key points regarding the interaction between entryPoints and routers: 1. Routers vs. EntryPoints: While you can enable TLS globally on an entryPoint (e.g., using http.tls on an entryPoint configuration), you can also define tls settings directly on individual routers [1][3][4]. A router with tls enabled will effectively handle the HTTPS termination for traffic arriving at the attached entryPoints [1][2]. 2. TLS Handshake and Routing: TLS options (such as cipher suites and TLS versions) are configured on a router but are applied during the TLS handshake, which occurs before HTTP routing [5]. Consequently, these TLS settings are mapped to the host names defined in the router's rule rather than the router itself [5]. 3. Certificate Management: When a tls.certResolver is specified within a router's tls configuration, Traefik automatically manages the TLS certificates for the domains associated with that router [1]. In summary, the tls field in a router configuration is the standard way to explicitly designate a router to handle HTTPS traffic, ensuring it only accepts and processes encrypted connections [1][3]. Citations:
🏁 Script executed: #!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
template = Path("charts/plane-ce/templates/ingress-traefik.yaml").read_text()
readme = Path("charts/plane-ce/README.md").read_text()
routes = list(re.finditer(r"kind:\s*IngressRoute(.*?)(?=\n---|\Z)", template, re.S))
assert len(routes) == 3, len(routes)
for i, match in enumerate(routes, 1):
body = match.group(1)
assert body.count("include \"plane.traefikEntryPoints\" .") == 1, i
assert "if eq (include \"plane.chartManagedCert\" .) \"true\"" in body, i
assert re.search(r"\n\s+tls:\s*\n\s+secretName:", body), i
assert 'want to serve both schemes at once' in readme
print(f"{len(routes)} IngressRoute resources use the shared entrypoint helper.")
print("Each conditionally emits spec.tls when plane.chartManagedCert is true.")
print("README contains the both-schemes claim.")
print("Therefore, with chart-managed TLS and entryPoints [websecure, web], the same TLS router is attached to both entrypoints; no separate non-TLS router is rendered.")
PYRepository: makeplane/helm-charts Length of output: 490 Do not promise both schemes from one TLS router. When chart-managed TLS is enabled, 🤖 Prompt for AI Agents |
||
|
|
||
| #### Caveat: check your Traefik entrypoints before relying on plain HTTP | ||
|
|
||
| Many Traefik installations redirect `web` to HTTPS in Traefik's own static | ||
| configuration: | ||
|
|
||
| ``` | ||
| --entryPoints.web.http.redirections.entryPoint.to=:443 | ||
| --entryPoints.web.http.redirections.entryPoint.scheme=https | ||
| --entryPoints.websecure.http.tls=true | ||
| ``` | ||
|
Comment on lines
+256
to
+260
Contributor
There was a problem hiding this comment. 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win Add a language to the fenced code block. Use 🧰 Tools🪛 markdownlint-cli2 (0.23.2)[warning] 256-256: Fenced code blocks should have a language specified (MD040, fenced-code-language) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
|
|
||
| Check yours with: | ||
|
|
||
| ```bash | ||
| kubectl get deploy -n traefik <traefik-deployment> \ | ||
| -o jsonpath='{.spec.template.spec.containers[0].args}' | tr ',' '\n' | grep -i redirect | ||
| ``` | ||
|
|
||
| If the redirection is present, every plain-HTTP request is answered with a | ||
| permanent redirect *before* it reaches a route, so Option 1 cannot serve Plane on | ||
| that cluster. Either drop the redirection, or use Option 2/3/4. | ||
|
|
||
| #### Upgrading from 1.6.2 or earlier | ||
|
|
||
| If you configure TLS through `ssl.tls_secret_name` or `ssl.generateCerts` + | ||
| `ssl.createIssuer`, the rendered ingress is unchanged and no action is needed. | ||
|
|
||
| Earlier releases always bound the Traefik `IngressRoute`s to `websecure` and always | ||
| emitted a `tls:` block, even with no certificate configured — pointing at a | ||
| `<release>-ssl-cert` Secret that was never created, so Traefik fell back to its | ||
| built-in self-signed certificate. If you relied on that, or on TLS terminated at | ||
| Traefik itself, adopt Option 4: | ||
|
|
||
| ```yaml | ||
| ssl: | ||
| externalTermination: true | ||
| ``` | ||
|
|
||
| ## Configuration Settings Available | ||
|
|
||
|
|
@@ -390,13 +519,15 @@ The default value is `"traefik"`. If you previously relied on the implicit defau | |
| | ingress.ingressClass | traefik | Yes | Set to `traefik` (or a name starting with `traefik`) to use native Traefik `IngressRoute` CRDs. Set to `nginx` (or any other class) to use a standard `networking.k8s.io/v1 Ingress` resource. | | ||
| | ingress.ingress_annotations | `{ "nginx.ingress.kubernetes.io/proxy-body-size": "5m" }` | | Annotations applied to the standard `Ingress` resource. **Only used when `ingressClass` is not `traefik`.** When Traefik is selected, use `ingress.traefik.maxRequestBodyBytes` to control request body size instead. | | ||
| | ingress.traefik.maxRequestBodyBytes | `5242880` | | Maximum allowed request body size in bytes for Traefik's buffering middleware (default: 5 MiB). Only used when `ingressClass` starts with `traefik`. | | ||
| | ingress.traefik.entryPoints | `[]` | | Traefik entrypoints the `IngressRoute`s bind to. Leave empty to derive them from your `ssl.*` settings (`websecure` when TLS is configured, otherwise `web`). Set explicitly only if your Traefik renamed the default entrypoints, e.g. `["websecure","web"]`. Only used when `ingressClass` starts with `traefik` | | ||
| | ssl.createIssuer | false | | Kubernets cluster setup supports creating `issuer` type resource. After deployment, this is step towards creating secure access to the ingress url. Issuer is required for you generate SSL certifiate. Kubernetes can be configured to use any of the certificate authority to generate SSL (depending on CertManager configuration). Set it to `true` to create the issuer. Applicable only when `ingress.enabled=true` | | ||
|
Contributor
There was a problem hiding this comment. 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win Correct the wording in the Replace “Kubernets”, “certifiate”, and “for you generate” with “Kubernetes”, “certificate”, and “for generating”. 🧰 Tools🪛 LanguageTool[grammar] ~523-~523: Ensure spelling is correct (QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| | ssl.issuer | http | | CertManager configuration allows user to create issuers using `http` or any of the other DNS Providers like `cloudflare`, `digitalocean`, etc. As of now Plane supports `http`, `cloudflare`, `digitalocean` | | ||
| | ssl.token | | | To create issuers using DNS challenge, set the issuer api token of dns provider like cloudflare`or`digitalocean`(not required for http) | | ||
| | ssl.server | <https://acme-v02.api.letsencrypt.org/directory> | | Issuer creation configuration need the certificate generation authority server url. Default URL is the `Let's Encrypt` server | | ||
| | ssl.email | <plane@example.com> | | Certificate generation authority needs a valid email id before generating certificate. Required when `ssl.createIssuer=true` | | ||
| | ssl.generateCerts | false | | After creating the issuers, user can still not create the certificate untill sure of configuration. Setting this to `true` will try to generate SSL certificate and associate with ingress. Applicable only when `ingress.enabled=true` and `ssl.createIssuer=true` | | ||
| | ssl.tls_secret_name | | | If you have a custom TLS secret name, set this to the name of the secret. Applicable only when `ingress.enabled=true` and `ssl.createIssuer=false` | | ||
| | ssl.externalTermination | false | | Set to `true` when TLS is terminated in front of Plane and this chart manages no certificate (cloud load balancer, Cloudflare, service mesh, or a Traefik entrypoint carrying its own cert). The Traefik `IngressRoute`s bind to `websecure` but no `tls:` block is emitted. Leave `false` if you set `ssl.tls_secret_name` or `ssl.generateCerts` | | ||
|
|
||
| #### Using Traefik as the ingress controller | ||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -55,4 +55,63 @@ Call with a dict carrying the root context and the component values: | |
| {{- with .values.annotations }} | ||
| annotations: {{ toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| {{- end }} | ||
| {{/* | ||
| Returns "true" when THIS CHART has a TLS Secret to point an ingress at: either | ||
| the user supplied one via ssl.tls_secret_name, or cert-manager is set up to mint | ||
| one (ssl.generateCerts + ssl.createIssuer, which is what gates | ||
| templates/certs/certs.yaml). | ||
|
|
||
| Gates the `tls:` blocks. Never widen this to cover externally-terminated TLS -- | ||
| referencing a Secret that nothing creates is the bug this helper exists to stop. | ||
| */}} | ||
| {{- define "plane.chartManagedCert" -}} | ||
| {{- if or .Values.ssl.tls_secret_name (and .Values.ssl.generateCerts .Values.ssl.createIssuer) -}} | ||
| true | ||
| {{- end -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* | ||
| Returns "true" when users reach Plane over https://, whoever terminates it. | ||
|
|
||
| That is either a chart-managed certificate, or ssl.externalTermination for TLS | ||
| handled in front of Plane -- a cloud load balancer, Cloudflare, a service mesh, | ||
| or a Traefik entrypoint with its own certificate (`websecure.http.tls=true`). | ||
| The chart owns no Secret in that second case, so this must NOT be used to emit a | ||
| `tls:` block; use plane.chartManagedCert for that. | ||
| */}} | ||
| {{- define "plane.tlsEnabled" -}} | ||
| {{- if or (eq (include "plane.chartManagedCert" .) "true") .Values.ssl.externalTermination -}} | ||
| true | ||
| {{- end -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* | ||
| Traefik entrypoint names for the IngressRoutes. | ||
|
|
||
| Honours an explicit ingress.traefik.entryPoints override (some clusters rename | ||
| the defaults); otherwise derives them from whether TLS is configured, so an | ||
| install with SSL left off is reachable over plain HTTP instead of serving | ||
| Traefik's fallback self-signed certificate. | ||
|
|
||
| An empty value is the "derive it" sentinel, never a literal empty list -- the | ||
| CRD requires at least one entrypoint. A bare string is accepted and wrapped into | ||
| a single-item list, since `--set ingress.traefik.entryPoints=websecure` yields a | ||
| scalar and would otherwise render a list-less mapping the CRD rejects. | ||
| Caller must nindent to the correct depth. | ||
| */}} | ||
| {{- define "plane.traefikEntryPoints" -}} | ||
| {{- with .Values.ingress.traefik.entryPoints -}} | ||
| {{- if kindIs "string" . -}} | ||
| {{- toYaml (list .) -}} | ||
| {{- else -}} | ||
| {{- toYaml . -}} | ||
| {{- end -}} | ||
| {{- else -}} | ||
| {{- if eq (include "plane.tlsEnabled" $) "true" -}} | ||
| - websecure | ||
| {{- else -}} | ||
| - web | ||
| {{- end -}} | ||
|
Comment on lines
+111
to
+115
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
rendered="$(mktemp)"
trap 'rm -f "$rendered"' EXIT
helm template plane charts/plane-ce \
--set ingress.appHost=plane.example.test \
--set ssl.externalTermination=true > "$rendered"
# Verify that external TLS offload routes to Traefik's HTTP entrypoint by default.
rg -n -C2 'entryPoints:|^- websecure$|^- web$|^[[:space:]]+tls:' "$rendered"Repository: makeplane/helm-charts Length of output: 201 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- helper definitions and surrounding template ---'
cat -n charts/plane-ce/templates/_helpers.tpl | sed -n '80,135p'
printf '%s\n' '--- relevant values ---'
rg -n -C4 'externalTermination|traefik|entryPoints|tlsEnabled|chartManagedCert' charts/plane-ce/values.yaml charts/plane-ce/templates
printf '%s\n' '--- chart metadata and available tooling ---'
sed -n '1,160p' charts/plane-ce/Chart.yaml
command -v helm || true
git status --shortRepository: makeplane/helm-charts Length of output: 16921 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- SSL values and comments ---'
cat -n charts/plane-ce/values.yaml | sed -n '18,58p'
printf '%s\n' '--- all externalTermination references ---'
rg -n -C5 'externalTermination|traefikEntryPoints|tlsEnabled|chartManagedCert' --glob '!charts/plane-ce/templates/_helpers.tpl' .
printf '%s\n' '--- IngressRoute route matching and TLS sections ---'
cat -n charts/plane-ce/templates/ingress-traefik.yaml | sed -n '1,84p'
printf '%s\n' '--- documentation and tests mentioning Traefik entrypoints or termination ---'
rg -n -i -C3 'external termination|externalTermination|entrypoint|entryPoints|websecure|TLS termination|tls termination' \
--glob 'README*' --glob '*.md' --glob '*test*' --glob '*spec*' charts .Repository: makeplane/helm-charts Length of output: 48544 🏁 Script executed: #!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
helpers = Path("charts/plane-ce/templates/_helpers.tpl").read_text()
values = Path("charts/plane-ce/values.yaml").read_text()
readme = Path("charts/plane-ce/README.md").read_text()
assert 'if eq (include "plane.tlsEnabled" $) "true"' in helpers
assert 'or (eq (include "plane.chartManagedCert" .) "true") .Values.ssl.externalTermination' in helpers
assert '- websecure' in helpers and '- web' in helpers
assert 'externalTermination: true' in values
assert "externalTermination) -> ['websecure']" in values
assert '| TLS terminated in front of Plane | `ssl.externalTermination: true` | `websecure` | — |' in readme
def derived_entrypoint(chart_managed_cert, external_termination):
return "websecure" if chart_managed_cert or external_termination else "web"
for managed, external, expected in [
(False, False, "web"),
(True, False, "websecure"),
(False, True, "websecure"),
(True, True, "websecure"),
]:
actual = derived_entrypoint(managed, external)
print(f"chartManagedCert={managed}, externalTermination={external} -> {actual}")
assert actual == expected
print("The helper maps externalTermination=true to websecure.")
print("The helper cannot distinguish TLS terminated before Traefik from TLS terminated by Traefik.")
PYRepository: makeplane/helm-charts Length of output: 248 🌐 Web query:
💡 Result: When Traefik is placed behind an external proxy or load balancer that performs TLS termination (such as an AWS ALB or an Nginx reverse proxy), it receives plain HTTP traffic. To ensure your applications correctly identify the original protocol (HTTPS) and other request details, you must configure Traefik to trust the headers forwarded by the upstream proxy [1]. ### Configuration for External TLS Termination You should configure the EntryPoint that receives traffic from your external proxy to trust its IP address. This prevents Traefik from ignoring or overwriting the X-Forwarded-* headers provided by the upstream load balancer [1]. In your static configuration, add the Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
helpers = Path("charts/plane-ce/templates/_helpers.tpl").read_text()
values = Path("charts/plane-ce/values.yaml").read_text()
readme = Path("charts/plane-ce/README.md").read_text()
ingress = Path("charts/plane-ce/templates/ingress-traefik.yaml").read_text()
checks = {
"tlsEnabled includes chartManagedCert": 'eq (include "plane.chartManagedCert" .) "true") .Values.ssl.externalTermination' in helpers,
"entrypoint branches on tlsEnabled": 'if eq (include "plane.tlsEnabled" $) "true"' in helpers,
"secure branch exists": re.search(r'\n-\s*websecure\b', helpers) is not None,
"HTTP branch exists": re.search(r'\n-\s*web\b', helpers) is not None,
"externalTermination value exists": "externalTermination: false" in values,
"IngressRoutes use helper": ingress.count('include "plane.traefikEntryPoints" .') == 3,
"managed TLS is separate": ingress.count('include "plane.chartManagedCert" .') == 3,
}
for name, result in checks.items():
print(f"{name}: {result}")
def derived_entrypoint(chart_managed_cert, external_termination):
return "websecure" if chart_managed_cert or external_termination else "web"
print("derived cases:")
for managed, external in [(False, False), (True, False), (False, True), (True, True)]:
print(f" chartManagedCert={managed}, externalTermination={external}: "
f"{derived_entrypoint(managed, external)}")
assert all(checks.values())
assert derived_entrypoint(False, True) == "websecure"
assert derived_entrypoint(False, False) == "web"
print("The current helper selects websecure when externalTermination=true.")
PYRepository: makeplane/helm-charts Length of output: 719 Use When an external load balancer terminates TLS and forwards HTTP to Traefik’s 🤖 Prompt for AI Agents |
||
| {{- end -}} | ||
| {{- end -}} | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Describe
webandwebsecureas derived defaults.ingress.traefik.entryPointsoverrides the derived entrypoint list. Therefore, thewebandwebsecurevalues in these tables are not guaranteed when a custom list is configured. State that they are defaults used only whenentryPointsis empty. Also update the later fixedwebsecuredescription at Line 536.Also applies to: 522-522
🤖 Prompt for AI Agents