feat: migrate ingresses to traefik

2025-09-17 18:24:14 +02:00 · 2021-08-06 15:48:03 +02:00
parent 86fd42fd3e
commit c10ac797a1
43 changed files with 127 additions and 307 deletions
--- a/cluster/apps/data/bookstack/helm-release.yaml
+++ b/cluster/apps/data/bookstack/helm-release.yaml
@@ -50,8 +50,9 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Bookstack"
          forecastle.stakater.com/icon: "https://yunohost.org/user/images/logo-bookstack.png?height=80?height=80"
@@ -61,9 +62,6 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "bookstack.${SECRET_CLUSTER_DOMAIN}"
    persistence:
      config:
        enabled: true
--- a/cluster/apps/data/forecastle/helm-release.yaml
+++ b/cluster/apps/data/forecastle/helm-release.yaml
@@ -30,7 +30,9 @@ spec:
      ingress:
        enabled: true
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          kubernetes.io/ingress.class: "traefik"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
        hosts:
          - host: home.${SECRET_CLUSTER_DOMAIN}
            paths:
@@ -38,7 +40,3 @@ spec:
          - host: services.${SECRET_CLUSTER_DOMAIN}
            paths:
              - /
-        tls:
-          - hosts:
-              - home.${SECRET_CLUSTER_DOMAIN}
-              - services.${SECRET_CLUSTER_DOMAIN}
--- a/cluster/apps/data/freshrss/helm-release.yaml
+++ b/cluster/apps/data/freshrss/helm-release.yaml
@@ -37,7 +37,8 @@ spec:
      main:
        enabled: true
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          kubernetes.io/ingress.class: "traefik"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "FreshRSS"
          forecastle.stakater.com/icon: "https://raw.githubusercontent.com/FreshRSS/FreshRSS/edge/docs/img/FreshRSS-logo.png"
--- a/cluster/apps/data/joplin-server/helm-release.yaml
+++ b/cluster/apps/data/joplin-server/helm-release.yaml
@@ -27,8 +27,6 @@ spec:
    strategy:
      type: Recreate

-    resources: {}
-
    service:
      main:
        annotations:
@@ -48,13 +46,12 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          kubernetes.io/ingress.class: "traefik"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
        hosts:
          - host: joplin.${SECRET_CLUSTER_DOMAIN}
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "joplin.${SECRET_CLUSTER_DOMAIN}"
--- a/cluster/apps/data/pgadmin/helm-release.yaml
+++ b/cluster/apps/data/pgadmin/helm-release.yaml
@@ -29,11 +29,9 @@ spec:
    ingress:
      enabled: true
      annotations:
-        kubernetes.io/ingress.class: "nginx"
-        # -- Nginx client Body Buffer Size
-        nginx.ingress.kubernetes.io/client-body-buffer-size: "50m"
-        # -- Nginx Proxy Body Size
-        nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+        kubernetes.io/ingress.class: "traefik"
+        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-medium@kubernetescrd
        forecastle.stakater.com/expose: "true"
        forecastle.stakater.com/appName: "pgAdmin"
        forecastle.stakater.com/icon: "https://bitnami.com/assets/stacks/postgresql/img/postgresql-stack-110x117.png"
@@ -43,9 +41,6 @@ spec:
          paths:
            - path: /
              pathType: Prefix
-      tls:
-        - hosts:
-            - pgadmin.${SECRET_CLUSTER_DOMAIN}
    persistentVolume:
      enabled: true
      existingClaim: pgadmin-config
--- a/cluster/apps/data/recipes/helm-release.yaml
+++ b/cluster/apps/data/recipes/helm-release.yaml
@@ -52,9 +52,10 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/client-body-buffer-size: "10m"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-small@kubernetescrd
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Recipes"
          forecastle.stakater.com/icon: "https://raw.githubusercontent.com/vabene1111/recipes/develop/docs/logo_color.svg"
@@ -64,9 +65,6 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "recipes.${SECRET_CLUSTER_DOMAIN}"
    persistence:
      media:
        enabled: true
--- a/cluster/apps/data/resilio-sync/statefulset.yaml
+++ b/cluster/apps/data/resilio-sync/statefulset.yaml
@@ -206,7 +206,8 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
-    kubernetes.io/ingress.class: "nginx"
+    kubernetes.io/ingress.class: "traefik"
+    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
    forecastle.stakater.com/expose: "true"
    forecastle.stakater.com/appName: "Resilio Sync"
    forecastle.stakater.com/icon: "https://avatars.githubusercontent.com/u/12284211?s=200&v=4"
@@ -238,7 +239,3 @@ spec:
                name: resilio-sync
                port:
                  number: 8889
-  tls:
-    - hosts:
-        - resilio-sync-claude.${SECRET_CLUSTER_DOMAIN}
-        - resilio-sync-helene.${SECRET_CLUSTER_DOMAIN}
--- a/cluster/apps/data/sharry/helm-release.yaml
+++ b/cluster/apps/data/sharry/helm-release.yaml
@@ -43,12 +43,10 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          # -- Nginx client Body Buffer Size
-          nginx.ingress.kubernetes.io/client-body-buffer-size: "2048m"
-          # -- Nginx Proxy Body Size
-          nginx.ingress.kubernetes.io/proxy-body-size: "2048m"
-          nginx.ingress.kubernetes.io/proxy-buffering: "off"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-large@kubernetescrd
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Sharry"
          forecastle.stakater.com/icon: "https://raw.githubusercontent.com/eikek/sharry/master/artwork/icon.png"
@@ -58,9 +56,6 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "sharry.${SECRET_CLUSTER_DOMAIN}"

    config: |
      sharry.restserver {
--- a/cluster/apps/data/vaultwarden/helm-release.yaml
+++ b/cluster/apps/data/vaultwarden/helm-release.yaml
@@ -44,8 +44,9 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Vaultwarden"
          forecastle.stakater.com/icon: "https://image.winudf.com/v2/image1/Y29tLng4Yml0LmJpdHdhcmRlbl9pY29uXzE1OTM0NTk3NDNfMDA2/icon.png?fakeurl=1&h=120"
@@ -64,10 +65,6 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "vaultwarden.${SECRET_CLUSTER_DOMAIN}"
-              - "bitwarden.${SECRET_CLUSTER_DOMAIN}"
    persistence:
      config:
        enabled: true
--- a/cluster/apps/data/vikunja/helm-release.yaml
+++ b/cluster/apps/data/vikunja/helm-release.yaml
@@ -60,8 +60,9 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Vikunja"
          forecastle.stakater.com/icon: "https://vikunja.io/docs/images/vikunja-logo-white.svg"
@@ -71,9 +72,6 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "vikunja.${SECRET_CLUSTER_DOMAIN}"

    persistence:
      files:
--- a/cluster/apps/data/wallabag/helm-release.yaml
+++ b/cluster/apps/data/wallabag/helm-release.yaml
@@ -45,8 +45,9 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Wallabag"
          forecastle.stakater.com/icon: "https://cdnx.nextinpact.com/compress/850-412/data-next/images/bd/wide-linked-media/545.jpg"
@@ -56,9 +57,6 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - wallabag.${SECRET_CLUSTER_DOMAIN}
    persistence:
      images:
        enabled: true
--- a/cluster/apps/development/docker-registry/helm-release.yaml
+++ b/cluster/apps/development/docker-registry/helm-release.yaml
@@ -32,15 +32,11 @@ spec:
    ingress:
      enabled: true
      annotations:
-        kubernetes.io/ingress.class: "nginx"
-        nginx.ingress.kubernetes.io/proxy-body-size: "0"
-        nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-        nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+        kubernetes.io/ingress.class: "traefik"
+        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-large@kubernetescrd
      hosts:
        - registry.${SECRET_CLUSTER_DOMAIN}
-      tls:
-        - hosts:
-            - registry.${SECRET_CLUSTER_DOMAIN}
    service:
      annotations:
        prometheus.io/probe: "true"
--- a/cluster/apps/development/drone/helm-release.yaml
+++ b/cluster/apps/development/drone/helm-release.yaml
@@ -40,9 +40,9 @@ spec:
      DRONE_SERVER_HOST: drone.${SECRET_CLUSTER_DOMAIN}
    ingress:
      enabled: true
+      annotations:
+        kubernetes.io/ingress.class: "traefik"
+        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
      hosts:
        - host: drone.${SECRET_CLUSTER_DOMAIN}
          paths: ["/"]
-      tls:
-        - hosts:
-            - drone.${SECRET_CLUSTER_DOMAIN}
--- a/cluster/apps/development/gitea/helm-release.yaml
+++ b/cluster/apps/development/gitea/helm-release.yaml
@@ -27,16 +27,13 @@ spec:
    ingress:
      enabled: true
      annotations:
-        kubernetes.io/ingress.class: "nginx"
-        nginx.ingress.kubernetes.io/proxy-body-size: 128m
+        kubernetes.io/ingress.class: "traefik"
+        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
      hosts:
        - host: "gitea.${SECRET_CLUSTER_DOMAIN}"
          paths:
            - path: /
              pathType: Prefix
-      tls:
-        - hosts:
-            - "gitea.${SECRET_CLUSTER_DOMAIN}"
    service:
      annotations:
        prometheus.io/probe: "true"
--- a/cluster/apps/home-automation/emqx/helm-release.yaml
+++ b/cluster/apps/home-automation/emqx/helm-release.yaml
@@ -30,13 +30,11 @@ spec:
      dashboard:
        enabled: true
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          kubernetes.io/ingress.class: "traefik"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
        path: /
        hosts:
          - emqx.${SECRET_CLUSTER_DOMAIN}
-        tls:
-          - hosts:
-              - emqx.${SECRET_CLUSTER_DOMAIN}
    emqxConfig:
      EMQX_ALLOW_ANONYMOUS: "false"
      EMQX_ADMIN_PASSWORD: "${SECRET_EMQX_ADMIN_PASSWORD}"
--- a/cluster/apps/home-automation/frigate/helm-release.yaml
+++ b/cluster/apps/home-automation/frigate/helm-release.yaml
@@ -24,17 +24,14 @@ spec:
      main:
        enabled: true
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
+          kubernetes.io/ingress.class: "traefik"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
        hosts:
          - host: "frigate.${SECRET_CLUSTER_DOMAIN}"
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "frigate.${SECRET_CLUSTER_DOMAIN}"
    service:
      main:
        annotations:
--- a/cluster/apps/home-automation/home-assistant/helm-release.yaml
+++ b/cluster/apps/home-automation/home-assistant/helm-release.yaml
@@ -44,8 +44,9 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
        hosts:
          - host: hass.${SECRET_CLUSTER_DOMAIN}
            paths:
@@ -55,9 +56,6 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "home-assistant.${SECRET_CLUSTER_DOMAIN}"
    prometheus:
      serviceMonitor:
        enabled: false
@@ -88,18 +86,14 @@ spec:
          - "/config/.vscode"
        ingress:
          enabled: true
+          ingressClassName: "traefik"
          annotations:
-            kubernetes.io/ingress.class: "nginx"
-            nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-            nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
+            traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
          hosts:
            - host: hass-config.${SECRET_CLUSTER_DOMAIN}
              paths:
                - path: /
                  pathType: Prefix
-          tls:
-            - hosts:
-                - hass-config.${SECRET_CLUSTER_DOMAIN}
        volumeMounts:
          - name: config
            mountPath: /config
--- a/cluster/apps/home-automation/zigbee2mqtt/helm-release.yaml
+++ b/cluster/apps/home-automation/zigbee2mqtt/helm-release.yaml
@@ -69,18 +69,15 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
        hosts:
          - host: "zigbee.${SECRET_CLUSTER_DOMAIN}"
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "zigbee.${SECRET_CLUSTER_DOMAIN}"
    persistence:
      config:
        enabled: true
@@ -96,8 +93,4 @@ spec:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
            - matchExpressions:
-                - {
-                    key: "feature.node.kubernetes.io/custom-zigbee",
-                    operator: In,
-                    values: ["true"],
-                  }
+                - { key: "feature.node.kubernetes.io/custom-zigbee", operator: In, values: ["true"] }
--- a/cluster/apps/home-automation/zwavejs2mqtt/helm-release.yaml
+++ b/cluster/apps/home-automation/zwavejs2mqtt/helm-release.yaml
@@ -28,10 +28,10 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
        hosts:
          - host: zwave.${SECRET_CLUSTER_DOMAIN}
            paths:
@@ -60,8 +60,4 @@ spec:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
            - matchExpressions:
-                - {
-                    key: "feature.node.kubernetes.io/custom-zwave",
-                    operator: In,
-                    values: ["true"],
-                  }
+                - { key: "feature.node.kubernetes.io/custom-zwave", operator: In, values: ["true"] }
--- a/cluster/apps/kasten-io/k10/helm-release.yaml
+++ b/cluster/apps/kasten-io/k10/helm-release.yaml
@@ -36,13 +36,10 @@ spec:
    clusterName: k3s
    ingress:
      create: true
-      class: "nginx"
+      class: "traefik"
      host: "k10.${SECRET_CLUSTER_DOMAIN}"
      annotations:
-        nginx.ingress.kubernetes.io/app-root: /k10
+        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
      urlPath: k10
      hosts:
        - "k10.${SECRET_CLUSTER_DOMAIN}"
-      tls:
-        enabled: true
-        secretName: "${SECRET_CLUSTER_DOMAIN/./-}-tls"
--- a/cluster/apps/media/bazarr/helm-release.yaml
+++ b/cluster/apps/media/bazarr/helm-release.yaml
@@ -50,23 +50,12 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
-          nginx.ingress.kubernetes.io/configuration-snippet: |
-            proxy_set_header Accept-Encoding "";
-            sub_filter '</head>' '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/bazarr/space-gray.css"></head>';
-            sub_filter_once on;
-          forecastle.stakater.com/expose: "true"
-          forecastle.stakater.com/appName: "Bazarr"
-          forecastle.stakater.com/icon: "https://raw.githubusercontent.com/morpheus65535/bazarr/4ba88228177dcfac93dc74e375cfa49eda29ad21/static/logo128.png"
-          forecastle.stakater.com/network-restricted: "true"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
        hosts:
          - host: bazarr.${SECRET_CLUSTER_DOMAIN}
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "bazarr.${SECRET_CLUSTER_DOMAIN}"
--- a/cluster/apps/media/flood/helm-release.yaml
+++ b/cluster/apps/media/flood/helm-release.yaml
@@ -36,9 +36,9 @@ spec:
      main:
        enabled: true
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
+          kubernetes.io/ingress.class: "traefik"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Flood"
          forecastle.stakater.com/icon: "https://raw.githubusercontent.com/jesec/flood/master/flood.svg"
@@ -48,9 +48,6 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "flood.${SECRET_CLUSTER_DOMAIN}"
    persistence:
      data:
        enabled: true
--- a/cluster/apps/media/jellyfin/helm-release.yaml
+++ b/cluster/apps/media/jellyfin/helm-release.yaml
@@ -53,8 +53,9 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Jellyfin"
          forecastle.stakater.com/icon: "https://features.jellyfin.org/images/logos/a7Lx9nYDzWuDR94Az8Yum7neWMvNMndkm9qr4QVtmjaMrOHDLisS5K7LJctTRzK9-icon-transparent.png?size=200"
@@ -63,9 +64,6 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "jellyfin.${SECRET_CLUSTER_DOMAIN}"
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
--- a/cluster/apps/media/lidarr/helm-release.yaml
+++ b/cluster/apps/media/lidarr/helm-release.yaml
@@ -31,43 +31,29 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
-          nginx.ingress.kubernetes.io/configuration-snippet: |
-            proxy_set_header Accept-Encoding "";
-            sub_filter '</head>' '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/lidarr/space-gray.css"></head>';
-            sub_filter_once on;
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Lidarr"
          forecastle.stakater.com/icon: "https://raw.githubusercontent.com/lidarr/Lidarr/14c3d31c2bf64893e9e7c137a04bfc096e6d36fe/frontend/src/Content/Images/Icons/android-chrome-192x192.png"
          forecastle.stakater.com/network-restricted: "true"
-          # -- Nginx client Body Buffer Size
-          nginx.ingress.kubernetes.io/client-body-buffer-size: "20m"
-          # -- Nginx Proxy Body Size
-          nginx.ingress.kubernetes.io/proxy-body-size: "20m"
-          nginx.ingress.kubernetes.io/proxy-buffering: "off"
        hosts:
          - host: lidarr.${SECRET_CLUSTER_DOMAIN}
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "liddarr.${SECRET_CLUSTER_DOMAIN}"
      api:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
        hosts:
          - host: "lidarr.${SECRET_CLUSTER_DOMAIN}"
            paths:
              - path: /api
                pathType: Prefix
-        tls:
-          - hosts:
-              - "lidarr.${SECRET_CLUSTER_DOMAIN}"
    persistence:
      config:
        enabled: true
--- a/cluster/apps/media/lychee/helm-release.yaml
+++ b/cluster/apps/media/lychee/helm-release.yaml
@@ -34,8 +34,9 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Lychee"
          forecastle.stakater.com/icon: "https://lycheeorg.github.io/docs/img/logo.png"
@@ -44,9 +45,6 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "lychee.${SECRET_CLUSTER_DOMAIN}"

    env:
      PHP_TZ: Europe/Paris
--- a/cluster/apps/media/navidrome/helm-release.yaml
+++ b/cluster/apps/media/navidrome/helm-release.yaml
@@ -31,8 +31,9 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Navidrome"
          forecastle.stakater.com/icon: "https://raw.githubusercontent.com/navidrome/navidrome/master/resources/logo-192x192.png"
@@ -42,9 +43,6 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "navidrome.${SECRET_CLUSTER_DOMAIN}"
    env:
      ND_SCANINTERVAL: 15m
      ND_LOGLEVEL: info
--- a/cluster/apps/media/prowlarr/helm-release.yaml
+++ b/cluster/apps/media/prowlarr/helm-release.yaml
@@ -35,10 +35,10 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Prowlarr"
          forecastle.stakater.com/icon: "https://raw.githubusercontent.com/Prowlarr/Prowlarr/develop/Logo/256.png"
@@ -48,9 +48,6 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "prowlarr.${SECRET_CLUSTER_DOMAIN}"
    resources:
      requests:
        memory: 100Mi
--- a/cluster/apps/media/pyload/helm-release.yaml
+++ b/cluster/apps/media/pyload/helm-release.yaml
@@ -46,10 +46,9 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "pyLoad"
          forecastle.stakater.com/icon: "https://raw.githubusercontent.com/pyload/pyload/main/media/logo.png"
@@ -59,6 +58,3 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "pyload.${SECRET_CLUSTER_DOMAIN}"
--- a/cluster/apps/media/qbittorrent/helm-release.yaml
+++ b/cluster/apps/media/qbittorrent/helm-release.yaml
@@ -63,8 +63,9 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "qBittorrent"
          forecastle.stakater.com/icon: "https://upload.wikimedia.org/wikipedia/commons/thumb/6/66/New_qBittorrent_Logo.svg/600px-New_qBittorrent_Logo.svg.png"
@@ -74,6 +75,3 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "qbittorrent.${SECRET_CLUSTER_DOMAIN}"
--- a/cluster/apps/media/radarr/helm-release.yaml
+++ b/cluster/apps/media/radarr/helm-release.yaml
@@ -31,43 +31,29 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
-          nginx.ingress.kubernetes.io/configuration-snippet: |
-            proxy_set_header Accept-Encoding "";
-            sub_filter '</head>' '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/radarr/space-gray.css"></head>';
-            sub_filter_once on;
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Radarr"
          forecastle.stakater.com/icon: "https://raw.githubusercontent.com/Radarr/Radarr/develop/Logo/256.png"
          forecastle.stakater.com/network-restricted: "true"
-          # -- Nginx client Body Buffer Size
-          nginx.ingress.kubernetes.io/client-body-buffer-size: "20m"
-          # -- Nginx Proxy Body Size
-          nginx.ingress.kubernetes.io/proxy-body-size: "20m"
-          nginx.ingress.kubernetes.io/proxy-buffering: "off"
        hosts:
          - host: radarr.${SECRET_CLUSTER_DOMAIN}
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "radarr.${SECRET_CLUSTER_DOMAIN}"
      api:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
        hosts:
          - host: "radarr.${SECRET_CLUSTER_DOMAIN}"
            paths:
              - path: /api
                pathType: Prefix
-        tls:
-          - hosts:
-              - "radarr.${SECRET_CLUSTER_DOMAIN}"
    persistence:
      config:
        enabled: true
--- a/cluster/apps/media/sabnzbd/helm-release.yaml
+++ b/cluster/apps/media/sabnzbd/helm-release.yaml
@@ -31,14 +31,10 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
-          nginx.ingress.kubernetes.io/configuration-snippet: |
-            proxy_set_header Accept-Encoding "";
-            sub_filter '</head>' '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/sabnzbd/space-gray.css"></head>';
-            sub_filter_once on;
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "SABnzbd"
          forecastle.stakater.com/icon: "https://avatars.githubusercontent.com/u/16778130?v=4"
@@ -48,22 +44,17 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "sabnzbd.${SECRET_CLUSTER_DOMAIN}"
      api:
        enabled: true
+        ingressClassName: "traefik"
        nameSuffix: "api"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
        hosts:
          - host: "sabnzbd.${SECRET_CLUSTER_DOMAIN}"
            paths:
              - path: /api
                pathType: Prefix
-        tls:
-          - hosts:
-              - "sabnzbd.${SECRET_CLUSTER_DOMAIN}"
    persistence:
      config:
        enabled: true
--- a/cluster/apps/media/sonarr/helm-release.yaml
+++ b/cluster/apps/media/sonarr/helm-release.yaml
@@ -31,43 +31,29 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
-          nginx.ingress.kubernetes.io/configuration-snippet: |
-            proxy_set_header Accept-Encoding "";
-            sub_filter '</head>' '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/sonarr/space-gray.css"></head>';
-            sub_filter_once on;
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Sonarr"
          forecastle.stakater.com/icon: "https://raw.githubusercontent.com/Sonarr/Sonarr/develop/Logo/256.png"
          forecastle.stakater.com/network-restricted: "true"
-          # -- Nginx client Body Buffer Size
-          nginx.ingress.kubernetes.io/client-body-buffer-size: "20m"
-          # -- Nginx Proxy Body Size
-          nginx.ingress.kubernetes.io/proxy-body-size: "20m"
-          nginx.ingress.kubernetes.io/proxy-buffering: "off"
        hosts:
          - host: sonarr.${SECRET_CLUSTER_DOMAIN}
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "sonarr.${SECRET_CLUSTER_DOMAIN}"
      api:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
        hosts:
          - host: "sonarr.${SECRET_CLUSTER_DOMAIN}"
            paths:
              - path: /api
                pathType: Prefix
-        tls:
-          - hosts:
-              - "sonarr.${SECRET_CLUSTER_DOMAIN}"
    persistence:
      config:
        enabled: true
--- a/cluster/apps/media/tdarr/helm-release.yaml
+++ b/cluster/apps/media/tdarr/helm-release.yaml
@@ -62,10 +62,10 @@ spec:
    ingress:
      main:
        enabled: true
+        ingressClassName: "traefik"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
          forecastle.stakater.com/expose: "true"
          forecastle.stakater.com/appName: "Tdarr"
          forecastle.stakater.com/icon: "https://raw.githubusercontent.com/HaveAGitGat/Tdarr/master/public/images/icon_dark.png"
@@ -75,6 +75,3 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "tdarr.${SECRET_CLUSTER_DOMAIN}"
--- a/cluster/apps/media/travelstories/deployment.yaml
+++ b/cluster/apps/media/travelstories/deployment.yaml
@@ -79,9 +79,9 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
-    kubernetes.io/ingress.class: "nginx"
-    nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-    nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
+    kubernetes.io/ingress.class: "traefik"
+    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+    traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd, networking-buffering-small@kubernetescrd
    forecastle.stakater.com/expose: "true"
    forecastle.stakater.com/appName: "Travelstories"
    forecastle.stakater.com/icon: "https://image.flaticon.com/icons/png/512/120/120653.png"
@@ -102,6 +102,3 @@ spec:
                name: travelstories
                port:
                  number: 80
-  tls:
-    - hosts:
-        - travelstories.${SECRET_CLUSTER_DOMAIN}
--- a/cluster/apps/monitoring/blackbox-exporter/helm-release.yaml
+++ b/cluster/apps/monitoring/blackbox-exporter/helm-release.yaml
@@ -87,15 +87,11 @@ spec:
    ingress:
      enabled: true
      annotations:
-        kubernetes.io/ingress.class: "nginx"
-        nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-        nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
+        kubernetes.io/ingress.class: "traefik"
+        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
      hosts:
        - host: "blackbox.${SECRET_CLUSTER_DOMAIN}"
          paths:
            - path: /
-              pathType: ImplementationSpecific
-
-      tls:
-        - hosts:
-            - "blackbox.${SECRET_CLUSTER_DOMAIN}"
+              pathType: Prefix
--- a/cluster/apps/monitoring/healthchecks/helm-release.yaml
+++ b/cluster/apps/monitoring/healthchecks/helm-release.yaml
@@ -53,14 +53,6 @@ spec:
          prometheus.io/probe: "true"
          prometheus.io/protocol: http

-    nodeSelector: {}
-
-    tolerations: []
-
-    affinity: {}
-
-    podAnnotations: {}
-
    persistence:
      config:
        enabled: false
@@ -76,6 +68,3 @@ spec:
            paths:
              - path: /
                pathType: Prefix
-        tls:
-          - hosts:
-              - "healthchecks.${SECRET_CLUSTER_DOMAIN}"
--- a/cluster/apps/monitoring/kube-prometheus-stack/helm-release.yaml
+++ b/cluster/apps/monitoring/kube-prometheus-stack/helm-release.yaml
@@ -33,13 +33,10 @@ spec:
        enabled: true
        pathType: Prefix
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
+          kubernetes.io/ingress.class: "traefik"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
        hosts: ["alert-manager.${SECRET_CLUSTER_DOMAIN}"]
-        tls:
-          - hosts:
-              - alert-manager.${SECRET_CLUSTER_DOMAIN}
      config:
        global:
          resolve_timeout: 5m
@@ -199,11 +196,9 @@ spec:
        enabled: true
        pathType: Prefix
        annotations:
-          kubernetes.io/ingress.class: "nginx"
+          kubernetes.io/ingress.class: "traefik"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
        hosts: ["grafana.${SECRET_CLUSTER_DOMAIN}"]
-        tls:
-          - hosts:
-              - grafana.${SECRET_CLUSTER_DOMAIN}
    kubeEtcd:
      enabled: false
    kubeControllerManager:
@@ -217,13 +212,10 @@ spec:
        enabled: true
        pathType: Prefix
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
+          kubernetes.io/ingress.class: "traefik"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
        hosts: ["prometheus.${SECRET_CLUSTER_DOMAIN}"]
-        tls:
-          - hosts:
-              - prometheus.${SECRET_CLUSTER_DOMAIN}
      prometheusSpec:
        replicas: 2
        replicaExternalLabelName: "replica"
--- a/cluster/apps/monitoring/thanos/helm-release.yaml
+++ b/cluster/apps/monitoring/thanos/helm-release.yaml
@@ -29,10 +29,10 @@ spec:
        enabled: true
        hostname: "thanos.${SECRET_CLUSTER_DOMAIN}"
        annotations:
-          kubernetes.io/ingress.class: "nginx"
-          nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local./api/verify"
-          nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}/"
-        tls: true
+          kubernetes.io/ingress.class: "traefik"
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+          traefik.ingress.kubernetes.io/router.middlewares: networking-forward-auth@kubernetescrd
+        tls: false
    queryFrontend:
      enabled: false
    bucketweb:
--- a/cluster/apps/monitoring/uptime-kuma/statefulset.yaml
+++ b/cluster/apps/monitoring/uptime-kuma/statefulset.yaml
@@ -68,7 +68,8 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
-    kubernetes.io/ingress.class: "nginx"
+    kubernetes.io/ingress.class: "traefik"
+    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
  labels:
    app.kubernetes.io/instance: uptime-kuma
    app.kubernetes.io/name: uptime-kuma
@@ -86,6 +87,3 @@ spec:
                name: uptime-kuma
                port:
                  number: 3001
-  tls:
-    - hosts:
-        - uptime-kuma.${SECRET_CLUSTER_DOMAIN}
--- a/cluster/apps/networking/authelia/deployment.yaml
+++ b/cluster/apps/networking/authelia/deployment.yaml
@@ -91,16 +91,14 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
-    kubernetes.io/ingress.class: "nginx"
+    kubernetes.io/ingress.class: "traefik"
+    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
  labels:
    app.kubernetes.io/instance: authelia
    app.kubernetes.io/name: authelia
  name: authelia
  namespace: networking
 spec:
-  tls:
-    - hosts:
-        - login.${SECRET_CLUSTER_DOMAIN}
  rules:
    - host: login.${SECRET_CLUSTER_DOMAIN}
      http:
--- a/cluster/apps/networking/authentik/helm-release.yaml
+++ b/cluster/apps/networking/authentik/helm-release.yaml
@@ -23,14 +23,13 @@ spec:

    ingress:
      enabled: true
-      ingressClassName: "nginx"
+      ingressClassName: "traefik"
+      annotations:
+        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
      hosts:
        - host: id.${SECRET_CLUSTER_DOMAIN}
          paths:
            - path: /
-      tls:
-        - hosts:
-            - id.${SECRET_CLUSTER_DOMAIN}

    geoip:
      enabled: false
--- a/cluster/apps/networking/unifi/helm-release.yaml
+++ b/cluster/apps/networking/unifi/helm-release.yaml
@@ -32,14 +32,11 @@ spec:
    ingress:
      enabled: true
      annotations:
-        kubernetes.io/ingress.class: "nginx"
-        nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
-        nginx.ingress.kubernetes.io/proxy-body-size: 10m
+        kubernetes.io/ingress.class: "traefik"
+        traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+        traefik.ingress.kubernetes.io/router.middlewares: networking-buffering-medium@kubernetescrd
      hosts:
        - unifi.${SECRET_CLUSTER_DOMAIN}
-      tls:
-        - hosts:
-            - unifi.${SECRET_CLUSTER_DOMAIN}
    guiService:
      type: LoadBalancer
      externalIPs:
--- a/cluster/core/rook-ceph/dashboard/ingress.yaml
+++ b/cluster/core/rook-ceph/dashboard/ingress.yaml
@@ -5,8 +5,8 @@ metadata:
  name: rook-ceph-mgr-dashboard
  namespace: rook-ceph
  annotations:
-    kubernetes.io/ingress.class: "nginx"
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    kubernetes.io/ingress.class: "traefik"
+    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
  labels:
    app.kubernetes.io/instance: rook-ceph-mgr-dashboard
    app.kubernetes.io/name: rook-ceph-mgr-dashboard
@@ -22,6 +22,3 @@ spec:
                name: rook-ceph-mgr-dashboard
                port:
                  name: http-dashboard
-  tls:
-    - hosts:
-        - "rook.${SECRET_CLUSTER_DOMAIN}"